No products in the cart.
How to remove spyware from Android safely
Android spyware removal helps you find and remove apps that may be tracking, recording or interfering with your Android phone. Spyware can hide as a normal app, misuse permissions or rely on access that was granted earlier. Some problems come from an ordinary suspicious app, some come from a compromised Google or email account, and some involve a personal safety concern such as stalkerware. The safest approach is to check your risk first, then work through Play Protect, app removal, permissions, safe mode, password changes and reset options in the right order.
First, check whether it is safe to remove spyware
Stalkerware is spyware that may be installed by someone who knows you, has had physical access to your phone or can guess your passwords. Removing it, changing passwords or resetting the phone may alert that person, especially if they can see your location, messages, notifications or app activity.
If you are worried about a partner, former partner, family member, housemate or another person reacting badly, do not start by deleting apps on the phone they may monitor. Use another safe device, such as a trusted friend’s phone, a work device, a library computer or a phone the person has never accessed.
- Use a safe device before searching for help, changing passwords or reading safety information.
- Contact a domestic, family or sexual violence support service if there is any risk to your safety.
- Do not confront someone you suspect of installing stalkerware.
- Do not change passwords on a phone you believe is being monitored.
- Preserve messages, app names or screenshots only if it is safe and will not increase your risk.
- Call emergency services if you are in immediate danger.
Warning signs of spyware on an Android phone
Spyware warning signs can overlap with normal phone problems, ageing batteries, weak mobile reception, app bugs or full storage. Recent physical access to your phone, new accessibility access or unknown apps are stronger warning signs than one slow app or one flat battery.
| Possible warning signs | Stronger warning signs |
|---|---|
| Battery drain, overheating or apps taking longer to load. | An unknown app appears after someone else had physical access to your phone. |
| Higher data usage than usual when your own use has not changed. | A basic app has powerful permissions, such as a torch app requesting microphone, location or accessibility access. |
| More pop-ups, redirects or browser notifications than normal. | You find apps installed from unknown sources or outside the Google Play Store without your knowledge. |
| The phone feels slower after a recent app install or update. | An app has device admin access and will not uninstall normally. |
| Settings look different after an Android or security update. | Play Protect, app permissions, accessibility or install unknown apps settings have changed without a clear reason. |
Don't Let A Broken Phone Hold You Back
Look no further! Our comprehensive price list covers all major brands and models, ensuring that you can easily find the repair cost for your specific phone. Pleas check our price list for details
What Android spyware can access
Android spyware can only access what the device, user permissions and security settings allow. The risk becomes higher when a malicious app gets sensitive permissions, special access or device control.
Location: Location access may expose where the phone is now and where it has been. Maps, weather and transport apps may need location, but a calculator or torch app usually should not.
Microphone: Microphone access may let an app record sound during app use or in the background if the app has broader access. Be cautious when simple utility apps request it.
Camera: Camera access may expose photos, video or visual information around the phone. Camera, banking and scanning apps may need it, but many games and utilities do not.
SMS: SMS access may expose private messages, delivery notices, one time codes and account recovery texts. Few apps need direct SMS access on a modern Android phone.
Notifications: Notification access may expose message previews, two step verification prompts, banking alerts and private app activity. It can be more sensitive than it first appears.
Accessibility: Accessibility access can support legitimate accessibility tools, but it can also allow screen reading, input capture, forced taps or monitoring of what you do on the phone.
Storage: Storage access may expose photos, downloads, documents and saved media. Newer Android versions may split this into photo, video, music and file permissions.
Device admin access: Device admin access can let an app control security settings or block normal uninstall. A suspicious app with this access is a stronger warning sign.
How worried should I be?
Your level of concern should depend on the pattern of signs, not one symptom by itself. Use this guide to decide the next safest step.| Situation | Concern level | Next step |
|---|---|---|
| Your phone is slow, hot or draining battery, but there are no unknown apps or strange permissions. | Low to moderate | Update Android, run Play Protect, check storage and remove unused apps. |
| You find unknown apps, unusual data usage, suspicious permissions or apps not visible on the home screen. | Moderate | Review installed apps, remove suspicious apps and change passwords from a clean device. |
| An app will not delete, has device admin access or uses accessibility without a clear reason. | High | Try safe mode, remove special access and consider a trusted spyware scanner. |
| You suspect stalkerware from someone you know or feel unsafe. | Personal safety concern | Do not remove apps yet if that may alert someone. Use another safe device and contact trusted support first. |
What not to do if you suspect spyware
Panic steps can make Android spyware removal harder or less safe. Slow down before installing tools, deleting evidence or changing accounts.
- Do not confront a suspected stalker or abuser.
