In almost every case, you won’t know if police are watching your phone until they tell you, because lawful surveillance is designed to be invisible on the device itself. Only 2,297 wiretap orders were authorized across the entire United States in 2024, and roughly half targeted narcotics investigations, so active monitoring is uncommon to begin with.1United States Courts. Wiretap Report 2024 The battery drain, strange noises, and clicking sounds that dominate online advice are almost never signs of police activity. What matters is knowing where surveillance actually happens, the narrow set of clues that can point to it, and the notice federal law requires you to receive after the fact.
Why You Usually Can’t Tell From the Phone Itself
The methods police rely on most heavily don’t touch your device. They happen at the carrier, at a cloud provider, or through records the government requests directly from a company.
A court-ordered wiretap under federal law lets police intercept calls, texts, and other communications directly from the carrier’s network. The order itself directs your phone company to provide the technical assistance needed to accomplish interception “unobtrusively and with a minimum of interference” with your service.2Office of the Law Revision Counsel. 18 USC 2518 – Procedure for Interception of Wire, Oral, or Electronic Communications A properly executed wiretap runs entirely on the carrier side. Your battery, data usage, and performance stay the same. Each order lasts a maximum of 30 days but can be renewed, and installed wiretaps ran for an average of 47 days in 2024.1United States Courts. Wiretap Report 2024
When police want the metadata rather than the content, meaning who you called and when, they use a pen register or trap-and-trace device. The government needs only to certify that the information is relevant to an ongoing investigation, not to show probable cause. This also happens at the carrier, so your phone gives no indication.
Carriers also hand over records they already store. Call logs, text metadata, and historical location data can be requested with legal process that doesn’t involve your phone at all. The Supreme Court ruled in Carpenter v. United States (2018) that accessing seven or more days of historical cell-site location information counts as a Fourth Amendment search requiring a warrant.3Supreme Court of the United States. Carpenter v. United States For basic subscriber records and other non-content data, the legal standard is lower. You’d have no way of knowing from your device.
The same is true of your cloud. iCloud backups, Google Drive, email, and cloud-synced messages are all reachable through the Stored Communications Act. To access the contents of communications held by a provider for 180 days or less, police need a warrant supported by probable cause.4Office of the Law Revision Counsel. 18 U.S. Code 2703 – Required Disclosure of Customer Communications or Records The warrant goes to the provider, not to you, and providers are typically barred from notifying you while the investigation is active. If your phone syncs to the cloud, the government often doesn’t need to break into your phone at all.
Two more categories are worth naming as boundaries, because searchers often assume they’d show up on the device. Geofence warrants compel a company to identify every device inside a geographic boundary during a time window, and social media monitoring uses publicly visible posts or platform-side legal process. Neither one interacts with your handset, so there’s nothing there to detect.
The Surveillance Methods That Can Leave Traces
A small number of techniques do touch the phone, and these are the ones the standard advice about “signs” actually applies to.
Cell site simulators, commonly known by the brand name StingRay, are portable devices that mimic a cell tower. Your phone connects to the simulator thinking it’s legitimate, which lets police pinpoint your location and, in some configurations, intercept communications. They affect every phone in range, not just the target’s. A cell site simulator can force your phone to drop from an LTE or 5G connection down to an older network, which is one of the few technical fingerprints a user might notice. Android users with certain Qualcomm-chipset phones can run apps that watch for suspicious tower behavior, though false positives are common and no consumer tool offers reliable detection. iOS restricts access to the low-level radio data these tools need, so detection on iPhones is particularly difficult.
Software installed directly on the device is the other category. That’s more characteristic of stalkerware planted by someone with physical access, or high-end commercial spyware delivered through zero-click exploits. Even sophisticated spyware like Pegasus is engineered to leave minimal footprints, and zero-click attacks can compromise a device through something as innocuous as a malformed image file, with no interaction from you.
Signs That Could Point to On-Device Monitoring
The symptoms people associate with surveillance almost always have mundane causes. They become meaningful only in combination, and only if you have a concrete reason to think you might be a target.
- Rapid battery drain on a relatively new phone with no change in your usage habits. An aging battery loses capacity naturally, so age alone explains most of what people see.
- Unusual data consumption, especially from an unfamiliar app. Spyware that records audio or captures screenshots has to transmit that data somewhere. So do cloud photo syncing and automatic updates, so check the per-app breakdown rather than the total.
- Overheating when idle. A phone that runs hot while sitting on a table with the screen off is worth investigating, because background monitoring processes can drive sustained CPU activity.
- Unexpected reboots. Usually a software bug or low storage, but poorly coded spyware can cause instability.
