Start here: how iPhone monitoring actually works
Most "iPhone spyware" articles are written for Android and then have the word iPhone swapped in. That leads people to hunt for a hidden app that, on an iPhone, almost certainly is not there. iOS does not let one app read another app’s data, does not let apps hide their icon, and does not let a website or an app see what else is installed. Those limits are real, and they matter for how you check.
So how do people get monitored on an iPhone? In practice, in roughly this order of likelihood:
- 1
Someone knows your Apple Account password or your passcode.
With either, they do not need software on your phone. They can restore your iCloud backup to their own device, read Messages in iCloud, see your location through Find My, browse your shared photo library and read your iCloud Mail. This is the single most common form of iPhone "spyware", and it leaves no app behind to find. - 2
A configuration profile or MDM enrolment.
Profiles are files that change how the phone behaves. A management profile (MDM) can install apps silently, route your traffic through a proxy or VPN, install a root certificate that lets someone decrypt your web traffic, and prevent its own removal. Businesses use these legitimately. Abusers and some commercial "monitoring" products use them too. - 3
Family Sharing and Screen Time misuse.
Screen Time can report every app you open and how long you use it, and can restrict settings behind a passcode you do not know. Family Sharing can show your location to the family organiser. Both are legitimate features, and both are used to control adults. - 4
A jailbroken phone with stalkerware.
This is the classic model, and it is rare now. Jailbreaks for current iOS versions are hard to come by, break on updates, and usually need the phone to be re-jailbroken after every restart. If someone jailbroke your phone, there are signs. - 5
Mercenary spyware
in the Pegasus class. This is extremely rare and used against journalists, activists, lawyers and politicians, not ordinary partners. If you are in one of those groups, Lockdown Mode and Apple threat notifications are designed for you, and we cover them. - 6
Physical trackers.
An AirTag or similar tracker in a bag, a car or a coat is not spyware, but it is the same crime of tracking, and iOS warns you about them.
This guide covers each of those, in that order, with the exact Settings paths on recent iOS, what to look for, and what to do. Many of the checks take a minute each.
If the person who may be monitoring you is a partner, ex-partner, family member or anyone you live with or fear, changing your Apple Account password, removing a device from your account or turning off location sharing will be visible to them almost immediately. Apple sends an email and a notification when a password changes or a device is removed. A phone that suddenly "goes dark" can make a dangerous situation worse.
Talk to someone first if you can. The Coalition Against Stalkerware (stopstalkerware.org) has guidance and lists organisations by country. In the US, the National Domestic Violence Hotline is 1-800-799-7233. Local domestic-violence services can help you decide the safest moment to make these changes and whether to keep behaving normally while you prepare.
If you think you may want the police involved, read the section on preserving evidence before you delete or reset anything.
Screen Time and Family Sharing
Settings > Screen Time. If Screen Time is on and asks for a passcode you do not know, someone else set it. With a Screen Time passcode, they can see every app you use and for how long (on their own device, via Family Sharing), block apps, restrict account changes, and stop you turning off location sharing. On a phone belonging to an adult, that is monitoring.
If you are in a Family Sharing group, Settings > [your name] > Family Sharing shows the organiser and members. Check what you are sharing with the family: location (under Family Sharing > Location Sharing), purchases, and Screen Time reports. If you are set up as a "child" account in a family you did not choose, the organiser has significant control, including Ask to Buy and Screen Time. To leave, tap your name in the family list and choose Leave Family. Child accounts under 13 cannot leave on their own; an adult account can.
To remove a Screen Time passcode you do not know: Settings > Screen Time > Change Screen Time Passcode > Forgot Passcode? lets you reset it with the Apple Account credentials of whoever set it up. If that is not you, the passcode cannot be removed without Erase All Content and Settings.
Mercenary spyware, Lockdown Mode and threat notifications
Pegasus-class spyware is sold to governments and used against a very small number of people: journalists, human-rights workers, lawyers, opposition politicians and those close to them. It is delivered through exploits, sometimes with no click at all, and leaves no app behind. If you are not in a group like that, it is very unlikely to be your problem, and the earlier sections are where the answer lies.
If you are, two Apple features matter:
- Lockdown Mode: Settings > Privacy & Security > Lockdown Mode. It turns off a set of features that exploit chains rely on: most message attachment types, link previews, some web technologies, incoming FaceTime from unknown callers, wired connections while locked, and profile installation. The phone works, with some friction. For people at real risk it is the strongest protection available.
- Threat notifications: Apple sends an email and iMessage to the addresses on your account, and shows a banner at the top of appleid.apple.com after you sign in, when it believes you have been targeted by mercenary spyware. Apple does not send these by text message alone and never asks you to install anything; a message claiming to be a threat notification and asking you to click a link is itself an attack.
