Quick Answer: Check where the warning came from before treating it as an infection. On Android with Google services, use Play Protect and inspect apps and permissions. On iPhone, review iOS, apps and account security; a normal security app cannot scan the whole device. Deal with exposed accounts separately.
A hot phone, a weak battery or a frightening browser message does not establish an infection. This guide helps you decide what needs checking, what can wait for ordinary troubleshooting, and when to get help. “Virus” is often used loosely; our explanation of what malware is covers the distinction.
Before You Change Anything
If you suspect someone close to you is monitoring your phone, use a different, trusted device to seek help first. Removing an app, changing sharing settings or resetting the phone could alert that person and erase useful evidence. Contact a specialist domestic-abuse or technology-safety service if making changes could put you at risk.
For a work or school phone, contact its administrator before deleting management software. If you see unauthorised payments or account logins, use another trusted device to contact the provider and secure the affected account now. A phone check should not delay that response.
Is It Malware, a Browser Scam or an Ordinary Fault?
Look for specific evidence rather than treating every symptom as a diagnosis. Note when the problem began, which app or website was open, and whether it happens elsewhere.
- A website says you have several viruses: do not call its number, pay for cleanup or install its suggested app. Close the tab. A webpage displaying a scan animation is not evidence that it inspected your phone.
- Unexpected ads or notifications: identify the sending app or website. A site notification can look alarming without the phone itself being infected.
- Heat, battery drain or high data use: check which apps are responsible. Updates, navigation, video and ageing batteries can also explain these symptoms.
- A genuine security warning: open the relevant security feature directly rather than following a link in a message. Take a named harmful-app warning seriously.
- An unfamiliar login or purchase: investigate the account separately. Stolen credentials can be used without malware being installed on your phone.
How to Check an Android Phone
The following checks apply to phones with Google Play services. Menu names differ across Pixel, Samsung and other manufacturers; use Settings search if a label is different. Phones without Google services need the manufacturer’s security guidance.
- Open the Google Play Store yourself, tap your profile picture, choose Play Protect and tap Scan. Follow any harmful-app warning shown there. Google explains that Play Protect also checks apps from outside Google Play; a clean result is useful but does not prove the absence of every threat.
- Check the Android version, Android security update and Google Play system update separately in Settings. On many devices, About phone > Android version shows their status; System > Software updates checks for available software. Manufacturer labels vary. Complete the required restart so a downloaded update becomes active.
- Review the installed-app list in Settings. Investigate apps installed around the time the problem began, but do not delete an unfamiliar system component simply because its name looks unusual.
- Check app permissions and special access. Consider whether each app has a clear reason to use accessibility services, notifications, location or device administration. Do not disable a legitimate accessibility aid or employer-managed setting without understanding it.
- Check battery and data usage for an explanation of the symptoms. Record the app name and pattern you find, rather than assuming the highest entry must be malicious.
If a harmful app is identified, or intrusive behaviour continues, follow the fuller Android malware removal steps. Safe mode can help distinguish a downloaded-app problem from other faults, but it is not a malware detector.
Read the named-app result, not just the reassurance
Play Protect may warn about, disable or remove a potentially harmful app. If the warning says an app was removed, first check the named item and result rather than searching for a missing app and reinstalling it. A caller’s request to disable scanning does not make their installation safe.
If Google requests an evaluation of an unfamiliar app from outside Google Play, that is a specific installation check. Review the request and app source; do not interpret it as proof that everything on the phone has already been scanned. Likewise, an unused app losing permissions can be a privacy safeguard rather than evidence of an attacker changing settings.
Check whether the phone can still receive the updates it needs
Google’s update guidance distinguishes Android version, security patch and Google Play system status. Write down those dates and the model when asking the manufacturer for help. “No update available” can mean this model has no newer supported release; it does not establish that a recently purchased phone is still within its security-support period.
Keep the next decision proportionate. A delayed update does not prove infection. If the manufacturer confirms that important security support has ended, compare supported-device options and protect the affected accounts while planning the change. Avoid a reset that simply restores the same unsupported software and gives a false sense of completion.
