Search "how to remove spyware from Android" and you'll get the same five steps on every result: install an antivirus app, check for unknown apps, factory reset if all else fails. That advice isn't wrong, but it skips the parts that actually matter — why a factory reset alone can silently reinstall the very spyware you're trying to remove, why dialing those "secret codes" people share on Facebook does nothing at all, and why the app list in Settings is often the least reliable place to look. This guide covers the mechanics most articles gloss over, along with the actual tools Android ships with in 2026 that most people never turn on.
A safety note before you touch anything
If you suspect someone in your life — a partner, an ex, a family member — installed monitoring software on your phone deliberately, read this before removing anything. Most consumer stalkerware notifies the person who installed it the moment the app is uninstalled, force-stopped, or loses permissions. If you're in a situation where that could put you at risk, it may be safer to leave the app running for now and use a different, unmonitored device to plan your next step. The Coalition Against Stalkerware (stopstalkerware.org) maintains region-specific support contacts, and Malwarebytes and the National Network to End Domestic Violence both publish guidance written specifically for this scenario. If there's no personal-safety risk involved — this is a phone you bought secondhand, or you just want a clean device — the rest of this guide applies directly.
Stop trusting the dialer-code myth
Before anything else: forget *#21#, *#62#, and ##002#. These codes circulate constantly as "secret spyware detectors," and they do nothing of the sort. They're GSM call-forwarding diagnostic codes built into the baseband radio, designed to tell you whether your carrier is forwarding your calls to another number — a leftover from an era when call-forwarding fraud was the main phone-based scam. They have no visibility into installed apps, permissions, accessibility services, or background processes, which is where virtually all modern spyware actually operates. If a code shows "forwarding not active," that tells you nothing about whether spyware is on your device. It's worth knowing this explicitly, because acting on a false negative from these codes is exactly how people stop looking in the places that matter.
Where spyware actually hides, and why the app drawer won't show it
Modern Android spyware, whether it's a $30 "parental control" app sold in bad faith or a more capable commercial stalkerware product, almost never sits on the home screen with a visible icon. It typically does three things immediately after installation: removes its own launcher icon, requests Device Administrator or Accessibility Service privileges to make itself hard to force-stop, and renames itself to something forgettable like "System Update," "Device Health," or "Sync Service." This means scrolling through your app drawer looking for something suspicious is close to useless — you need to check the permission layers underneath, which is where these apps can't hide as easily.
Start with Device Administrator apps, since this is the privilege tier that blocks normal uninstallation. The path varies by manufacturer — on stock Android it's Settings > Security > More security settings > Device admin apps; on Samsung it's under Settings > Biometrics and security > Other security settings; on Xiaomi/MIUI it's Settings > Privacy protection > Special permissions > Device admin apps. On a personal, non-work phone, the only entries you should ever see here are Find My Device (Google) and possibly your antivirus app. Anything else is deactivated by unchecking it — this alone often unlocks the ability to uninstall the app normally afterward.
Then check Accessibility. Go to Settings > Accessibility > Installed apps (or Downloaded apps, depending on your OEM skin). This service exists so screen readers and switch-access tools can read and interact with on-screen content for users with disabilities — which is precisely why it's the single most abused permission in the stalkerware ecosystem. An app with Accessibility access can read everything rendered on your screen, including one-time passwords, banking app balances, and message content, all without needing root. If you see a generic-sounding service here that you don't remember granting screen-reading access to, that is the strongest single red flag you'll find anywhere on the device, and it's worth investigating before anything else on this list.
Checking who actually installed the app — a detail almost nobody mentions
Since Android 11, every app's info page carries a line that most users never notice: tap any app in Settings > Apps > [app name] > App details, or on newer versions Settings > Apps > See all apps > [app name], and scroll to "App details" or "Store listing," which shows the installer source. Apps genuinely from the Play Store show "Installed via Google Play Store." Apps installed manually — by someone plugging your phone into a laptop, sending you an APK file, or using ADB over USB — show "Installed via Package Installer" or simply show no store listing at all. This single field is one of the fastest ways to separate a legitimately downloaded app from something sideloaded onto your phone during a period when it was out of your hands, since almost no ordinary user manually sideloads APKs, but nearly all consumer stalkerware is distributed exactly that way, specifically because Play Store apps get scanned by Play Protect before they're allowed to install.
