If someone in your life seems to know things they shouldn’t — where you went, who you messaged, what you searched for — it is natural to wonder whether your phone is being monitored. That worry is not paranoia. The eSafety Commissioner (esafety.gov.au) has repeatedly flagged technology-facilitated abuse as a common feature of domestic and family violence, and monitoring software, often called stalkerware, is one of the ways it happens.
This article walks through the warning signs, explains why the obvious response — deleting the app or resetting the phone — can actually make things worse, and describes what a proper forensic examination involves. If you are in immediate danger, call 000. For confidential support any time, 1800RESPECT is available on 1800 737 732.
One important note before anything else: if you suspect your phone is monitored, try to research and seek help from a device the other person has never had access to — a friend’s phone, a work computer, or a library computer. Searches and calls made on a monitored phone may be visible to the person monitoring it.
What stalkerware actually is
Stalkerware is software installed on a phone to secretly report its activity to someone else — messages, call logs, location, photos, sometimes even the microphone or camera. Despite how it is marketed (“parental control”, “employee monitoring”), installing it on another adult’s phone without consent is unlawful across Australia.
A key fact that surprises many people: stalkerware generally requires physical access to an unlocked phone to install. It usually cannot be planted remotely just by sending a text or knowing your number. So the realistic risk window is a relationship, or a period of contact, where the other person could handle your phone while it was unlocked — or knew your passcode.
Monitoring does not always involve stalkerware, either. Sometimes the “spying” happens through a shared iCloud or Google account, linked devices, or old backups. We cover those pathways in Is My Ex Reading My Messages?, and physical tracking devices separately in GPS Trackers, AirTags and Cars.
Warning signs worth paying attention to
No single sign proves anything on its own. Phones slow down, batteries age, and data usage varies. But a cluster of the following, especially alongside someone knowing things they shouldn’t, is worth taking seriously:
Behaviour of the phone
- Battery draining noticeably faster than it used to, without a change in how you use the phone. Monitoring software works constantly in the background.
- The phone running warm while idle in your pocket or on a table.
- Unexplained spikes in mobile data usage — stalkerware has to upload what it collects.
- Unfamiliar apps, or apps with generic names like “System Service” or “Device Health” that you do not remember installing.
- Settings you didn’t change: an unfamiliar profile or device-management entry on an iPhone, or “install unknown apps” and accessibility permissions enabled on Android for an app you don’t recognise.
Behaviour of the other person
Often the strongest signal is not technical at all. They quote things from private conversations. They turn up where you are. They react to plans you only discussed by message. They mention a search you made or a photo you took. If you find yourself explaining away a pattern of “lucky guesses”, trust that instinct enough to look into it safely.
Doing a quick check yourself
If you want to do a quick check before going any further, Cyber Security Guides publishes free step-by-step walkthroughs for a basic spyware check: how to check an iPhone for spyware and how to detect spyware on Android. They cover the settings, profiles and permissions worth looking at on each platform.
A basic check like this can surface the obvious cases, but keep two things in mind: well-hidden stalkerware is designed to survive exactly this kind of inspection, so a clear result is not a guarantee — and if you do find something, resist the urge to delete it on the spot. Note what you found, leave it in place, and read the next section before acting.
Why deleting it yourself can backfire
The understandable impulse is to find the app and delete it, or factory-reset the phone. Before you do, there are two serious downsides to weigh.
It can alert the person monitoring you. Many stalkerware products notify their operator when the software stops reporting. If the person watching realises you have discovered them, they may escalate — and research and frontline experience consistently show that the period around discovery and separation carries heightened risk. Any change to your safety and privacy is best planned, ideally with a domestic violence support service, rather than done impulsively.
It destroys the evidence. A stalkerware installation is evidence — of the software itself, when it was installed, and what it was configured to collect. That can matter enormously in protection order applications, family law proceedings and criminal complaints. Deleting the app or resetting the phone wipes that record, usually permanently. You may end up safer in the moment but with nothing to show a court except your word.
The safer sequence is: preserve first, plan second, remove third — with support around you.
What a forensic examination actually does
A forensic examination is very different from running an antivirus scan. A qualified examiner takes a forensic extraction of the phone — a complete, verifiable copy of its contents — before anything is touched or changed. From that copy, the examiner can:
- identify installed monitoring software, including apps designed to hide themselves;
- establish when it was installed, which can be matched against who had access to the phone at that time;
- document what it was collecting and where it was sending data;
- check for other monitoring pathways, such as unfamiliar linked devices, suspicious account sessions or configuration profiles;
- in some cases, recover deleted traces of software that has since been removed.
Just as importantly, the findings are documented in a report suitable for court, with proper chain of custody so no one can argue the evidence was altered. If the matter proceeds, the examiner can explain the findings as an expert witness. A screenshot of a suspicious app rarely carries that weight; a forensic report usually does.
An examination can also give you the other answer — that the phone is clean. For many people, credible reassurance is just as valuable, because it lets them focus on the real pathway (often a shared account) instead of living with an open question.
A calm way forward
If the signs above feel familiar, here is a sensible order of operations:
- Use a safe device for anything sensitive — research, support calls, new email accounts.
- Keep behaving normally on the suspect phone. Do not confront the person or announce your suspicions through it.
- Talk to a support service or your lawyer about timing, especially if separation or court proceedings are underway.
- Arrange a forensic examination before you clean or reset anything, so the evidence is preserved.
- Then remove the software and secure your accounts, in a planned way.
Digital Forensics Group provides discreet, court-ready stalkerware detection and evidence preservation for people across Australia and New Zealand, and we regularly work alongside domestic violence services and family lawyers. You can read about how we approach these matters on our domestic violence assistance page, or contact us confidentially on +61 499 475 408 — from a safe device.
