She noticed it on a Tuesday morning. She had mentioned, only in a WhatsApp message to her sister, that she was thinking about visiting a shelter. That evening, her husband brought it up — calmly, conversationally, as if he had simply overheard it. She hadn’t called him. She hadn’t told him. She had never said the word “shelter” out loud.
Her phone knew. And so did he.
What she was experiencing is textbook stalkerware: commercial surveillance software installed secretly on a victim’s device, transmitting their location, messages, call logs, and photos to whoever put it there. It’s sold openly. It’s easy to install. And in most jurisdictions, including India, the products themselves are entirely legal to buy.
If you fear for your safety, read this first. Do not delete stalkerware the moment you find it. Many products alert the abuser if the app is removed. That moment of discovery can be dangerous. Reach out from a device you’re sure is clean. In India, call iCall at 9152987821 or the Vandrevala Foundation at 1860-2662-345 (24/7). Full safety steps are in “Before you do anything” below.
What stalkerware actually is
Stalkerware is not a virus or a hack in the conventional sense. It’s a category of commercially sold software — marketed, usually, as “parental monitoring” or “employee tracking” tools — designed specifically to hide from the person being monitored.
The leading products include FlexiSPY, mSpy, Hoverwatch, Spyic, and eyeZy. You can buy them right now, on their own branded websites, with pricing tiers, customer support, and money-back guarantees. FlexiSPY’s premium plan, at the time of writing, costs around $68 per month. The marketing copy describes it as a tool for “worried parents” and “employers who need to protect company data.”
What these apps actually do: once installed on a target device, they run invisibly in the background. They transmit GPS location continuously. They log every text message, WhatsApp message, and call. They can access the photo library. On some devices, they activate the microphone. All of it streams silently to a web dashboard that the person who installed the app can access from anywhere.
The Coalition Against Stalkerware — a group of domestic violence organizations and cybersecurity firms — estimates that the vast majority of stalkerware victims are women in intimate partner relationships. The “parental monitoring” framing is, largely, marketing cover.
The FTC drew a line in 2021
In September 2021, the US Federal Trade Commission took an unprecedented step. It banned Support King, the company behind a stalkerware product called SpyFone, from operating any surveillance business. Not fined. Banned.
The FTC’s investigation found that SpyFone harvested data from victims’ phones and failed to secure it adequately, exposing that data to additional risk. The commission also found the product was being used primarily not by parents or employers, but by stalkers and abusive partners. Support King was ordered to delete all data it had collected and notify victims that they had been surveilled.
It was the first time a US regulator had explicitly targeted stalkerware as a consumer protection issue rather than just a law enforcement matter. The FTC has since pursued similar actions against other surveillance apps. The message from that action was clear: selling a surveillance tool marketed for secret use against other adults is not a legally safe business.
That enforcement action happened in the United States. India has no equivalent regulatory action on record.
How it gets installed
This is the question that matters most for understanding your risk: stalkerware requires physical access to the unlocked device, typically for about five minutes. Most products advertise this explicitly in their setup guides. You need the phone in your hand, and you need it unlocked.
On Android, installation involves enabling “install from unknown sources” in settings — a standard security override — then downloading and running the stalkerware APK. Once installed, the app icon is typically hidden. The app may rename itself something innocuous in the app list: “System Service,” “Phone Manager,” “Device Health.” Android’s more open architecture makes it the more common target.
On iOS, the situation is more constrained but not impossible. A jailbroken iPhone can be compromised the same way as Android. But several stalkerware products — including some versions of mSpy — operate entirely through iCloud sync without needing physical device access at all. If someone knows your Apple ID and password, they may be able to access your iCloud-backed messages, photos, and location history from a web browser. No app installation required.
This is why the question “who has had access to my phone?” matters. But so does the question “who knows my Apple ID password?” And if you’re worried about being tracked physically as well, our guide to hidden AirTags and GPS trackers covers how to sweep a car or bag.
Signs your phone may have stalkerware
None of these signals are definitive on their own. But a cluster of them — especially alongside a relationship where your partner seems to know things they shouldn’t — warrants a closer look.
Battery draining faster than usual. Stalkerware runs continuously in the background, polling location, intercepting messages, and transmitting data. That takes power. Say a phone that used to last a full day now needs charging by midafternoon. It may just have an aging battery. Or it may be doing a lot of work you don’t know about.
Higher than expected data usage. Location pings, photo uploads, message logs — all of it goes somewhere over your data connection. Check your monthly data usage in your carrier’s app or in Settings. If you’re consuming significantly more data than your usage habits suggest, something is transmitting.
Phone warm when sitting idle. Your phone should do nothing overnight. If it’s warm when you pick it up in the morning, it was running something.
Apps you don’t recognize. In your app list, look for anything with a generic, system-sounding name that you didn’t install and can’t identify. Stalkerware developers specifically choose names that blend in.
