Understanding Abuse
Your phone, their eyes
Tech-enabled abuse, and how to get clear of it
Why this is everywhere
Your phone knows more about you than any person does, and it can be read by anyone who has had it in their hands for a few minutes, or who knows one password. Where you are, minute by minute. Everyone you talk to and what you said. What you searched at 2 a.m. Your photos, your calendar, your bank, your period tracker, the address of the friend you stayed with. A man who wants control does not need to follow you. He needs your phone, or your account, once.
This is not rare and it is not high-tech. The tools are ordinary: the built-in location sharing on every phone, a shared cloud account, a family plan, a cheap tracker in a bag, a login he watched you type. Advocates who work with survivors report that monitoring through phones and accounts is now one of the most common forms of abuse they see, and the person being monitored usually has no idea how much is visible. She notices only the effects: he knows where she was, he knows what her friend said, he turns up, he already has an answer for the thing she had not yet said.
The one fact that changes everything: most of the access is not a secret program hidden on the phone. It is his ordinary access to her accounts and settings, which stays open until she closes it, and which comes back if she sets up a new phone from the old one. That is why the steps in section 5 are in the order they are in, and why a new phone alone did not solve it for the young woman who needed one.
Who this is for. The woman it is happening to, and the friend doing it with her. Read it on a device he has never touched.
How they get in
There are two doors: the phone itself, and the accounts behind it. Most abusers use both, and the second one matters more.
The physical moments. Every one of these is ordinary, and every one is enough.
- While you sleep. Your thumb or face unlocks the phone whether you are awake or not. A few minutes is enough to turn on location sharing, add his number as a trusted contact, read a month of messages, or install something.
- While you are drunk, passed out or drugged. The same, with no chance you will stir. A spiked drink is sometimes the first move, and the phone is what it is for.
- When you leave it in a room. On the counter, on charge, in the car. If he knows the passcode, or if the phone is unlocked, that is access.
- "Can I borrow your phone?" To make a call, check a map, show you something. Two minutes with it unlocked in his hand.
- When he "sets it up for you." A new phone he bought, a plan he put you on, the accounts he helped you create. He knows every password because he chose them, and the phone may be registered to him.
- When he watches you unlock it. The passcode, seen twice, is his. The same for a laptop.
- Through a shared device. The family iPad, the car's screen, a smart speaker, a laptop you both use and never fully sign out of.
The account doors. What he puts on or near you, and what stays open after you take the phone back. Most of these a new phone does not close by itself.
The most common way right now: a tracking app he downloaded onto your phone and hid. This is not a specialist's tool. He takes your phone while you sleep or while it is on the counter, opens the app store, installs a tracking app in under two minutes, hides it, and hands the phone back. From then on he sees your location, and depending on the app your messages, calls, photos and more, on his own phone, from anywhere, for as long as the app is there. Thousands of these apps exist; they are sold as family safety, parental control, find-my-friends or anti-theft, and they are built to disappear.
Where they hide. Inside a folder you never open, on the last home screen page, in a folder with a boring name. Under a name and icon that look like part of the system: Settings, Sync, System Service, Device Health, Calculator. On Android, inside a hidden or secure folder the launcher can conceal, or removed from the app drawer entirely while still running. On iPhone, removed from the home screen so it only shows in the App Library, or hidden in the Hidden folder, which needs Face ID to open. You will not find it by looking at your home screen. You find it by listing every app the phone has, which is what step 6 shows you how to do.
If you take one thing from this page: he does not need skill, money or a secret. He needs your phone unlocked for two minutes, once. If that has ever happened, assume an app is there until you have listed every app and proved otherwise.
- Spyware. Apps sold as "parental control," "family safety" or "employee monitoring" that hide on the phone and send him everything: messages, calls, location, photos, keystrokes, sometimes the microphone and camera. On Android they are common and take a few minutes of physical access to install, typically while you sleep or are out of the room. On iPhone a hidden app is rarer; what is sold as iPhone spyware mostly works by logging into your cloud account with your password, which is why the account steps in section 5 matter more than scanning the phone. Either way, a backup restores it.
- Trackers. A small Bluetooth tag in your bag, car, coat lining or child's backpack. Cheap, silent, and reporting your location through every passing phone. Your own phone can warn you about an unknown tracker travelling with you if that alert is on; many people have never seen the setting.
- Your cloud account. Apple ID or Google account. With that password he can see your backups, photos, messages, location, saved passwords and browsing from his own device, from anywhere, without ever touching your phone again.
- Built-in location sharing. Find My, Google Maps sharing, Life360, Snap Map. Turned on once, by him, with your phone in his hand, and it stays on.
- Family plans and family groups. A carrier family plan lets the account holder see call and text logs and often location. Apple Family Sharing and Google Family Link can share location and purchases and, for a child account, control the device.
- Your email. Email is the master key: every other password resets through it. If he has it, he has everything, and he gets a copy of every reset you attempt.