- Unfamiliar apps, particularly ones with broad permissions for microphone, camera, or location. This is the most concrete indicator. Some monitoring tools disguise themselves with generic names like “System Service” or “Phone Manager.”
- Repeated network downgrades from LTE or 5G to 2G in an area where you normally have strong service. Network congestion and building interference cause the same symptom, but this is one of the few signs that could point to a cell site simulator.
No single item on that list confirms anything. If several appear together, if they appeared suddenly, and if you have a plausible reason to be a target such as involvement in a criminal investigation, activism, or journalism, they’re worth acting on.
The Notice Federal Law Says You Should Receive
Most people don’t know this exists. Federal law requires that after a wiretap order ends or is denied, the judge must serve notice on the people named in the order within 90 days. That notice must tell you a wiretap application was filed, the date it was entered, and whether your communications were actually intercepted.5Office of the Law Revision Counsel. 18 U.S. Code 2518 – Procedure for Interception of Wire, Oral, or Electronic Communications If police lawfully wiretapped your phone, you will eventually be told.
The 90-day clock starts after the surveillance period ends, and courts can extend it. For delayed-notice search warrants, the initial notice window can be pushed to 30 days with further extensions of up to 90 days at a time.6Office of the Law Revision Counsel. 18 USC 3103a – Additional Grounds for Issuing Warrant So the notice may be slow, but the requirement is real. Watch your mail.
What to Do If You Think You’re Being Watched
Work from least drastic to most, and only escalate if what you find justifies it.
Audit Permissions and Data Usage
On both iOS and Android, review every installed app and check which ones have access to your microphone, camera, location, and contacts. Revoke anything that doesn’t fit the app’s purpose. A calculator with microphone access has no legitimate reason for it. Then look at data usage broken down by app, and flag anything you don’t recognize consuming data in the background.
Run a Forensic Scan
Reputable mobile security apps can catch known spyware signatures. For deeper analysis, Amnesty International’s Mobile Verification Toolkit is a free, open-source forensic tool that scans iOS backups and Android devices for indicators of compromise from known commercial spyware campaigns. It requires some technical skill to operate and won’t catch unknown or newly deployed spyware.
Turn On Lockdown Mode (iPhone)
Lockdown Mode on iPhone significantly narrows the ways your device can be attacked. It blocks most message attachment types, disables certain web technologies, prevents incoming FaceTime calls from unknown contacts, blocks configuration profile installation, and disconnects from non-secure Wi-Fi networks.7Apple Support. About Lockdown Mode Apple built it for people facing sophisticated, targeted threats. It also disables enrollment in mobile device management, which prevents attackers from installing malicious profiles.
Use End-to-End Encrypted Messaging
Apps like Signal protect the content of your messages from interception at the network level. Even with a wiretap order, police cannot read end-to-end encrypted messages without access to one of the endpoints. The CLOUD Act explicitly does not create any authority to compel providers to decrypt communications.8Department of Justice. The Purpose and Impact of the CLOUD Act – FAQs Encryption won’t stop metadata collection, but it does protect what you said.
Factory Reset as a Last Resort
A full factory reset wipes the device and removes anything installed without your knowledge. Back up essential data first, but be careful: if spyware is embedded in a backup, restoring from that backup reinfects the phone. After resetting, set the phone up as new, update the operating system immediately, change passwords on all your accounts, and enable two-factor authentication. A reset does nothing against network wiretaps, carrier data requests, or cloud warrants, but it clears anything running on the device itself.
If Surveillance Crossed Legal Lines
Federal law provides real remedies when interceptions happen without proper authority. Anyone whose communications were intercepted, disclosed, or used in violation of the federal wiretap statute can bring a civil lawsuit and recover the greater of actual damages plus any profits the violator made, or statutory damages of $100 per day of violation or $10,000. Courts can also award reasonable attorney’s fees and punitive damages.9Office of the Law Revision Counsel. 18 U.S. Code 2520 – Recovery of Civil Damages Authorized
Unauthorized interception is also a federal felony carrying up to five years in prison.10Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Officers who relied in good faith on a court warrant or order have a complete defense against both civil and criminal liability, even if the warrant is later found defective.9Office of the Law Revision Counsel. 18 U.S. Code 2520 – Recovery of Civil Damages Authorized
There is a hard deadline. Civil claims must be filed within two years of the date you first had a reasonable opportunity to discover the violation.9Office of the Law Revision Counsel. 18 U.S. Code 2520 – Recovery of Civil Damages Authorized If you receive a wiretap inventory notice or otherwise learn your communications were intercepted, talk to an attorney promptly. Challenging a surveillance order requires working through both Fourth Amendment doctrine and the specifics of the federal wiretap statute, and the clock does not stop while you decide.