How to tell if your phone is hacked (and what the *#21# codes really do)

Safety first. If someone you know may have put spyware on your phone, do not remove it yet. The FTC warns that doing so “could tip off your abuser,” who may then make things worse. Contact the National Domestic Violence Hotline from a device that person cannot reach: 1-800-799-7233 or thehotline.org. If you are in immediate danger, call 911.

Most phones that act strangely are not hacked. The signs that matter most are ones you did not cause: account alerts, unknown apps, or settings you never changed. The codes *#21# and *#62# do not scan for hacking. They only show where your calls are being forwarded, and *#06# shows the phone’s IMEI (International Mobile Equipment Identity), a number that identifies the phone itself.

Real signs and false alarms

No single sign proves a hack. Look for patterns, and start with your accounts. The FTC’s guide to hacked accounts (page dated August 2023) lists these signs:

• You cannot sign in to an account you normally use.
• You get a notice that your username or password changed, and you did not change it.
• You get an alert about a sign-in from a device or place you do not recognize.
• Friends or family get messages from you that you did not send.

Some signs are weaker. The FTC’s stalkerware page (dated June 2026) lists a battery that drains faster, more data use, overheating, and a phone that turns off and on. The FTC says these can point to spyware. Spyware, also called stalkerware, is an app someone installs on your phone without your knowledge.

But these signs have ordinary causes too. Apple’s battery page (October 22, 2026) lists background activity, weak signal, frequent notifications, and software updates. After an update, Apple says to “wait a few days and then check again.” It also says batteries “have limited lifespan.”

A pop-up that says your phone is infected is not a sign of a hack. Apple says such pop-ups “are usually fraudulent advertisements.” The FTC says real security warnings “will never ask you to call a phone number.” Close the page and do not call. For more, see Can iPhones get viruses?

One clue stands out. The FTC and the Safety Net Project both name it. The Safety Net Project is part of the National Network to End Domestic Violence. The clue is another person who seems to know things only your phone would show, such as where you are or what you texted. The Coalition Against Stalkerware adds that some stalkerware causes none of the other signs. If this sounds like your situation, read Is your phone being tracked?

What the *#21#, *#62# and *#06# codes really do

These codes are real, but they are not a hack test. They come from technical standards for mobile networks: 3GPP TS 22.030 and TS 22.082, published by ETSI in October 2025.

A code that starts with *# asks the network for a status. Call forwarding means the network sends your incoming calls to another number. Code 21 is “call forwarding unconditional,” which sends all your calls, whatever the state of your phone. The standard says the network should tell you whether it is on and, if so, which number it sends calls to. Code 62 covers calls that cannot reach your phone, for example when it is off or out of coverage. Here is what each code does:

Code	What it shows	Detects hacking?
*#21#	Whether all your calls are forwarded, and to what number	No
*#62#	Where calls go when your phone is off or has no signal	No
*#06#	Your phone’s IMEI	No

The standard also says a phone must accept *#06# and display its IMEI, with or without a SIM card.

So why check forwarding at all? If forwarding is on and you did not set it up, calls to your number ring somewhere else. That is worth fixing. It is not proof of spyware, because you or someone with access to your phone may have turned it on.

Carriers differ. Verizon’s call forwarding page lists *72, *71 and *73, and does not mention *#21#. If a code gives an error, use your phone’s settings:

1. iPhone: AT&T’s page for the iPhone 17e says to open Settings, tap Apps, tap Phone, then tap Call Forwarding.
2. Samsung Galaxy: Open the Phone app, tap the three dots, tap Settings, then Supplementary services, then Call forwarding. Samsung says availability varies by carrier and phone model.
3. Other Android phones: Look in the Phone app’s settings for call forwarding. Menus differ by phone.

To turn forwarding off, switch it off in that screen. The standard’s code for erasing all call forwarding is ##002#. Verizon’s page says to dial *73.

One rule protects you: never dial a code because someone told you to. The standard says a code that includes a phone number can set up call forwarding to that number.

Check an iPhone

1. Update iOS. Go to Settings, General, then Software Update. Apple says keeping software up to date “is one of the most important things you can do” for security.
2. Open Safety Check. Go to Settings, Privacy & Security, then Safety Check. It needs iOS 16 or later. It shows who and what can see your data. It cannot review non-Apple accounts, passwords, or social media sharing. Apple says to “consider potential impacts to your safety” before you change anything.
3. Look for profiles. Go to Settings, General, then VPN & Device Management. If you see no profiles, none are installed. A profile can manage settings and may allow access to data or location. Delete one you do not recognize. On a work or school phone, ask the administrator first.
4. Check your Apple Account devices. Open Settings and tap your name. Scroll to the device list. Tap any device you do not know, then tap Remove from Account.
5. Check call forwarding, as described above.

Check an Android phone

1. Update Android. Go to Settings, System, then Software updates. Google says you need the latest Android version to get the latest security update for your device.
2. Check Play Protect. Open the Play Store, tap your profile icon, tap Play Protect, then Settings. Make sure “Scan apps with Play Protect” is on. Google says Play Protect checks apps when you install them and scans your device from time to time. If it flags an app, tap the notification, then Uninstall.
3. Review your apps. Look for apps you do not remember. Google warns that an app with accessibility access “can read content on your screen and interact with apps on your behalf.” It advises against allowing restricted settings unless you trust the developer.
4. Check device admin apps. These apps can lock your phone or erase its data. Android’s developer page says you must first unregister such an app as an administrator before you can uninstall it. Search your Settings for “device admin apps.”
5. Check your Google Account devices. Open your Google Account, then Security & sign-in, then Manage all devices. Tap any device you do not recognize and choose Sign out.
6. Check call forwarding, as described above.

If you find a real sign

Take these steps in order:

1. Think about safety first. If an abuser could be watching, follow the box at the top of this page.
2. Use another device to secure your accounts. Change the passwords for your email, your Apple or Google account, and your bank. Use a unique password for each; our password generator can help. Turn on two-factor authentication, which asks for a second proof of identity when you sign in. Sign out of all devices, as the FTC advises.
3. Remove what does not belong. Delete unknown apps and profiles, remove unknown devices, and turn off forwarding you did not set.
4. Keep evidence before a reset. The FTC says to document abuse and save what you want to keep, such as photos, before you reset or replace a phone.
5. Reset if doubts remain. On an iPhone, Apple’s steps are Settings, General, Transfer or Reset iPhone, then Erase All Content and Settings. If you think someone installed malicious software, Apple says not to restore from a backup, because that may reinstall it. The FTC gives the same advice for apps: download them again from the app store. Google says a factory reset on Android erases all data from the phone, so check your backup first.

What can go wrong

• A reset erases everything, including evidence.
• Changes may alert the person who set up the spying. The FTC says taking these steps “could tip off your abuser.”
• Some Safety Check options may be missing if Screen Time limits or a management profile are active, Apple says.
• A clean check is not a guarantee, because some stalkerware shows no signs.
• An account may be hacked while the phone is fine. See Am I hacked?

What to do now

1. If you feel unsafe, call the National Domestic Violence Hotline at 1-800-799-7233 from a safe device before you change anything.
2. Review the sign-in alerts and device lists on your Apple or Google account, and sign out anything you do not know.
3. Check call forwarding with *#21# or your phone’s settings, and turn off any forwarding you did not set.
4. Update your phone and turn on two-factor authentication or a passkey for your email. See Passkeys vs passwords.
5. If you suspect someone is tracking you, read Is your phone being tracked? before you remove anything.