Is Your Phone or Computer Hacked? 35+ Security Checks You Can Do Today

Your laptop suddenly becomes slow. Your phone battery starts disappearing unusually quickly. A browser keeps opening strange advertisements. You receive a Microsoft, Google or Apple login notification from somewhere you've never been. WhatsApp suddenly asks you to register your number again. Your email account shows messages you don't remember sending.

Then comes the worrying question: “Have I been hacked?”

Maybe. But don't assume every slow computer or rapidly draining phone is infected. A failing SSD can make a PC slow. A bad application can drain a phone battery. Browser notifications can look like virus warnings. Poor Wi-Fi can make a perfectly healthy laptop seem broken.

Cybersecurity troubleshooting therefore follows the same principle we use throughout the Hashtag Electronics Tech Toolkit:

Don't panic. Don't guess. Collect evidence, isolate the problem and then act.

This week's guide covers Windows PCs, Macs, iPhones and Android smartphones, with useful techniques for beginners, enthusiasts and IT professionals.

First: What Does “Hacked” Actually Mean?

People use “hacked” to describe several completely different incidents:

• Your device itself could contain malicious software.
• Your email password could have been stolen even though your laptop is perfectly clean.
• You might have entered banking credentials into a phishing website.
• Someone may have gained access to your WhatsApp account.
• A malicious browser extension could be modifying webpages.
• An unwanted application could be generating advertisements.
• Your password may have appeared in an old data breach.
• Someone could simply have discovered your password because you reused it.

These require different responses. Our first job is to identify what has actually been compromised.

1. Know the Warning Signs

Potential warning signs include login alerts you don't recognise, password-reset emails you didn't request, unknown applications, browser homepage or search engine changing unexpectedly, excessive pop-ups, security software being disabled, unfamiliar browser extensions, unusual network activity, messages being sent from your accounts, new email forwarding rules, unexpected authentication prompts, unknown devices in your account, files becoming encrypted or renamed, unexplained high CPU/GPU activity, strange administrative accounts, or unexplained camera/microphone activity.

2–4. Account & Authentication Basics

2. If You Suspect an Account Breach, Start With a Clean Device

Changing a password on a heavily infected computer isn't ideal. Where possible, use a device you reasonably trust. Then: change the password, use a strong unique password, enable MFA, review logged-in devices and sessions, remove unknown devices, review recovery email/phone, check security activity, review connected apps, and check email forwarding and filtering rules. An attacker may create forwarding rules so they keep receiving copies of your messages.

3. Never Approve an MFA Prompt You Didn't Initiate

If your phone shows “Approve sign-in?” and you aren't signing in — don't approve it. An attacker may already know your password and be hoping you'll approve the second factor. Repeated prompts can be MFA fatigue. Deny them, change the password from a trusted device, review activity, and remove unfamiliar sessions.

4. Your OTP Is a Password — Treat It Like One

Never give an unsolicited caller your OTP — for banking, WhatsApp, Microsoft, Google or Apple. The OTP may be exactly what they need to complete a fraudulent transaction.

Windows Security Checks

5–8. Windows Security & Scans

Open Start → Windows Security and review Virus & threat protection, Account protection, Firewall, App & browser control, and Device security. Run a Quick Scan under Virus & threat protection. Use a Full Scan when symptoms justify deeper inspection. On supported systems, Microsoft Defender Offline scan restarts into a more isolated environment — save your work first.

9–11. Task Manager, Startup & Installed Apps

Press Ctrl + Shift + Esc. Check CPU, Memory, Disk, Network and GPU. An unknown process at 95% CPU while idle deserves investigation — but research process names before ending them. Inspect Startup apps and installed applications (sort by date). Uninstall software you don't recognise or no longer use. Don't remove corporate security tools without authorisation.

12–14. Browser Extensions & Fake Virus Warnings

Malicious extensions can change search results, inject ads, redirect pages or monitor activity. Remove extensions you don't recognise. A website saying “YOUR PC HAS 9 VIRUSES!” is often scareware or notification spam — not a real scan. Review browser notification permissions and remove suspicious sites.

15–19. Resource Monitor, netstat, PowerShell, Accounts & Updates

Resource Monitor and netstat -ano help correlate network activity with process IDs. Match a PID with tasklist /fi "PID eq 1234". PowerShell: Get-NetTCPConnection and Get-Process -Id 1234. Review user accounts under Settings → Accounts. Keep Windows Update, browsers, Office and other software patched.

macOS Security Checks

Macs aren't immune. Check Login Items (System Settings → General → Login Items & Extensions), review Applications, use Activity Monitor, audit browser extensions, and keep macOS and apps updated via Software Update.

iPhone Security & Privacy Checks

Fast battery drain does not automatically mean a hack. Check Settings → Battery for real consumers. Review devices signed into your Apple Account. Audit Privacy & Security permissions (Location, Contacts, Photos, Microphone, Camera). Use privacy indicators and Safety Check where available. Keep storage free and iOS updated.

Android Security & Privacy Checks

Run Google Play Protect. Check recently installed apps — especially sideloaded APKs. Review Permission Manager and Special app access (display over other apps, install unknown apps, notification access, device admin, accessibility). Disable unnecessary “Install unknown apps” permissions. Review battery and data usage by app.

WhatsApp Security

Enable two-step verification. Review Linked Devices and log out anything unknown. Never share your WhatsApp registration code — a common scam is “I sent my code to your number by mistake, please send it back.”

Password Security

Stop reusing passwords. Credential stuffing reuses leaked combinations across services. Use unique passwords (a reputable password manager helps). Enable MFA on email, banking, Microsoft, Google, Apple, social and business accounts. Your primary email is often the master key for password resets — protect it especially well.

Backups: Cybersecurity's Safety Net

Follow the 3-2-1 principle: 3 copies, 2 different media types, 1 off-site. Synchronisation is not always the same as backup — version history and recovery points matter. Test restores. Before handing a device for repair: back up, remove unnecessary sensitive files, clarify whether the technician needs passwords, and document condition.

If You Think You're Actively Compromised

1. Stop interacting with suspicious messages.
2. Disconnect a badly infected computer if necessary (e.g. ransomware-like behaviour).
3. Use a trusted device to change important credentials.
4. Protect email first.
5. Change compromised passwords; enable MFA; revoke unknown sessions.
6. Check recovery information and email rules.
7. Scan affected devices with trusted tools.
8. Preserve evidence for serious business incidents — don't blindly wipe everything.
9. Notify IT/security for corporate accounts; contact banks if financial data may be involved.
10. Monitor accounts for further unauthorised activity.

Common Cybersecurity Myths

• “iPhones can't be hacked.” False — account compromise, phishing and vulnerabilities still exist.
• “Macs don't get malware.” False — unwanted and malicious software targeting Mac users exists.
• “I have antivirus, so I can't be hacked.” False — antivirus doesn't stop you typing a password into a phishing site.
• “A VPN makes me anonymous.” Not automatically.
• “Incognito hides everything.” No — it mainly changes local browser storage for that session.
• “My battery is draining, so someone is spying on me.” Not necessarily — check battery usage first.

Frequently Asked Questions

Cybersecurity isn't about being paranoid. It's about reducing unnecessary risk: update software, use unique passwords, enable MFA, don't share OTPs, review permissions, back up important data, and investigate instead of panicking.

This article provides general educational cybersecurity and troubleshooting information. If you suspect fraud, financial theft, stalking, a serious business compromise or exposure of sensitive information, preserve relevant evidence and contact the appropriate financial institution, service provider, IT/security professional or authorities as applicable.