Why old smartphones need a malware check
Older phones often run outdated operating systems, have forgotten apps, and may no longer receive security patches.
That combination makes them a realistic target for spyware, adware, banking trojans, and credential-stealing malware, especially if the device was rooted, jailbroken, or used outside the official app store ecosystem.
If you are planning to reuse, donate, sell, or trade in a device, knowing how to check old smartphone for malware helps protect your accounts, photos, contacts, and payment data.
The process is not just about finding a virus; it is about looking for signs of compromise, suspicious behavior, and risky software that may still be active in the background.
What malware can look like on an older phone
Mobile malware often hides behind normal-looking app icons or system behavior, so the warning signs are easy to miss.
On older Android and iPhone devices, common symptoms include sudden battery drain, overheating, excessive pop-ups, unexplained data usage, slow performance, and apps you do not remember installing.
- Battery draining faster than usual
- Device overheating while idle
- Unknown apps, profiles, or permissions
- Browser redirects or intrusive ads
- High mobile data usage without explanation
- Frequent crashes, freezes, or random restarts
- Contacts, texts, or calls sent without your action
None of these signs proves malware by itself.
However, several symptoms appearing together should trigger a deeper review of the phone’s settings, installed apps, and account activity.
How to check old smartphone for malware step by step
A proper check combines manual inspection with security tools.
Start with the phone’s own settings, then move to scanning tools and account security.
1. Review installed apps carefully
Open the app list and look for anything unfamiliar, recently installed, or disguised with generic names such as “System Service,” “Update,” or “Cleaner.” On Android, pay attention to apps with device administrator access or accessibility permissions, because malware often abuses those settings to stay persistent.
On iPhone, check for apps you do not recognize and look for configuration profiles or mobile device management entries under settings.
2. Check permissions and special access
Malicious apps frequently request more access than they need.
Review camera, microphone, SMS, accessibility, notification, and location permissions.
If a flashlight app wants access to messages or a game wants access to contacts, that is a red flag.
On Android, also inspect “Special app access,” including install unknown apps, display over other apps, and unrestricted battery use.
3. Monitor data, battery, and storage usage
Unexpected background activity can reveal malware.
In settings, compare which apps use the most battery, mobile data, and storage.
A suspicious app may consume data even when you are not actively using it, or may appear near the top of battery statistics despite being rarely opened.
4. Scan with a reputable mobile security app
Use a trusted security solution from a recognized vendor such as Malwarebytes, Bitdefender, Norton, Kaspersky, Avast, or ESET, depending on availability for your device and region.
These tools can detect known adware, spyware, phishing links, and risky configurations, although they may not catch every advanced threat.
For Android, run a full scan after updating the security app’s definitions.
For iPhone, security apps cannot scan iOS in the same way due to platform restrictions, but they can still check for unsafe links, phishing, account exposure, and risky network behavior.
5. Check browser history, downloads, and notifications
Browser hijacking is common on older phones.
Review recent downloads, browser extensions if applicable, and notification permissions for websites.
If you see repeated pop-ups, fake virus warnings, or unwanted website notifications, clear them and revoke the browser permissions that enabled them.
6. Look for unauthorized account activity
Malware often aims at email, cloud storage, social media, and banking accounts rather than the device alone.
Check login history for Google, Apple ID, Microsoft, Gmail, and major social platforms.
If you see unfamiliar devices, locations, or password reset emails, assume the phone or one of its linked accounts may be compromised.
Android-specific checks
Android offers more flexibility than iPhone, which also means more places for malware to hide.
Review the following areas closely.
- Play Protect: Open Google Play and confirm Play Protect is enabled and recently scanned the device.
- Device admin apps: Remove any app you do not trust from administrator access.
- Accessibility services: Disable accessibility access for apps that do not need it.
- Unknown sources: Check whether app installation from unknown sources is enabled.
- App store history: Review previously installed apps and uninstall anything unnecessary.
If the phone was rooted, treat the security risk as higher.
Root access can let malicious software evade normal protections, so a clean reset may be more reliable than trying to remove every trace manually.
iPhone-specific checks
iPhones are less likely to be infected by traditional malware, but they can still be affected by spyware, malicious profiles, phishing, and jailbreak-related tools.
Inspect the device for configuration profiles, VPN settings you did not add, calendar spam, and unrecognized Apple ID devices.
- Go to settings and check for profiles or device management entries
- Review Apple ID signed-in devices
- Confirm two-factor authentication is enabled
- Remove suspicious calendar subscriptions and website notifications
- Delete apps you no longer recognize or use
If the device was jailbroken, assume the normal iOS security model may not be intact.
In that case, removing suspicious tweaks is not always enough, and a full restore is often the safer route.
When a factory reset makes sense
If the phone shows clear signs of compromise, the cleanest fix is usually a factory reset followed by careful account recovery.
A reset removes installed apps, local files, and many forms of persistent malware, but it does not automatically clean cloud backups, compromised passwords, or infected accounts.
Before resetting, back up only essential personal files that you trust, such as photos or documents.
Avoid restoring a full device backup if you suspect the backup may reintroduce the same bad app, profile, or configuration.
How to reset safely without bringing the problem back
After the reset, reinstall apps one by one from official sources only: Google Play on Android, the App Store on iPhone.
Use strong, unique passwords for your Apple ID, Google account, email, and financial accounts, and enable multi-factor authentication wherever possible.
Also update the operating system to the latest version the device supports.
Even if the phone is old, the newest supported firmware can close known vulnerabilities and reduce the chance of reinfection.
How to protect an old phone after the cleanup
Old phones can remain useful, but only if they are kept simple and locked down.
The safest approach is to reduce the number of apps, avoid sideloading, and keep the device away from sensitive accounts if updates are no longer available.
- Install only essential apps from official stores
- Turn off unknown app installs and unnecessary permissions
- Use a screen lock with a strong passcode
- Keep Bluetooth, NFC, and location off when not needed
- Avoid logging into banking or primary email on unsupported devices
- Review account security settings regularly
If the phone cannot receive current security updates, treat it as a limited-use device for offline tasks, media playback, or a secondary SIM rather than a primary security-critical device.
Signs you should not reuse the phone at all
Some devices are too risky to trust, even after cleanup attempts.
Consider retirement if the phone cannot be updated, repeatedly reinstalls suspicious apps, has unknown management profiles you cannot remove, or was exposed to high-risk use such as rooted firmware flashing or untrusted APK downloads.
In those cases, the device may still be suitable for parts recycling, but not for storing personal data or signing into important accounts.
If you plan to sell it, perform a full reset and remove all accounts first so the next owner starts with a clean, properly deactivated device.