Checking a backup with MVT or iMazing
For people in at-risk groups, the Mobile Verification Toolkit (MVT), built by Amnesty International’s Security Lab, checks an iPhone backup against published indicators of compromise for Pegasus and similar tools. iMazing, a commercial macOS and Windows app, bundles a guided version of the same check. At a high level:
- 1On a computer you trust, make an encrypted local backup of the iPhone. In Finder (macOS) or Apple Devices / iTunes (Windows), select the phone, choose "Back up all of the data on your iPhone to this Mac/PC", tick Encrypt local backup, and set a backup password. Encrypted backups include more data, which is why this matters.
- 2
With iMazing
open iMazing, select the device, choose the Spyware Analyzer (in the Tools or device actions), and let it back up and analyse. It downloads the current indicator files, scans the backup and produces a report of matches. - 3
With MVT
install it withpip install mvton macOS or Linux. Decrypt the backup withmvt-ios decrypt-backup -p <backup password> -d <output folder> <backup folder>, download the latest indicators withmvt-ios download-iocs, then runmvt-ios check-backup --iocs <ioc file> --output <results folder> <decrypted backup folder>. Read the results folder for files ending in_detected.json; empty results mean no match against those indicators. - 4If you get matches, do not wipe the phone. Contact a specialist organisation, such as Amnesty’s Security Lab, Access Now’s Digital Security Helpline or Citizen Lab, who can verify the result and advise.
A clean MVT result means no match against the published indicators. It is not proof the phone is clean, and it does not look for commercial stalkerware or account access. Use it for what it is designed for.
Physical trackers
iOS warns you when an AirTag, AirPods or a compatible third-party tracker that is separated from its owner has been moving with you. The alert is "AirTag Found Moving With You" or "Unknown Accessory Detected". When you see it, tap it; you can play a sound on the tracker, see where it has been with you, and read instructions to disable it, which usually means removing the battery.
You can also search manually: Find My > Items > Identify Found Items, or long-press an item and check for unknown items nearby. Check cars (wheel wells, under bumpers, the glovebox, under seats), bags, coat linings and children’s belongings. A tracker is evidence; photograph it in place before you remove it, and note the serial number shown in the alert, which Apple can tie to the owner’s account on request from law enforcement.
Removing what you found
Order matters a little less on iPhone than on Android, because there is no app fighting back, but the account steps should come first, from a device the other person has never touched if possible.
- 1
Change the Apple Account password
and sign out other devices when prompted. - 2
Remove unknown devices
from Settings > [your name]. - 3
Fix trusted phone numbers, recovery contacts and recovery key.
- 4
Change the passcode
and turn on Stolen Device Protection. - 5
Run Safety Check > Manage Sharing & Access
and stop sharing with anyone you did not intend to. - 6
Remove profiles and MDM
under VPN & Device Management; remove stray certificates under Certificate Trust Settings. - 7
Reset or remove the Screen Time passcode
leave a Family Sharing group you did not choose. - 8
Turn off Text Message Forwarding, Call Forwarding and mail rules
you did not set. - 9
Delete VPN configurations and apps
you do not recognise. To delete an app, long-press it, choose Remove App, then Delete App. Also check the App Library, and Settings > General > iPhone Storage, which lists every installed app including ones hidden from the Home Screen. - 10
Update iOS
Settings > General > Software Update. Updates remove jailbreaks and close the holes exploits use. - 11
If a profile cannot be removed, the phone is jailbroken, or you simply want certainty: Erase All Content and Settings.
What "Erase All Content and Settings" does and does not do
Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. It removes every app, profile, MDM enrolment, Screen Time passcode, VPN, certificate and setting, and wipes the encryption key for the data, so the old data is unrecoverable. It also removes any jailbreak. Activation Lock stays tied to your Apple Account, so the phone cannot be set up by someone else without your password.
It does not:
Fix your Apple Account
If someone knows your password, a wiped phone changes nothing. They can still see Find My, Messages in iCloud, photos and your backups. Account steps come first.
Remove you from Family Sharing or clear location sharing
Those live in your account, not on the phone.
Touch the SIM
If someone has access to your carrier account, they still do. Set a carrier account PIN and a SIM PIN (Settings > Cellular > SIM PIN).
Protect you if you restore from an iCloud backup that contains the same profiles or apps. Set the phone up as new, sign in, and reinstall apps from the App Store yourself. Photos, contacts, notes and messages come back through iCloud sync; apps and settings do not need to.
Remove a physical tracker from your car.
- 1Evidence savedReport GSR-M3K2 exported · 12 screenshots
- 2Device admin removedSettings › Security › Device admin apps
- 3Revoke accessibility accessSettings › Accessibility › Downloaded apps › Sync Services › OffOpen this setting →
- 4Revoke notification access
- 5Force stop and uninstall
- 6Re-scan and lock accounts
After removal: locking it down
- 1
Passwords.
Apple Account first, then email, banking, social media, and everything stored in Settings > Passwords. A password manager makes this bearable. Assume everything saved on the phone was seen. - 2
Two-factor authentication
everywhere, with an authenticator app or passkeys rather than SMS codes. Remove any 2FA phone number that is not yours. - 3
Remove devices
from every account: Apple, Google, WhatsApp (Linked Devices), Telegram, Instagram, Facebook, Snapchat, your bank. Sign out all sessions. - 4
App Privacy Report.
