How Abusers Use Screen Recording and Monitoring Apps — and the Warning Signs Your Device Has One

A high school counselor in Minnesota described a pattern she’d started seeing in 2022 that had become more common every year since. Teenagers — almost always girls, though not exclusively — coming into her office with screenshots of their own text conversations that they hadn’t sent to anyone. Screenshots of messages sent and received in private apps. Screenshots that could only have been taken by someone who had access to the inside of their phone while it was in the teenager’s possession. The controlling partner had installed a monitoring app, and the teenager had no idea it was there. The counselor knew exactly what it was after the second case. She’d learned about it from the National Network to End Domestic Violence.

This is not a niche or emerging problem. The Coalition Against Stalkerware — a working group that includes the National Domestic Violence Hotline, the Electronic Frontier Foundation, and major cybersecurity companies — has documented a consistent and growing use of commercial monitoring apps in abusive relationships. The same app that a parent might install on a child’s phone to monitor screen time can be installed covertly on a partner’s or teenager’s device to track every message, every call, every photo taken, and every location visited. The app is identical. The consent is not.

Key Takeaways

• Monitoring and screen recording apps that are legal when disclosed to the device’s user become surveillance tools — and potentially illegal — when installed without consent on an adult’s or teen’s device.
• Common stalkerware indicators include unusual battery drain, unexpected data usage spikes, unfamiliar apps in the device’s application list, and device behavior such as the screen lighting up when idle.
• Federal and state wiretapping laws, along with CFAA (Computer Fraud and Abuse Act) provisions, make covert device monitoring illegal in most circumstances — but enforcement requires documentation.
• Teen victims of relationship surveillance often don’t recognize the signs because they assume their partner just has access to information they carelessly shared.
• If you suspect your device has a monitoring app, do not immediately factory-reset it — evidence preservation for legal reporting requires specific steps first.

The Two Faces of Monitoring Apps

The same software product can be purchased, installed, and used in two entirely different contexts: transparent parental monitoring of a child’s device with the child’s knowledge, or covert surveillance of an adult or teen without their knowledge.

Commercial monitoring apps — including products like mSpy, FlexiSPY, Hoverwatch, and dozens of others — are openly sold with parental monitoring framing. Their marketing shows concerned parents reviewing their children’s text messages. Their feature lists include location tracking, SMS and iMessage logging, app activity recording, photo access, screen recording on demand, call logging, and in some products, microphone or camera activation.

These same features, installed on a device without the owner’s knowledge, constitute stalkerware. The difference is consent and disclosure. The app itself is agnostic to whether consent exists.

The FBI’s 2023 Internet Crime Complaint Center (IC3) report listed stalkerware among tech-enabled crimes affecting intimate partner violence cases. CISA (Cybersecurity and Infrastructure Security Agency) has published guidance on stalkerware as a cybersecurity threat, specifically noting that these apps are routinely used to facilitate coercive control in abusive relationships.

What These Apps Can Access

Understanding the full data access profile of monitoring apps helps clarify why they are so useful to abusers and so harmful to victims.

Feature	What It Captures	Why Abusers Use It
SMS/iMessage logging	All incoming and outgoing text messages, including deleted ones	Monitor communications with friends, family, support resources
Social media monitoring	Private messages on Instagram, Snapchat, WhatsApp, Facebook Messenger	Detect communications the victim thinks are private
Location tracking	Real-time GPS position, location history, named places	Know where victim is at all times; catch them in “lies”
Screen recording	Periodic or continuous screenshots of device screen	Capture passwords, account recovery codes, private conversations
Call logging	Incoming and outgoing call records, sometimes call audio	Identify who the victim is talking to and how often
Photo/camera access	Access to camera roll, sometimes live camera feed	Verify victim’s claimed location; access intimate images
Keylogger	Every keystroke typed on the device	Capture passwords, draft messages, search queries
App activity	Which apps are opened, when, and for how long	Know when victim is using support apps, searching for escape resources

How Monitoring Apps Get Installed

Understanding the installation pathways helps parents and teens recognize their own vulnerability.

On Android devices: Android’s more open application model allows apps to be installed from sources other than the Google Play Store (a process called “sideloading”). Many monitoring apps explicitly instruct buyers to enable this setting and then install the app directly. The installation process takes approximately 5-10 minutes with physical access to an unlocked device. Many stalkerware apps can be configured to hide their icon after installation.

On iPhones: Apple’s iOS is significantly more restricted. The main pathways for monitoring app installation on iPhones are: iCloud account access (monitoring apps can sync photos, messages, and backups from an iCloud account the abuser has credentials for without ever touching the device), mobile device management (MDM) profiles that can be installed through a web link or during device setup, and jailbreaking (which is less common due to the technical complexity but removes all iOS security restrictions).

