To check if your phone has a virus, start with the source of the warning, then check installed apps, security updates and account activity. On Android, run Google Play Protect if your phone includes it. On iPhone, review the device and account settings instead: an App Store security app cannot perform a desktop-style scan of the whole phone.
A hot phone, a weak battery or a frightening browser message does not establish an infection. This guide helps you decide what needs checking, what can wait for ordinary troubleshooting, and when to get help. “Virus” is often used loosely; our explanation of what malware is covers the distinction.
Before You Change Anything
If you suspect someone close to you is monitoring your phone, use a different, trusted device to seek help first. Removing an app, changing sharing settings or resetting the phone could alert that person and erase useful evidence. Contact a specialist domestic-abuse or technology-safety service if making changes could put you at risk.
For a work or school phone, contact its administrator before deleting management software. If you see unauthorised payments or account logins, use another trusted device to contact the provider and secure the affected account now. A phone check should not delay that response.
Is It Malware, a Browser Scam or an Ordinary Fault?
Look for specific evidence rather than treating every symptom as a diagnosis. Note when the problem began, which app or website was open, and whether it happens elsewhere.
- A website says you have several viruses: do not call its number, pay for cleanup or install its suggested app. Close the tab. A webpage displaying a scan animation is not evidence that it inspected your phone.
- Unexpected ads or notifications: identify the sending app or website. A site notification can look alarming without the phone itself being infected.
- Heat, battery drain or high data use: check which apps are responsible. Updates, navigation, video and ageing batteries can also explain these symptoms.
- A genuine security warning: open the relevant security feature directly rather than following a link in a message. Take a named harmful-app warning seriously.
- An unfamiliar login or purchase: investigate the account separately. Stolen credentials can be used without malware being installed on your phone.
How to Check an Android Phone
The following checks apply to phones with Google Play services. Menu names differ across Pixel, Samsung and other manufacturers; use Settings search if a label is different. Phones without Google services need the manufacturer’s security guidance.
- Open the Google Play Store yourself, tap your profile picture, choose Play Protect and tap Scan. Follow any harmful-app warning shown there. Google explains that Play Protect also checks apps from outside Google Play; a clean result is useful but does not prove the absence of every threat.
- Open Settings and check for software and security updates. On many phones, look under System or Security & privacy; the manufacturer may use Software update. Install available updates and restart when prompted.
- Review the installed-app list in Settings. Investigate apps installed around the time the problem began, but do not delete an unfamiliar system component simply because its name looks unusual.
- Check app permissions and special access. Consider whether each app has a clear reason to use accessibility services, notifications, location or device administration. Do not disable a legitimate accessibility aid or employer-managed setting without understanding it.
- Check battery and data usage for an explanation of the symptoms. Record the app name and pattern you find, rather than assuming the highest entry must be malicious.
If a harmful app is identified, or intrusive behaviour continues, follow the fuller Android malware removal steps. Safe mode can help distinguish a downloaded-app problem from other faults, but it is not a malware detector.
When an App Asks You to Bypass a Restricted Setting
On Android 13 and later, some sensitive settings can be restricted for newly installed apps. If a caller, message or supposed cleaner tells you to allow restricted settings, pause and verify the developer independently. The restriction is a safeguard, not a diagnosis that your phone is infected.
Google explains that accessibility access can let an app read screen content and interact with other apps. Legitimate accessibility tools may need it; a delivery-tracking app or unsolicited cleanup tool needs a convincing, independently verified reason. Record the app and permission requested, and do not grant more access merely to make a warning disappear.
How to Check an iPhone
An iPhone needs a different approach. You cannot give a normal third-party app unrestricted access to inspect iOS and every other app. That limitation does not mean iPhones are immune to malicious software or account abuse.
- Open Settings > General > Software Update and install an available iOS update. Keep your apps updated as well. If the phone cannot receive needed security updates, consider supported-device options.
- Review installed apps and their permissions under Settings > Privacy & Security. Investigate unexpected access to the camera, microphone or location, considering which features you actually use.
- Check Settings > General > VPN & Device Management if you are concerned about an unexpected profile. Identify its owner before changing anything. Apple warns that removing a profile can also remove associated settings, apps and data; ask your employer or school about managed profiles.
- Review your Apple Account for unfamiliar devices or changes. If there is evidence of compromise, follow Apple’s account recovery guidance from a trusted device.
- For a Safari scare message, close the offending page. On recent iOS versions, open Settings > Apps > Safari and check Block Pop-ups and Fraudulent Website Warning. On older versions, Safari may appear directly in Settings.
Do not dismiss every iPhone malware alert as fake. Apple can display a genuine warning about a third-party app it has identified as containing malware. Its guidance on detected malicious apps recommends deleting the affected app. That system warning is different from a website demanding payment to “clean” your phone.
What the Results Can and Cannot Tell You
If closing one tab stops the problem, concentrate on that website and any permissions you granted it. If removing an identified unwanted app stops the behaviour, that is useful evidence about the cause. Neither outcome tells you whether a password was already exposed.
A clean scan, normal battery chart or lack of visible symptoms cannot certify that a phone is uncompromised. Equally, one slow afternoon is not a reason to wipe it. The appropriate next step depends on the evidence you actually found.
If you are deciding whether to buy additional software, see our explanation of whether iPhones need antivirus. Pay attention to the specific protection offered, rather than assuming a mobile “security” subscription can inspect everything.
When to Get Help or Consider a Reset
Contact the manufacturer or your organisation’s IT team if security warnings persist, essential settings cannot be changed, or problems continue after ordinary app troubleshooting. If you receive a credible targeted-attack notification, seek specialist help rather than relying on a consumer scan.
A factory reset is a later recovery option, not the first response to an unexplained symptom. Before erasing anything, understand the backup, sign-in and data-loss implications. A reset also does not reverse stolen data, undo unauthorised payments or secure an account that an attacker still controls.
If you entered a password or card details into a scam, treat that as a separate incident even if the phone now looks normal. Use a trusted device to change exposed credentials, review recovery details and contact your bank where necessary.
Frequently Asked Questions
Can you check a phone for viruses without paying?
Yes. Start with the phone’s built-in security settings, updates and account checks. On Android phones that include Google services, Play Protect is available without a separate subscription. On iPhone, paying for a security app does not give it unrestricted access to scan the whole device.
Does battery drain mean my phone has a virus?
No. Battery wear, poor signal, navigation, video and background activity can all cause battery drain. Check the usage information and look for other evidence before assuming malware is responsible.
Will a factory reset prove my phone is safe?
No. A reset can help with many unwanted-app problems, but it is not a guarantee against every form of compromise. It also cannot undo exposed passwords or data, so account recovery and device recovery may both be necessary.
Related Articles
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.