When an App Asks You to Bypass a Restricted Setting
On Android 13 and later, some sensitive settings can be restricted for newly installed apps. If a caller, message or supposed cleaner tells you to allow restricted settings, pause and verify the developer independently. The restriction is a safeguard, not a diagnosis that your phone is infected.
Google explains that accessibility access can let an app read screen content and interact with other apps. Legitimate accessibility tools may need it; a delivery-tracking app or unsolicited cleanup tool needs a convincing, independently verified reason. Record the app and permission requested, and do not grant more access merely to make a warning disappear.
How to Check an iPhone
An iPhone needs a different approach. You cannot give a normal third-party app unrestricted access to inspect iOS and every other app. That limitation does not mean iPhones are immune to malicious software or account abuse.
- Open Settings > General > Software Update and install an available iOS update. Keep your apps updated as well. If the phone cannot receive needed security updates, consider supported-device options.
- Review installed apps and their permissions under Settings > Privacy & Security. Investigate unexpected access to the camera, microphone or location, considering which features you actually use.
- Check Settings > General > VPN & Device Management if you are concerned about an unexpected profile. Identify its owner before changing anything. Apple warns that removing a profile can also remove associated settings, apps and data; ask your employer or school about managed profiles.
- Review your Apple Account for unfamiliar devices or changes. If there is evidence of compromise, follow Apple’s account recovery guidance from a trusted device.
- For a Safari scare message, close the offending page. On recent iOS versions, open Settings > Apps > Safari and check Block Pop-ups and Fraudulent Website Warning. On older versions, Safari may appear directly in Settings.
Do not dismiss every iPhone malware alert as fake. Apple can display a genuine warning about a third-party app it has identified as containing malware. Its guidance on detected malicious apps recommends deleting the affected app. That system warning is different from a website demanding payment to “clean” your phone.
Use the Exact Warning to Choose Your Next Step
A clean-looking screen is not the goal of a phone check. You need to identify the affected app, permission, website or account and choose a response that addresses it. Keep a brief record of the exact warning and when it appeared. Do not include a password, recovery code or payment number when asking someone to help interpret it.
On Android, distinguish a scan warning from device certification. Google says Play Protect and certification work separately. A “Device is not certified” message is not the same as a report naming a harmful app. Open the Play Store directly, check the relevant status and use Google’s instructions for that specific message. Do not disable scanning because an unsolicited caller says it prevents their repair.
On iPhone, distinguish an app-blocking warning from a web advertisement. A genuine system warning can prevent a named malicious app opening; Apple recommends deleting the affected app. A webpage claiming it found several infections does not have that same diagnostic authority. Close the webpage rather than following its download or payment instructions, then inspect any app or profile you actually installed.
Verify a Targeted-Attack Notification Independently
A notification about mercenary spyware needs a different response from an ordinary browser scam. Apple explains how to verify its threat notifications: independently open account.apple.com and check for the notification after signing in. Do not use a link supplied by someone claiming to investigate it. Genuine threat notifications do not ask you to install a profile or app, open a file, or give a password or verification code by email or phone.
Take a verified alert seriously and seek the specialist help Apple recommends. The absence of a consumer-app detection is not a useful reason to dismiss it. Avoid resetting first when doing so could destroy evidence needed by the people helping you. For personal-safety concerns, use the separate trusted device described at the start of this guide.
Check What Happened After the Scare Message
Work through the actions you took, rather than only whether the message has disappeared. If you only viewed a page, closing it and reviewing its notification permission may address the immediate nuisance. If you installed something, identify that app or configuration and review the platform-specific checks above. If you typed account credentials or authorised a payment, use the actual account provider’s recovery process from a trusted device.
When another person talked you through changes, note any remote-access, accessibility or device-management permission you granted. Verify the software and developer independently before granting more access. A legitimate accessibility tool may need broad permission; an unexplained request from a stranger is a reason to stop, not to weaken a protection merely so their instructions work.