A critical pathway that parents and teens often don’t consider: an abusive partner who pays for the device, manages the phone account, or set up the phone initially may have installed monitoring before the victim ever used the device.

The carrier account pathway: If an abuser is the account holder on a shared phone plan, they may be able to access call and text records through the carrier’s account portal without installing anything on the device at all. This requires no physical access to the phone. Major carriers — including Verizon, AT&T, and T-Mobile — provide account holders access to call logs and usage history for all lines on the plan.

Technical Warning Signs of a Monitoring App

These signs do not definitively confirm a monitoring app, but their presence — especially in combination — warrants a more thorough investigation.

Battery and Data Behavior

• Unusual battery drain: Monitoring apps that run continuously in the background, transmit location data, or conduct periodic screen captures consume battery power that would not otherwise be used. If your battery is draining faster than it used to with the same usage patterns, this is worth investigating.
• Data usage spikes: Monitoring apps must transmit collected data (screenshots, location pings, message logs) to a remote server. This creates data usage that doesn’t correspond to any app the user consciously opened. Check your data usage breakdown by app in phone settings — look for unfamiliar app names consuming significant data.
• Device runs hot when idle: Consistent processing and data transmission while the phone appears to be doing nothing will generate heat. A phone that is warm or hot when it hasn’t been in active use is running something in the background.

Device Behavior

• Screen lights up when idle: Some monitoring apps, when accessing the camera or transmitting data, briefly activate the screen. This is particularly noticeable in dark rooms.
• Camera indicator light activates unexpectedly: On newer iPhones and some Android devices, a green dot appears when the camera is actively in use. If this appears when you aren’t using any camera app, something else is accessing the camera.
• Microphone indicator activates unexpectedly: Similar to the camera indicator — an orange dot on iPhone indicates microphone access.
• Unfamiliar apps in the app list: Go to Settings > Apps (Android) or Settings > General > VPN & Device Management (iPhone for MDM profiles). Look for apps with generic-sounding names, no icon, or names you don’t recognize. Many stalkerware apps use names designed to look like system utilities (“Sync Service,” “System Manager,” “Update Handler”).
• New configuration profiles on iPhone: Go to Settings > General > VPN & Device Management. Any profile listed that you didn’t deliberately install — especially from an organization name you don’t recognize — is a red flag.

Social Indicators

Technical warning signs matter, but the behavioral pattern is often what first tips off victims.

• Your partner or controlling person seems to know details of private conversations you had that you’re certain they weren’t present for.
• You receive accusations or confrontations about things you texted or searched for that the other person shouldn’t know.
• Your device was out of your possession (even briefly, such as when charging at a shared location) and someone else had it unlocked.
• You notice that conversations with specific contacts have been deleted — not by you.

What to Do If You Suspect a Monitoring App

This is the step where many people make a mistake that either destroys evidence or signals to the abuser that they’ve been discovered. The sequence matters.

Step 1: Do not immediately factory-reset the device. A factory reset will remove a monitoring app, but it will also destroy the evidence needed to report it to law enforcement. If you want to pursue legal action — which may be important for your safety, especially in a situation involving an abusive partner — evidence preservation comes first.

Step 2: Contact a domestic violence resource before doing anything else. If you are in a relationship with an abusive partner, the National Domestic Violence Hotline (1-800-799-7233 or thehotline.org) has trained advocates who understand technology-facilitated abuse and can help you plan your next steps safely. If you are a teen who suspects a partner, adult, or parent, the loveisrespect hotline (text “START” to 88788) provides similar support.

Step 3: Document what you find. Take photos of your phone’s app list, data usage screen, and device management profiles with a different device (not the potentially compromised one). Screenshot any evidence of the behavior patterns that raised your suspicion.

Step 4: Use a different device for safety research. If you are in an abusive situation and need to research your options, do not use the potentially compromised device to do so. A library computer, a friend’s device, or a new device is safer. Searching for domestic violence resources on a monitored phone may alert the abuser.

Step 5: Consult law enforcement or an attorney. The FBI’s Internet Crime Complaint Center (IC3.gov) accepts complaints about stalkerware. State laws on electronic monitoring vary significantly: some states make covert installation of monitoring software a felony. Others have specific intimate partner surveillance statutes. An attorney can advise on whether you have grounds for a civil or criminal complaint in your jurisdiction.

Step 6: After evidence is secured, remove the app. Once you’ve documented the monitoring app and consulted with appropriate resources, removing it is typically done either by a factory reset or by manually uninstalling the identified app. For iPhones, removing an MDM profile goes through Settings > General > VPN & Device Management.