- Do not install many random cleaner, booster or antivirus apps.
- Do not enter new passwords on a phone you believe is monitored.
- Do not reset the phone before backing up important data, unless safety or urgency makes that necessary.
- Do not restore every app automatically after a reset.
- Do not assume one clean scan means every risk is gone.
Step 1. Run Google Play Protect and update Android
Google Play Protect can scan installed apps and may warn about harmful or unsafe apps, but it should not be treated as a complete spyware check. Android security updates and Google Play system updates are separate checks that can also help protect your device.- Open the Google Play Store app.
- Tap your profile icon.
- Tap Play Protect.
- Run a scan and follow any prompts shown by the phone.
- Check that Play Protect scanning is turned on.
- Open Settings and look for Security and privacy, Security or System updates.
- Check for both Android security updates and Google Play system updates.
- Restart the phone after updates finish.
Step 2. Check installed apps and delete suspicious apps
Suspicious apps are often ordinary-looking apps that were installed without your knowledge, came from unknown sources or request access they do not need. Checking the full installed apps list is more useful than only checking the home screen.- Open Settings, then Apps.
- Review the full installed apps list, including apps that do not appear on the home screen.
- Look for blank icons, duplicate utility apps, unfamiliar parental control apps or vague names such as “System Service”.
- Check recently installed apps if the problem started suddenly.
- Remove third-party apps you do not trust or no longer use.
- Check whether unknown app installation is enabled for Chrome, file managers, messaging apps or email apps.
- Turn off unknown app installation for apps that do not need it.
Step 3. Review permissions and security settings
Permissions show what an app can reach on your Android phone. Spyware usually wants permissions that let it collect, send, read or control information.| Permission or setting | Why spyware wants it | What this could expose | What to check |
|---|---|---|---|
| Location | To track where the phone goes. | Current location, routines and places visited. | Check for apps with constant location access that do not need it. |
| Microphone | To record sound or listen during app use. | Conversations, background sound and voice notes. | Question simple apps, such as a torch app, asking for microphone access. |
| Camera | To capture photos, video or visual information. | Images, video and surroundings near the phone. | Limit camera access to apps that clearly need it. |
| SMS | To read messages, codes or private conversations. | Authentication codes, private texts and account recovery messages. | Remove SMS access from apps that are not messaging or verification tools. |
| Notification access | To read alerts and app activity. | Message previews, two step prompts, banking alerts and private notifications. | Allow it only for apps you recognise and trust. |
| Accessibility | To read the screen, automate taps or monitor activity. | Screen content, typed input, buttons pressed and app activity. | Turn it off for apps that are not genuine accessibility or automation tools. |
| Device admin apps | To control security settings or resist removal. | Uninstall control, lock settings and device management functions. | Remove admin access from unknown or suspicious apps before uninstalling them. |
| Install unknown apps | To install apps from outside the Google Play Store. | Apps that have not come through the usual Play Store path. | Keep it off for browsers, file managers and messaging apps unless there is a clear reason. |
Step 4. Use safe mode if the app will not delete
Safe mode starts Android with downloaded third-party apps limited or disabled, which can help you delete a suspicious app that keeps reopening or blocking removal. Safe mode can help remove spyware on Android when an app is the problem, but it does not remove account-level access or fix shared passwords.- Save anything important you are working on.
- Reboot your phone into safe mode using the method for your model.
- Open Settings, then Apps.
- Find the suspicious app and try to uninstall it.
- If it will not uninstall, remove device admin access and check accessibility access first.
- Restart the phone normally after removal.
- Run Play Protect again and review permissions.
Step 5. Run a trusted antivirus or spyware scanner
Antivirus software, mobile antivirus apps, free anti-spyware tools and spyware scanners can add another check after you review apps and permissions. Do not assume any spyware removal tool will detect every threat.| Use case | What to do |
|---|---|
| You want a second opinion after Play Protect. | Choose a recognised mobile antivirus from the Google Play Store and run a scan. |
| You are considering a free anti-spyware app. | Check the developer, review volume, privacy policy, recent updates and permissions before installing it. |
| A scanner asks for broad permissions. | Check whether those permissions match the scanner’s purpose. Avoid tools that ask for unnecessary access without a clear reason. |
| A scanner finds a threat. | Follow the removal prompt, restart the phone and check app permissions again. |
| Different scanners give different results. | Do not keep installing more tools. Focus on unknown apps, special access, updates, account security and whether a reset is needed. |
Step 6. Change passwords from a clean device
Password changes should happen after removal steps, and preferably from a clean device that you trust. If spyware captured a password before removal, changing it on the same monitored phone may expose the new password too.- Change your Google account password first.
- Review devices signed in to your Google account and remove any you do not recognise.