Keep a short record that leads to a useful response
A record helps separate device recovery from account recovery. Use a safer device first if monitoring by another person is a concern; even looking for help on the suspected phone may be visible. Do not collect evidence in a way that increases the risk to you.
| What to record | Why it matters |
|---|---|
| Exact warning and named app, without passwords or codes | Distinguishes a webpage, app warning and account alert |
| Device model, update status and when the issue began | Helps the manufacturer identify the supported troubleshooting route |
| What you entered, installed, paid or authorised | Identifies account, payment and permission recovery that a scan cannot perform |
| What changed after one ordinary troubleshooting step | Preserves a useful sequence rather than a list of simultaneous changes |
The Safety Net Project’s cell-phone safety plan explains why changing a monitored phone can alert an abusive person or erase evidence. Seek tailored safety planning before removal or a reset in that situation. For an ordinary technical fault, the manufacturer or authorised administrator is the more relevant first contact.
What the Results Can and Cannot Tell You
If closing one tab stops the problem, concentrate on that website and any permissions you granted it. If removing an identified unwanted app stops the behaviour, that is useful evidence about the cause. Neither outcome tells you whether a password was already exposed.
A clean scan, normal battery chart or lack of visible symptoms cannot certify that a phone is uncompromised. Equally, one slow afternoon is not a reason to wipe it. The appropriate next step depends on the evidence you actually found.
If you are deciding whether to buy additional software, see our explanation of whether iPhones need antivirus. Pay attention to the specific protection offered, rather than assuming a mobile “security” subscription can inspect everything.
When to Get Help or Consider a Reset
Contact the manufacturer or your organisation’s IT team if security warnings persist, essential settings cannot be changed, or problems continue after ordinary app troubleshooting. If you receive a credible targeted-attack notification, seek specialist help rather than relying on a consumer scan.
A factory reset is a later recovery option, not the first response to an unexplained symptom. Before erasing anything, understand the backup, sign-in and data-loss implications. A reset also does not reverse stolen data, undo unauthorised payments or secure an account that an attacker still controls.
If you entered a password or card details into a scam, treat that as a separate incident even if the phone now looks normal. Use a trusted device to change exposed credentials, review recovery details and contact your bank where necessary.
Finish With the Right Recovery Task
Use what you found to decide the next step: ordinary battery or app troubleshooting, removal of an identified harmful app, account recovery, or specialist help for a verified targeted alert. Keep the phone updated and preserve useful evidence before an irreversible reset. If the problem began with a browser’s virus scare, follow the dedicated pop-up guide rather than buying a cleaner from that warning.
Frequently Asked Questions
Can you check a phone for viruses without paying?
Yes. Start with the phone’s built-in security settings, updates and account checks. On Android phones that include Google services, Play Protect is available without a separate subscription. On iPhone, paying for a security app does not give it unrestricted access to scan the whole device.
Does battery drain mean my phone has a virus?
No. Battery wear, poor signal, navigation, video and background activity can all cause battery drain. Check the usage information and look for other evidence before assuming malware is responsible.
Will a factory reset prove my phone is safe?
No. A reset can help with many unwanted-app problems but does not certify every form of compromise. It cannot reverse stolen passwords, transactions or exposed data. Consider evidence, backups, sign-in recovery and personal safety before erasing a device.
Does “no update available” mean my Android phone is secure?
No. Check the Android version, Android security update and Google Play system status separately, then ask the manufacturer about support for the exact model. A model with no newer supported release is different from a phone that has installed every current security update.
Should I reinstall an app that Play Protect removed?
First read the named-app warning and removal result in Play Protect. Do not reinstall an app or disable scanning merely because a caller or pop-up tells you to. Verify the developer and follow the genuine security guidance for that specific app.
Sources and image credits
Checked 9 November 2026: Google Play Protect, Android updates, restricted settings, Apple’s malicious-app warning guidance and threat-notification guidance, plus the Safety Net Project’s safety plan. Manufacturer menus and support periods vary.
The phone-security illustration is conceptual. The warning diagram explains response boundaries and does not show a diagnostic result or a product interface.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.