Spyware: What It Is, How It Works, and How to Protect Yourself

Quick answer: Spyware is software that secretly watches what you do on a phone or computer and sends it to someone else. The kind that most often hurts ordinary people is stalkerware, which a partner, ex, or other person installs to track location, messages, calls, and browsing. Keep your devices updated, lock them with a strong passcode, install apps only from official stores, and review app permissions. If you think stalkerware is on your phone and you may be at risk from someone you know, don’t remove it right away: contact a domestic violence advocate first, from a different device.

Spyware ranges from advertising trackers to tools built to monitor one person. This post covers how it works, a real case, how to check your own devices, and what to do if you find it, including a safety warning that matters more than any technical step.

A Real Example: The SpyFone Case

In September 2021, the Federal Trade Commission banned SpyFone and its CEO from the surveillance business. According to the FTC, the company sold apps that let buyers covertly monitor a device owner’s photos, text messages, web histories, GPS locations, emails, and video chats without the owner’s knowledge. The FTC said the company gave instructions for hiding the app on Android phones and for bypassing phone restrictions, and that monitoring email required “rooting” the phone, which could expose it to security risks.

The company also failed to protect what it collected, according to the FTC. Stored personal information, including photos and text messages, wasn’t encrypted, buyers’ passwords were sent in plain text, and in August 2018 a hacker accessed the company’s server and obtained data on about 2,200 consumers. The order bars the company and its CEO from offering any surveillance app, requires deletion of illegally collected data, and requires notifying device owners that their devices may have been monitored and may not be secure. FTC, “FTC Bans SpyFone and CEO from Surveillance Business and Orders Company to Delete All Secretly Stolen Data” (September 2021).

In December 2025, the FTC denied the CEO’s petition to vacate or modify the 2021 order, finding he “failed to show changed conditions of fact or law sufficient to justify reopening and setting aside the Consent Order.” FTC, “FTC Denies Petition from SpyFone App CEO to Vacate 2021 Order” (December 2025).

The case shows two things. Stalkerware is a real product that real people buy and install on other people’s phones. And the companies behind it often can’t protect what they collect, so a victim’s private data can end up exposed to third parties too.

What Spyware Is and How It Works

The FTC describes stalkerware, also known as spyware, as software someone installs on your device without your knowledge, which can track your location, record calls, read messages, and show your online activity. Source: FTC, “Stalkerware: What To Know”.

Broadly, spyware works by getting installed, hiding, collecting data, and sending it somewhere:

• Getting installed. Usually someone with physical access to your unlocked phone installs it, or you’re tricked into installing a malicious app, attachment, or fake update. Pirated software and links from unexpected messages are common routes. See 5 quick ways to spot a phishing email.
• Hiding. As the SpyFone case shows, sellers can provide instructions for hiding the app.
• Collecting. Messages, location, microphone, camera, keystrokes, or browsing, depending on the type and the permissions it obtained.
• Sending. The data goes to the person or company that controls it.

Other forms include keyloggers (record what you type) and adware that tracks browsing. How these are classified varies, and the sources above focus on stalkerware.

Signs to Look For

The FTC lists phone symptoms that may point to stalkerware: faster battery drain, unexpected data use, overheating, and the phone turning itself off and on. These symptoms have many ordinary causes, so treat them as prompts to look closer, not proof.

The FTC says the behavior of the other person can be a stronger sign. Ask yourself:

• Does someone know your exact location when you haven’t told them?
• Do they know details of private conversations?
• Do they seem to know who you’re texting or talking to, or what sites you visit?
• Has that person had access to your phone without you watching?

If You Think Someone Is Monitoring You

Your safety comes first. The FTC warns that taking steps against stalkerware “could tip off your abuser,” and that an abuser who suspects you’re cutting off access may escalate. Its guidance:

1. Contact a domestic violence advocate before removing anything. Advocates can help with a personal safety plan, a technology safety plan, talking to law enforcement, and preserving evidence.
2. Don’t call for help from the phone that may be monitored. Use a friend’s or family member’s device, or a pay-as-you-go phone.
3. Document what’s happening before you reset or replace the phone, and save content you want to keep.
4. Consider a new phone with new accounts the other person can’t access. If you keep the phone, a full factory reset may remove stalkerware.
5. Don’t restore from a backup of the old phone, since that could reinstall the stalkerware. Download apps again from the official store.
6. Check whether the phone was rooted or jailbroken, which some stalkerware requires. The FTC points to a guide from the National Network to End Domestic Violence’s Safety Net Project at techsafety.org/rootjailbreakcheck.

Help available: The National Domestic Violence Hotline can be reached at 1-800-799-SAFE (7233), by chat at thehotline.org, or by texting START to 88788, according to the FTC. If you’re in immediate danger, call 911.

If It’s Not About a Person: Checking for Other Spyware

If you’re worried about an app or malware rather than a person with access to your phone, do this:

1. Review app permissions. On your phone, check which apps can use your location, microphone, camera, and contacts, and revoke what an app doesn’t need. Exact menus vary by device and version, so look in your privacy settings. Our guide to turning off hidden tracking on your phone walks through it.
2. Delete apps you don’t recognize or no longer use. Install apps only from official stores.
3. Install updates for your operating system and apps, which patch known flaws.
4. Run a scan with reputable security software. See our antivirus guide.
5. Change your passwords from a clean device and turn on multi-factor authentication. Multi-factor authentication makes stolen passwords much less useful, but it isn’t a guarantee against every attack.
6. If you still suspect infection, back up what you need and do a full factory reset. For computers, see our guide to safely wiping a device, and don’t restore from an infected backup.

How to Protect Yourself

The FTC’s protective measures for stalkerware apply to everyone:

• Use a passcode of at least six digits, change it if someone else may know it, and turn on automatic locking.
• Keep the phone’s software and apps updated.
• Use strong, new passwords for accounts someone may have had access to, and don’t share them.
• Turn on two-factor authentication.
• Don’t give partners, exes, or anyone else unsupervised access to your phone.

For families, see our family tech safety hub. Monitoring apps that parents use openly with a child’s knowledge differ from covert ones, but talk with older children about what’s installed on their devices and why.

People Also Ask

Sources: Federal Trade Commission, “FTC Bans SpyFone and CEO from Surveillance Business and Orders Company to Delete All Secretly Stolen Data” (September 2021); Federal Trade Commission, “FTC Denies Petition from SpyFone App CEO to Vacate 2021 Order” (December 2025); Federal Trade Commission, “Stalkerware: What To Know” (updated June 2026)