If you suspect targeted spyware, the instinct is to scan, reset, or delete the first suspicious thing you see. Resist it. The goal is to learn the truth withoutlosing the evidence that proves it — and the order you do things in decides whether that is still possible.
Step 1 — Preserve before you touch anything
Stop using the phone for anything sensitive. Do not factory-reset it, do not uninstall apps, and do not “clean it up.” A reset wipes the forensic traces a real check depends on, and visible changes can tip off an operator who is monitoring you. If you can, keep the device powered and move sensitive conversations to a separate, trusted device in the meantime.
Step 2 — Lower your risk on a safer device
While the suspect phone is set aside, harden the device you are actually using: update the OS, turn on the strongest account protections, and consider Apple Lockdown Mode if you are on iPhone and high-risk. This reduces the chance of a fresh compromise while you sort out the first one.
Step 3 — Run a methodical check, not a random app
Skip the app-store “spyware detector” apps; they cannot see what matters. The credible self-check path is Amnesty International’s Mobile Verification Toolkit (MVT), which examines a backup of the device against publishedindicators of compromise. It is a technical tool — comfortable for a security-minded reporter, worth handing to a helper if not. The free research labs in the sources below can also advise.
What a result actually tells you
Be precise about what you can conclude. A self-check can only say “no known indicators of compromise were found” — never “your phone is clean.” MVT and similar tools match against spyware that has already been studied and published. A newer or self-erasing exploit can leave nothing detectable. A clean result lowers the odds; it does not certify safety.
When to escalate to an examiner
If indicators turn up, if the stakes are high, or if you simply need certainty you can stand behind, hand it to a credentialed examiner. They can image the device without changing it, correlate against the latest indicators, and produce a court-ready account of the findings — honest about attribution limits. See newsroom device-compromise response for that step, and where to get free expert help first.