Settings > Privacy & Security > App Privacy Report, turn it on, and come back in a few days. It shows which apps accessed your location, camera, microphone, contacts and photos, and which domains they contacted. An app you barely use that hits your location every hour deserves a second look. - 5
Review location sharing
in Find My > People and in Messages. Turn off Share My Location entirely under Settings > [your name] > Find My if you do not need it; you can still locate your own devices. - 6
Review Settings > Privacy & Security
permission by permission: Location Services, Contacts, Photos, Microphone, Camera, Bluetooth. Revoke anything that does not make sense. - 7
Lockdown Mode
if you are in an at-risk group. - 8
Face ID & Passcode
set "Require Passcode" to Immediately, turn off Control Center and Wallet access from the Lock Screen if you prefer, and turn on Stolen Device Protection. - 9
Auto-updates on
Settings > General > Software Update > Automatic Updates. - 10
Check other devices
iPad, Mac, Apple Watch and old phones on the same account need the same review. A Mac signed into your account with Messages in iCloud sees everything. - 11
Carrier account
set an account PIN and ask whether any authorised users, forwarding or extra SIMs are on the account. - 12
Come back in a week
and repeat the devices list, Safety Check and VPN & Device Management screens. If something has returned, you have a reinstall path to find and a stronger case for reporting.
Needs a look 1
Protection
When to involve the police or a forensic examiner
Monitoring another adult’s phone or account without consent is a crime in most places. If you may report it, keep the evidence before you remove anything:
Screenshots of the device list under Settings > [your name], with the unknown device’s name and model.
Screenshots of VPN & Device Management showing any profile or MDM, and the profile detail screens, plus the exported .mobileconfig and the GuestSpy profile report.
Apple’s emails about sign-ins, password changes, new trusted numbers or new devices. Do not delete them.
Screenshots of Find My sharing, Family Sharing, Screen Time and forwarding settings.
Photos of any tracker in place, and the alert screens with the serial number.
Your own notes on what the person knew and when.
Apple can provide account access logs to law enforcement with the right legal process, which is why the timing in your notes matters. If a forensic examination is needed, do not erase the phone; keep it charged, in Airplane Mode, and give it to the examiner. A domestic-violence advocate can help you find one.
Run a free scan right now
Drop an APK, a file, your installed-apps list or an iPhone configuration profile into the GuestSpy Web Scanner. Everything is analysed inside your browser. Nothing is uploaded.
Frequently asked questions
Can an app on my iPhone see my messages or other apps?
Not without a jailbreak. iOS keeps each app in its own container, and there is no accessibility-style permission that lets one app read another’s screen. That is why iPhone monitoring is nearly always done through the Apple Account, a profile, Screen Time or Family Sharing instead. Check those first.
Can GuestSpy scan my iPhone?
Not remotely, and no website can. The Web Scanner reads a configuration profile you export and tells you what it does. The GuestSpy app and this guide walk you through the account and settings checks, which is where iPhone monitoring actually lives. Anyone claiming to scan an iPhone from a web page is not being straight with you.
Someone knows my passcode. Is that really a problem?
Yes, a serious one. With the passcode, a person can see every saved password, change your Apple Account password, add their own device to your account, disable Find My and set up Messages forwarding, all in a couple of minutes. Change the passcode, turn on Stolen Device Protection, and then do the whole account review.
I found a management profile. Does that mean I am being spied on?
It means someone has management control over the phone, which can include silent app installs, traffic interception and restrictions. If your employer issued the phone, that may be expected. If it is your own phone and you did not enrol it, treat it as monitoring. Export the profile and run it through the GuestSpy profile check to see exactly what it does.
Will erasing the phone get rid of everything?
It removes every app, profile, jailbreak, Screen Time passcode and setting on the phone. It does not change your Apple Account, your Family Sharing membership, your location sharing, your carrier account, or a tracker in your car. Do the account steps first, and set the phone up as new rather than restoring an old backup.
I got an "AirTag Found Moving With You" alert. What should I do?
Tap it, play the sound to find the tracker, and photograph it where you find it before disabling it. Note the serial number from the alert. If you are in a dangerous situation, consider leaving it in place until you have spoken with an advocate or the police, since removing it tells the owner you found it.
Do I need Lockdown Mode?
If you are a journalist, activist, lawyer, politician or close to one, it is worth the inconvenience. If your concern is a partner or family member, Lockdown Mode does not address how they are most likely watching you; the account and sharing checks do. There is no harm in using it, but do not let it replace the other steps.
Why does Apple keep emailing me about sign-ins and changes?
Because Apple notifies every address and device on the account when a password changes, a device is added, a trusted number changes or someone signs in from a new location. Those emails are useful: they are a timeline. Keep them, and if any describe something you did not do, start with the device list and the password change.