How do you detect a keylogger on your phone?

To detect a keylogger on a phone, check which keyboards and accessibility services are enabled, review recently installed apps and sources, and run your platform's built in scan. Phone keyloggers rarely hide as obvious apps. They usually need a permission you had to grant, so that is where to look.

How do phone keyloggers get access?

MITRE's mobile technique T1417.001, Input Capture: Keylogging, lists the methods. Masquerading as a legitimate third party keyboard to record keystrokes. On both Android and iOS the user must explicitly authorize a third party keyboard, and MITRE advises users to use extreme caution before granting it. Abusing accessibility features: on Android, an app can register an accessibility service and listen for text change events, and the event data can contain what the user typed. MITRE adds that further methods may be possible if root access is available.

The same page lists real mobile malware families that log keystrokes, some of which work in every installed application. The lesson is not to memorize names. It is that these tools rely on permissions you granted or access that someone with your phone could grant.

Where do you look first?

Menu names vary by phone make and system version, so use the search box in Settings.

1. Keyboards. Open the keyboard or language and input settings and list every enabled keyboard. Remove any you do not recognize. On Android also check the default keyboard.
2. Accessibility services (Android). Open the accessibility settings and review services with full access. Legitimate ones include screen readers and password managers. A service you cannot explain with a vague name needs scrutiny.
3. Device administrator and special access lists. Check apps allowed to appear on top, to use notification access and to be device admins.
4. App list. Sort by install date. Look for anything installed around when problems began, and for apps with generic names such as "System Service" or "Update".
5. Install sources. Apps installed from outside the main store carry more risk.
6. Battery and data use. A hidden logger that uploads text may show unusual background network use. This is a weak signal on its own.
7. iPhone: review enabled keyboards in the keyboard settings and check for profiles under VPN and device management that you did not install.

Constructed example: someone notices that their phone gets warm overnight and a banking app asked them to log in again. In settings they find an enabled keyboard named something like "Smart Input" they never chose, and an accessibility service with a similar name. Both were added when they installed a free wallpaper app from a link in a message. Removing the app and both entries ends the capture. Changing passwords from a different device finishes the job.

What do built in scans do?

On Android, Google Play Protect checks apps from the Play Store before download and checks your device for potentially harmful apps from other sources. It can warn you and may deactivate or remove harmful apps. Google's help page says it is on by default and recommends keeping it on, and that you can view the setting from the Play Store profile menu. It also says Play Protect may prevent installing an unverified app that uses sensitive permissions commonly targeted for financial fraud. A scan is useful but not proof of a clean phone, since new or targeted tools may not yet be known.

What if you find something?

1. From a different, trusted device, change the passwords for your email first, then banking and other important accounts, and enable multifactor authentication.
2. Remove the unwanted app, keyboard and permissions.
3. Update the operating system.
4. If you are unsure the phone is clean, back up only photos and contacts and perform a factory reset, then reinstall apps from the official store only.
5. If you think someone with physical access installed it, think about your safety before taking steps that alert them, and ask a trusted support organization for advice.

How to reduce the risk

• Install only from the official store, and read the permissions an app requests before approving.
• Never grant accessibility access to an app whose purpose does not need it.
• Use a screen lock and do not leave an unlocked phone with others.
• Keep the system and apps updated.
• Use a password manager and multifactor authentication, which limit what a captured password can do.

Quick check

Sources

• MITRE ATT&CK T1417.001, Input Capture: Keylogging (Mobile)
• Google, Use Google Play Protect

Last reviewed: 18 October 2026.