The Teen Relationship Context

It is worth addressing the teen relationship context specifically, because this is where parents often don’t think to look.

Research from the Centers for Disease Control and Prevention found that approximately 1 in 12 teens reported being physically hurt by a boyfriend or girlfriend in the prior year, and the rate for digital abuse — including unwanted monitoring, harassment, and pressure to share images — is significantly higher. A 2020 survey by loveisrespect found that 1 in 3 teens had received unwanted sexual content or had a partner look through their phone without permission.

Teens in controlling relationships are often the last to recognize that what’s happening is abuse, partly because the controlling partner frames monitoring as love: “I just want to know you’re safe” or “I check because I care about you.” Parents who notice signs of a monitoring app on their teen’s device should not confront the suspected controlling partner without first planning carefully, and should engage the teen with care — teens in controlling relationships may not be ready to leave or may face real danger if the abuser feels their control is being threatened.

For more on how to talk to teens about digital safety in relationships, the National Network to End Domestic Violence’s Safety Net project (techsafety.org) has resources specifically for young people and their parents.

What to Watch For Over 3 Months

• Periodically check your device’s data usage by app and look for unexplained spikes or unfamiliar apps with significant data consumption.
• If a teen in your family has a partner you’re concerned about, watch for signs of the teen becoming increasingly secretive about their phone, seeming anxious when they receive messages, or having their partner account for their whereabouts in detail.
• Check iPhone device management profiles every 90 days: Settings > General > VPN & Device Management.
• On Android, check for unfamiliar apps by going to Settings > Apps and looking for apps that have no icon, no entry in the Play Store when you search for them, or unusually vague names.
• Watch for the social indicators: your teen or family member repeatedly being confronted about conversations that should have been private.

Frequently Asked Questions

Is it legal for a parent to install a monitoring app on their teen’s phone without telling them?

Laws vary by state and the teen’s age. For children under 18 on a device the parent owns and pays for, parental monitoring is generally legal. However, installing monitoring software on an adult child’s phone without their consent — or on a teen’s phone in a context that a court might consider a violation of privacy — enters murky legal territory. Transparency is both the ethical and legally safer approach.

What is the fastest way to check if someone installed something on my phone?

On iPhone: check Settings > General > VPN & Device Management for unfamiliar profiles, and Settings > Privacy & Security > App Privacy Report to see which apps are accessing your camera, microphone, and location. On Android: check Settings > Apps > All Apps for unfamiliar entries, and Settings > Network & Internet > Data Usage for apps consuming data you don’t recognize.

Can monitoring apps be installed remotely, without physical access to my phone?

On iPhones, iCloud-based monitoring does not require physical device access — only your iCloud credentials. On Android, remote installation is not possible through legitimate means, but malicious links can sometimes deliver apps if clicked. Physical device access is required for the most comprehensive monitoring app installations on both platforms.

If I find a monitoring app and remove it, am I safe?

Removing the app eliminates that specific monitoring vector, but if the person who installed it has your iCloud credentials or manages your phone account at the carrier level, they may retain other access. After removing a monitoring app, change all account passwords on a different device, update your iCloud/Google account password, enable two-factor authentication, and consider changing your phone number or plan to one the controlling person doesn’t manage.

What should I tell my teen about monitoring apps in relationships?

Frame it as a consent conversation: a partner who wants access to your private messages, location at all times, or who installs anything on your device without telling you is not demonstrating care — they are demonstrating a need for control. Healthy partners don’t need to monitor each other. Framing this as a relationship norm, rather than a technology warning, tends to land more effectively with teens.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

Sources

1. FBI Internet Crime Complaint Center (IC3). (2023). 2023 Internet Crime Report. https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
2. CISA. (2023). Stalkerware: What It Is and How to Protect Yourself. https://www.cisa.gov/resources-tools/resources/stalkerware
3. Coalition Against Stalkerware. (2024). About stalkerware. https://stopstalkerware.org/what-is-stalkerware/
4. National Domestic Violence Hotline. (2024). Technology and Coercive Control. https://www.thehotline.org/resources/technology-safety/
5. National Network to End Domestic Violence, Safety Net Project. (2024). Stalkerware: Understanding and Addressing Technology-Facilitated Abuse. https://www.techsafety.org/stalkerwareresources
6. Centers for Disease Control and Prevention. (2023). Teen Dating Violence: Fast Facts. https://www.cdc.gov/violenceprevention/intimatepartnerviolence/teendatingviolence/fastfact.html
7. loveisrespect. (2020). Digital Abuse Survey: Tech and Teen Dating Abuse. https://www.loveisrespect.org/resources/digital-abuse-statistics/