- Linked apps and recovery details. His number or email listed as your recovery contact; your messages set to also appear on an iPad or Mac he can reach; a browser signed in on his computer with your account.
- Your car. Many cars have an app that shows location and trips to whoever set it up.
How common this is. The patterns above do not need skill. They are done by people who would not call themselves abusers, in the first weeks of a relationship, as "caring," and they are done in this city, now. Assume it is possible until section 4 says otherwise.
What they can see, and how it is used against you
| What is visible | Where it comes from | How it is used |
|---|---|---|
| Where you are, and where you have been | Location sharing; the cloud account; a tracker; the car; the carrier | Turning up; knowing you lied about where you were; knowing where the friend lives, where the clinic is, where the new place is |
| Who you talk to, and what you say | Messages synced to the cloud or to another device; call and text logs on a family plan; spyware | Knowing what your friend advised; punishing the friend; quoting your own words back to you |
| What you search and read | Browser history synced through the account | Knowing you looked up a hotline, a lawyer, an apartment, this page |
| Your photos | Cloud photo library | Leverage; proof of where you were; who you were with |
| Your calendar, email and bank | The account; shared logins | Knowing your plans before you say them; watching for money set aside |
| Your health and cycle | Period and health apps synced to the account | Knowing about a pregnancy or a test before you have decided what to do |
| What you want | All of the above, read over time | The one people miss: see below |
The last row is the subtle one. A man reading your messages and searches for months learns what you want: the trip you talk about with your sister, the job you are considering, the thing you wish he would say. He then provides it, at the right moment, and it feels like being understood. It is not. It is pandering built on surveillance, and it is one of the reasons women in these relationships say "but he knows me so well." He knows your data. The same reading lets him pre-empt: he raises the subject before you do, apologizes for the thing you had not yet confronted him about, or has the answer ready. The effect is that your own thoughts stop feeling private, and the next step is that you stop having them.
It also runs through other people. A friend's phone he had access to, a child's tablet with location on, a shared family account. Getting your own device clean is necessary and not sufficient; section 5 covers the rest.
Signs you are being monitored
Tick what fits. Two or more is enough to run the procedure in section 5 regardless of whether you find anything; the procedure does no harm if you were wrong.
What he knows
What your devices do
What you have done
The clean-slate procedure
Read all of it before you start, and do it in this order. The order exists because of two traps. First: if you cut his access in a way he notices before you are safe, he knows you know, and that is the dangerous moment. Second: if you set up a new phone from your old backup or sign the old accounts into it, you carry his access with you. A new phone restored from the old one is the old phone with a new case.
If you are still living with him or he can reach you, talk to an advocate (section 7) before doing anything he could notice. Some women run this procedure in secret over days; some do it the day they leave; some do it with an advocate in the room. The right order for you depends on your situation, and an advocate helps you choose it. Do not announce any of this.
Borrow a phone or laptop he has never touched, use a library or work computer, or buy the cheapest new phone you can and do not tell him. Everything from here on is done from the safe device unless it says otherwise. Do not log any of your old accounts into it yet.
A brand-new address at a provider you have not used. Strong password written down on paper and kept somewhere he cannot reach. Turn on two-factor using an authenticator app on the safe device, not text messages to your old number. This address is your new master key. It is never typed on the old phone.
From the safe device, photograph the old phone's screens that show his access: location sharing lists, family groups, devices signed in to your account, unknown apps. Photograph any tracker you find. Keep these photos on the safe device. They are evidence for a protection order and they are proof for you later when he says you imagined it.
- Your cloud account (Apple ID or Google). Sign in on the safe device. Change the password. Set the recovery email to the new address and remove any recovery phone or email that is his. Then look at the list of devices signed in to the account and remove every one you do not hold in your hand. Turn on two-factor with the authenticator app. (If the account itself was created by him and you cannot regain it, abandon it and make a new one; do not fight for an account he controls.)
- Your main email. Same steps: password, recovery details, signed-in devices, forwarding rules (he may have set your mail to forward to him; delete every rule), two-factor.
- Location sharing. Find My or Google location sharing: remove him and every person you did not choose. Leave any family group he controls. Check Snap Map, Life360, WhatsApp live location, and any app with a map.
- Family plans and groups. Apple Family Sharing and Google Family: leave the group. Carrier: call the carrier from the safe device, set an account PIN he does not know, and ask what the account holder can see; if the account is his, you need your own plan and your own number, and an advocate can help with the cost.
- Bank, social, messaging. Change passwords; check for his devices and sessions; set recovery to the new email; two-factor on.
- Shared devices. Sign your accounts out of any iPad, laptop, TV, speaker or car you both use. Check the car's app for who has access.