Check whether USB debugging was ever turned on without you knowing
This is the detail that rarely makes it into these guides, and it matters because it explains how spyware got onto a phone that was never handed over willingly for long. Go to Settings > About phone, tap Build number seven times to reveal Developer options, then open Settings > System > Developer options. If Developer options is already enabled and you never turned it on yourself, treat that as a serious signal on its own. Enabling it requires deliberately tapping Build number seven times — nobody does this by accident — and its main purpose for an attacker is enabling USB debugging, which allows a connected computer to run adb install commands that push an APK directly onto the device over a cable, completely bypassing the Play Store and, historically, bypassing Play Protect's install-time scan as well. A five-minute window with your unlocked phone and a laptop is all this technique needs. If Developer options and USB debugging are on and you didn't do it, turn USB debugging off immediately, then work through the rest of this list before turning Developer options off entirely, since some of the checks below are easier with it briefly enabled.
Reading the permission graph instead of the app icon
Rather than hunting app by app, flip the process around using Settings > Privacy > Permission manager (or Apps > Special app access on older versions). Open each of these categories and read down the list rather than across your app drawer: Camera, Microphone, Location ("Allow all the time" specifically, not "only while using"), SMS, Call logs, and Display over other apps. An app you don't recognize holding "Location: Allowed all the time" or persistent Microphone access is far more informative than its name or icon, because spyware developers control the name and icon but can't hide from the permission ledger itself. Pay particular attention to "Display over other apps" and "Draw over other screens" — this permission lets an app render invisible overlays used to capture what you tap, and legitimate apps rarely need it outside of things like Messenger's chat heads.
Using Play Protect's Live Threat Detection properly
Reading data usage the way an investigator would, not the way the Settings app presents it
Checking Settings > Network & internet > App data usage for an unfamiliar app burning background data is standard advice, but it misses how most modern spyware actually exfiltrates data. Rather than opening its own direct connection — which shows up plainly under the app's own name — a well-built spyware app routes uploads through Firebase Cloud Messaging or a similar push-notification relay that Android attributes to Google Play services in the data usage breakdown, not to the spyware app itself. This is deliberate: it makes the traffic blend into background noise that every phone generates. If you're auditing data usage, don't just look for the one suspicious app name — check whether Google Play services' data footprint is unusually high relative to your normal pattern, especially background data over Wi-Fi during hours you weren't touching the phone. It isn't proof on its own, since plenty of legitimate sync activity flows through the same channel, but combined with an unfamiliar accessibility service or device admin entry, it corroborates the pattern rather than standing alone.
The factory reset trap nobody warns you about
Checking your Google account for legitimate tools being misused
Not everything worth checking is a stalkerware APK. Google's own family-safety and location-sharing tools are frequently repurposed for covert monitoring precisely because they're legitimate, signed by Google, and invisible to any malware scanner. Open myaccount.google.com > People & sharing > Location sharing and confirm every person listed is someone you actively chose to share with. Separately, check whether your account is enrolled as a supervised account under Family Link — go to Settings > Google > Set up family or check families.google.com directly — since an adult account added to someone else's Family Link group inherits activity reporting and location visibility that has nothing to do with installed apps and won't be caught by any spyware scanner on this list.
Removing it once you've confirmed what it is
With Device Admin revoked and Accessibility access pulled, most consumer spyware can be uninstalled the normal way — long-press the icon (or find it via the App details screen you used to check the installer source) and choose Uninstall. If it's still resisting removal, Safe Mode strips out third-party processes entirely: power off, then power on holding Volume Down until "Safe Mode" appears in the corner, and uninstall from there. After removal, monitor the phone for 24–48 hours — battery life returning to normal and background data dropping back to baseline are good confirmation signs that nothing was left running. And remember what removal doesn't undo: any data already uploaded to the spyware operator's servers before you removed it is already out of your hands, which is a separate problem from the app itself and, depending on your situation, may be worth a conversation with local authorities or a domestic-violence advocate rather than something to solve technically.