Someone knows too much. This is the signal that matters most. Maybe your partner references details from private conversations, knows where you were when you didn’t tell them, or seems to respond to things before you’ve said them. Trust that feeling.
How to check your device
These steps will help you look more carefully. Go through them methodically, preferably somewhere private.
Android
Open Settings > Apps > See All Apps. Work through the list. For any app you don’t recognize, tap it to see when it was installed. If it was installed on a date when your partner had access to your phone, that warrants suspicion.
Open Settings > Battery > Battery Usage. Look for apps that are consuming a notable percentage of battery in the background — especially apps you don’t use or don’t recognize.
Open Settings > Accessibility > Installed Services. This is the most reliable check. Stalkerware almost always requires accessibility permissions to intercept messages and calls. Any service listed here that you didn’t enable yourself is a red flag.
On some Android versions, also check Settings > Device Admin Apps — stalkerware sometimes registers as a device administrator to prevent easy uninstallation.
iOS
Open Settings > Privacy & Security > Location Services. Scroll through the list and look for any app with “Always” access that you don’t recognize or don’t use.
Open Settings > [your name] and scroll down to the device list. If you see an unfamiliar device logged into your Apple ID, someone may have access to your iCloud data. You can remove devices from this list — but read the safety section below before doing anything.
Open Settings > [your name] > iCloud and review which data categories are synced. Messages, photos, and location can all be accessible to anyone logged into your Apple ID from another device.
Also check whether someone has added themselves to Family Sharing on your account — this gives visibility into location.
Before you do anything — read this
If you find stalkerware on your device and you’re in a relationship where you fear for your safety, do not delete it immediately.
This is not a caveat. It’s the most important thing in this guide.
Many stalkerware products are configured to send an alert if the app is uninstalled or if certain data stops arriving. Deleting the app — or resetting permissions, or removing a device from your Apple ID — can alert your abuser that you’ve discovered the surveillance. In an abusive relationship, that moment of discovery can be dangerous.
The right sequence is:
- Do not act on the device yet.
- Contact a support line from a different device — a phone you’re certain is clean, a friend’s phone, or a landline. In India: iCall at 9152987821 (TISS’s psychological counseling service, which also handles domestic violence situations) or Vandrevala Foundation at 1860-2662-345 (24/7 mental health and crisis helpline). These organizations can help you think through a safety plan before you take any action on your phone.
- Plan your next steps with support. A domestic violence counselor can help you think through the sequence of leaving or securing your situation in a way that accounts for the surveillance.
When it is safe to act, a factory reset is the most reliable solution — not trying to find and remove the specific stalkerware. Stalkerware is designed to resist detection and removal. A factory reset wipes the device entirely and removes everything. Set the device up as new afterward, not from a backup (a backup may restore the stalkerware). Change your Apple ID or Google account password from a separate device before or immediately after the reset.
What the law says in India
Here’s where it’s worth being precise, because there’s a common misconception about what’s actually illegal.
Selling stalkerware in India is not illegal. FlexiSPY and mSpy can be purchased and delivered to an Indian address without violating any law. The companies are not breaking Indian law by operating here.
Using stalkerware against someone without their consent is a different matter.
Installing software on someone’s device without their knowledge or permission violates Section 66 of the Information Technology Act 2000, which covers unauthorized access to computer systems. “Computer” under the IT Act includes mobile phones.
Intercepting someone’s private communications — messages, calls — without authorization violates Sections 66B and 66E of the IT Act 2000 and provisions of the Indian Telegraph Act.
And stalkerware is almost always used to monitor someone’s movements and contact. That conduct falls under Section 354D of the Indian Penal Code, which covers stalking. Section 354D was added in 2013 following the Nirbhaya case. It explicitly covers monitoring a person’s use of the internet, email, or other electronic communication.
If you want to file a complaint: go to your nearest police station and file an FIR citing Section 66 of the IT Act and Section 354D IPC. Bring evidence — screenshots, the name of the app you found, dates. You can also file a complaint with the Cyber Crime Reporting Portal at cybercrime.gov.in, which has a specific category for complaints involving women.
The challenge, practically, is that police response to IT Act complaints varies significantly by state and district. Documentation matters. Having a lawyer or support organization alongside you matters. This is another reason to reach out to support organizations before engaging the legal system alone.
A note for parents
If you’re reading this because you’re genuinely concerned about a child’s online safety: the distinction that matters is consent and transparency.
Google Family Link and Apple Screen Time are both designed to be visible to the child being monitored. The child knows the monitoring is in place. That transparency is what makes them appropriate tools for parental oversight rather than surveillance.
Hidden monitoring of any person — including an adult child, a teenager, or a young child who doesn’t know — trains them to believe that secret surveillance is normal. It removes the opportunity to build trust through conversation. And in the case of an adult child, it’s legally the same as monitoring a stranger.
If your concern is about a young child’s safety online, use visible tools and have the conversation. If your concern is about a partner, a sibling, or an adult child — what you’re describing is not parenting. It’s surveillance, and it causes real harm.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.