Do not wipe it yet if you may need evidence; put it in airplane mode and give it to the advocate or a trusted friend to hold. If you are keeping the phone, factory reset it fully, then set it up as a new phone, not from a backup, and sign in only with the new email and the accounts you took back in step 4. Do not restore apps from a backup; reinstall the ones you need by hand. Set a new passcode he has never seen, turn off face or fingerprint unlock until you are sure of your surroundings, and never let the phone out of your sight unlocked again.
Why "not from a backup" is the whole point. A backup restores the configuration that let him in: location sharing, the devices trusted on your account, saved passwords, any management profile, any app he installed, and every account that was signed in. Several people have bought a new phone, restored it from the cloud, and found him right where he was. The backup is the flaw. Start clean and accept losing some convenience.
On iPhone, Settings → Privacy & Security → Safety Check runs through who you share with and which devices have access, and can reset everything at once; use it after step 4, not instead of it. On Android, Settings → Security has a safety check and Google Play Protect scans for harmful apps; also look through all installed apps and remove anything you do not recognize, and in Settings → Security check for any device-administrator or accessibility permission granted to an app you did not choose. Both platforms now warn you about unknown trackers travelling with you; keep that on. Then list every app, not just what you see on the home screen. iPhone: Settings → General → iPhone Storage shows every app installed, including ones hidden from the home screen; also open the App Library and the Hidden folder, and check Settings → Screen Time for an app you did not add. Android: Settings → Apps → See all apps, with Show system turned on; check the launcher's hidden-apps setting and any secure folder; in Settings → Security, look at Device admin apps and at which apps have Accessibility access, because tracking apps use both to stay alive. Anything you cannot account for, remove, and photograph it first. If you cannot be sure, the factory reset in step 5 removes every app; the account steps are what keep them from coming back.
Bag, coat lining, car (under seats, in the trunk, wheel wells, the glove box, the charging port), children's bags and toys, the gift he gave you. Trackers are small and cheap. If you find one, photograph it in place before touching it, and talk to the advocate about whether to remove it or let the police see it first.
Tell the people closest to you, in person, that he may be reading their messages to you through their own phones if he has had access to them; ask them not to share your new number or address in writing. If you have children with devices, run steps 4 to 6 on theirs. Change the locks on anything that unlocks with an app.
Passcode, not a pattern. Two-factor everywhere, with the authenticator app. No shared accounts, ever again. Review the signed-in devices on your main accounts once a month. Keep the paper with the passwords where he cannot reach it. If anything from section 4 happens again, run the whole procedure again; it costs an afternoon.
What this does not fix. It does not remove what he already knows. It does not stop him from being told things by people he still has access to. And it does not make you safe by itself if you are still living with him. It closes the doors; the advocate helps with the rest.
For the friend or helper
You are the safe device. Most of the procedure is easier with a second person: someone whose phone he has never touched, who can hold the evidence, read the steps aloud, and sit through the carrier call. If you have ever had to buy someone a new phone, you know that the phone was the easy part.
- Do it somewhere he cannot walk in, on a day you have hours, not minutes.
- Keep the paper with her new passwords if she asks you to. Do not photograph it.
- Do step 3 (the record) before she changes anything; the screenshots are the part people skip and later wish they had.
- Watch for the backup trap. If she is setting up a phone and it offers to restore from iCloud or Google, that is the moment to stop her.
- Help with the money. A new number, a new plan, sometimes a new phone: an advocate knows which organizations cover these costs, and some carriers have programs for survivors.
- Check your own phone. If he has had access to it, your messages to her are not private. Run steps 4 and 6 on yours.
- Do not confront him, and do not post about it. Both make her less safe.
- Afterward, stay. The doors are closed; the fear takes longer.
Resources, and what to keep as evidence
In an emergency: 911.
| Who | How | Note |
|---|---|---|
| National Domestic Violence Hotline | 1-800-799-7233 · text START to 88788 · thehotline.org | 24/7; will talk to friends and family too |
| Washington State Domestic Violence Hotline | 1-800-562-6025 | 24/7 |
| Safety Net project, National Network to End Domestic Violence | techsafety.org | The best plain-language guides on tech abuse, by platform and app |
| Coalition Against Stalkerware | stopstalkerware.org | What stalkerware is and how to check for it |
| Clinic to End Tech Abuse (Cornell) | ceta.tech.cornell.edu | A model for hands-on device clinics; advocates can refer |
| Pierce County advocates | [Starflower organizations with their own pages] | [add before publishing] |
What to keep. Screenshots of his access before you removed it (location sharing, family groups, signed-in devices, forwarding rules, unknown apps); photos of any tracker in place; the password-reset emails you did not request; a dated note of each thing he knew that he should not have. Keep it on the safe device or with the advocate. In Washington, a pattern of monitoring and control can support a protection order [verify current statute]; this record is what makes the pattern visible to a court.
[Before publishing: confirm each number and link; add county advocates; have a victims-advocacy partner read sections 2 and 5; recheck the iPhone and Android settings paths in step 6 against the current OS versions.]