Stalkerware: How to Detect and Remove It Safely

What Stalkerware Is

Stalkerware, sometimes called spyware or monitoring software, is an app or program installed to secretly track a person. Depending on the product and permissions, it may record:

• Text messages, emails, and chat apps.
• Call logs and, in some cases, call audio.
• Photos and videos.
• Browsing history.
• Location in real time.
• Keystrokes, passwords, and social media activity.

It is usually installed by someone with brief physical access to the device, or by tricking the person into installing it. It often hides its icon.

Why It's Dangerous

Stalkerware gives a stalker a view into your private life. They may know where you go, who you talk to, and what you plan, including steps you take to get help. That can make safety planning dangerous and can lead to showing up where you are.

Using such software on another person without consent can violate federal and state laws on wiretapping, unauthorized access, and stalking. Federal law covers stalking that uses electronic communication services and facilities of interstate commerce.

Warning Signs

No single sign proves stalkerware, but several together are worth taking seriously.

• The person knows things they could only learn from your phone.
• They show up where you are without being told.
• Your battery drains faster than usual, or the phone gets warm when idle.
• You see unexpected data use or slow performance.
• Unfamiliar apps, settings, or profiles appear.
• Security settings have been turned off, or unknown sources are allowed.
• Your phone restarts or lights up unexpectedly.
• Your accounts show logins you didn't make.

Some of these also have ordinary causes, so look for patterns. Read electronic stalking.

Safety First: Why Removal Can Be Risky

If a stalker is using stalkerware and you suddenly remove it, they may notice that the feed has stopped. That can provoke them, or lead them to escalate or show up. Before you act:

• Decide whether it is safe to remove. If you fear violence, talk to police or a victim advocate first.
• Save evidence. Screenshot suspicious apps, settings, and alerts before you change anything.
• Make a safety plan. Have a place to go and a person to call. See how to build a safety plan.
• Use a safe device for research and for changing passwords.

How to Check Your Phone

These steps are general. Menus differ by phone and software version.

• Review installed apps, including those with generic or system-like names.
• Check permissions for apps that have access to location, microphone, camera, accessibility, or device administration.
• Review device administrator and accessibility settings, where monitoring tools often hide.
• Check for apps or profiles you didn't install, and any settings that allow installation from unknown sources.
• Update your operating system to the latest version.
• Run a reputable security scan, while knowing no scan is perfect.

If you aren't sure, ask a trusted technician or contact police about forensic help.

Computers and Accounts

Stalkerware can also run on computers, and many stalkers go through accounts instead.

• Check installed programs and browser extensions.
• Review logged-in devices and sessions on email and social accounts.
• Look for forwarding rules in email that send copies elsewhere.
• Change passwords from a safe device, and turn on multi-factor authentication. See the Cybersecurity and Infrastructure Security Agency's Secure Our World.

Options for Removing It

• Remove suspicious apps and permissions, if safe, after saving evidence.
• Restore the device to factory settings, which usually removes stalkerware, but erases data, so back up what you need first and be careful not to restore the stalkerware from a backup.
• Get a new device, and set it up with new accounts from the start.

A factory reset or new device does not protect accounts the stalker already knows the passwords to. Change those first.

Reporting It

Report stalkerware to police and keep evidence. You can also file a complaint with the FBI's Internet Crime Complaint Center. Tell them what you found, when, and any ways the stalker has shown they have information. See how to report online stalking.

What to Do After

• Keep monitoring your accounts and devices.
• Be careful about connecting a new device to old backups.
• Tell trusted friends not to share your information.
• Update your safety plan, and consider a protective order. See protection against stalking.

Stalkerware vs. Legitimate Monitoring

Not all monitoring is stalking. Some people use location sharing with family or friends, and parents may use controls on children's devices. The key differences are consent, transparency, and purpose.

• Consensual sharing is something you know about, can see, and can turn off.
• Hidden monitoring of another adult, without their knowledge, is what makes software "stalkerware." It is often designed to hide itself.
• Parental controls for minors involve different legal and ethical questions, and laws and norms vary. Even then, transparency is usually best.

If you share location with someone, check the settings regularly and consider whether that sharing still makes sense, especially after a breakup.

Cars, Smart Homes, and Other Connected Devices

Monitoring doesn't require software on your phone. Connected cars, smart speakers, cameras, thermostats, and doorbells can also reveal where you are or what you do.

• Check whether a car's app or account lists other users or devices.
• Review who has access to smart home apps and cameras, and remove people you don't trust.
• Change passwords on shared devices and routers.
• Look for hidden trackers in vehicles and belongings. See stalker alerts.

Getting Professional Help With a Device

If you think a device has been compromised, a professional can help. Police may be able to arrange forensic examination for criminal cases. A reputable technician can check for malicious software. If you plan to report, ask police or an attorney before you wipe the device, because wiping can erase evidence. Keep a record of who handled the device and when.

After Removal: Rebuilding Trust in Your Devices

Once you've removed stalkerware or switched devices, take steps to regain confidence.

• Change passwords for all important accounts from a clean device.
• Turn on multi-factor authentication and review recovery options.
• Install updates, and review app permissions regularly.
• Avoid restoring from backups that may contain the monitoring software.
• Watch for signs that the stalker still has information, and update your safety plan.

It can take time to feel safe using your devices again. That's normal.

A Weekly Device Hygiene Routine

Small habits make stalkerware easier to notice.

• Look at your installed apps and remove ones you don't recognize.
• Check which apps have permissions for location, microphone, camera, and accessibility.
• Review logged-in devices on email and social media.
• Install system updates.
• Check your battery and data usage for sudden changes.
• Make sure your lock screen requires a PIN or biometric, and that no one else's fingerprint or face is registered.

It takes about ten minutes. Use the Safety Audit to keep track.

Talking to Your Phone Carrier and Platforms

Carriers and platforms can sometimes help. Ask your carrier whether anyone else is listed on your account, whether call forwarding or other services were added, and whether there are options to secure your account with a PIN. Ask platforms whether there is a way to see active sessions or sign out everywhere. Note what they tell you, and keep records for police.

If You Rely on a Device You Think Is Monitored

Sometimes you can't immediately replace your phone. In that case, assume what you do on it can be seen. Use another device or a trusted person's phone for sensitive communication, don't search for help on the monitored device, and avoid discussing plans on it. When you can, get a new device and set it up with new accounts before you transition. Until then, rely on your safety plan.

You can't always see stalkerware, but you can act on what you notice, and protect yourself while you do.

Sources and further reading

• Secure Our World (CISA)
• FBI Internet Crime Complaint Center (IC3)
• Interstate Stalking (U.S. Attorney's Office, N.D. Georgia)