- Check account recovery email addresses and phone numbers.
- Change your main email password because email can reset many other accounts.
- Change banking, payment, shopping, social media and messaging passwords.
- Turn on two step verification where available.
- Review app passwords, connected apps and passkeys if your account uses them.
- Use different passwords for important accounts, not one shared password.
When to perform a factory reset
A factory reset returns the phone to factory settings and can remove many app-based infections. It is a stronger step when suspicious behaviour continues after updates, app removal, permission checks and safe mode.
Reset when:
- Suspicious apps return after removal.
- Security settings keep changing without your action.
- Safe mode does not help you remove the app.
- Play Protect or another scanner keeps finding threats.
- You cannot identify the cause and the phone still behaves unusually.
Do not rely on a reset alone when:
- Your Google account, email, banking or social accounts may be compromised.
- Someone else knows your passwords or unlock code.
- You plan to restore every app from a backup without checking them.
- Your cloud account syncs settings or apps you do not recognise.
Before performing a factory reset, back up important photos, contacts and files. Avoid backing up unknown apps, and be careful with full device restores because they may bring back the same risky app or setting.
After the reset, update Android, sign in with a secured Google account, install apps from the Google Play Store and restore only the data you need. If you are resetting because of a personal safety concern, use a safe device to plan the reset and account changes first.
How to prevent spyware on Android devices
Preventing spyware is mostly about reducing risky installs, keeping accounts secure and limiting physical access to your phone. Small habits can make a large difference over time.
- Install apps from the Google Play Store where possible.
- Avoid unknown sources unless you understand the risk and trust the file.
- Turn off install unknown apps again after any one-off use.
- Keep Android, Google Play system updates and app updates current.
- Check Play Protect status from time to time.
- Review accessibility, notification access and device admin apps regularly.
- Use biometric unlock with a strong PIN, password or pattern.
- Do not share your unlock code or Google account password.
- Keep physical access to your phone controlled.
- Review installed apps after lending your phone to someone, after a reset or after a major update.
When to get help with your Android device
Android spyware removal can become stressful when you are unsure whether the problem is malware, a failing phone, a bad app update, a storage issue or a compromised account. It is also worth getting help before a factory reset if you need to protect photos, contacts, messages or other important data.
Phone Expert can provide practical phone support for issues such as software problems, device access, backing up data before a reset and questions about recovering photos, videos, contacts or other phone data. Its website lists store locations including Maroochydore, Kawana, Noosaville, Bundaberg, Chermside and Coomera, as well as booking, quote, drop-in, send-in and pick up or return options.
For a worried spyware situation, it is fair to ask what can and cannot be checked before handing over the device. A phone repair business can help inspect device behaviour, review visible apps and settings, help with backup steps or advise on reset preparation, but it should not be treated as emergency safety support, legal advice, cyber forensics or a guaranteed spyware detection service.
If you bring a phone in, explain the symptoms, when they started, whether someone else had access to the phone and whether you need help backing up data before a reset. If you need help with photos, videos or other phone files, Phone Expert also has a data recovery service page.
If you are unsure what is causing the problem, need help backing up your Android phone before a reset, or want someone to inspect your device, contact Phone Expert through the phone repair services page or use the send it in service if visiting a store is not practical.
Book Online &
Save $10 on Your Mobile Phone Repair
By booking online, you get an exclusive $10 discount on your repair cost. Don’t miss out on this special offer!
FAQs About Android Spyware Removal
Change passwords from a clean device, not from a phone you believe may be monitored. In many cases, it is safer to remove suspicious apps, update the phone and secure your Google account before using the phone for new passwords. If stalkerware may be involved, think about personal safety before making visible account changes.
It can, depending on what the backup restores. Restoring photos, contacts and files is usually different from restoring every app and setting. After a factory reset, avoid automatically restoring unknown apps, old app permissions or settings you do not recognise. Install needed apps fresh from the Google Play Store where possible.
A factory reset can remove many app-based spyware infections because it returns the phone to factory settings. It does not fix compromised accounts, shared passwords, unsafe cloud settings or someone else knowing your unlock code. Secure your Google account and important passwords as part of the reset plan.
Google Play Protect is a useful first scan and should usually be kept on, but it should not be the only step. Some risks involve permissions, unknown app sources, accessibility access, account compromise or apps that are not clearly flagged. Combine it with updates, app reviews, safe mode where needed and password changes.
A repair shop may be able to help review visible apps, permissions, software behaviour, backup options and reset preparation. It should not be treated as a guaranteed spyware removal or forensic service unless that service is clearly offered. If the issue involves stalking, family violence or personal safety, contact a specialist support service from a safe device.
