PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
an app has camera, microphone, or location permissions you do not remember approving

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Revoke the app’s camera, microphone and location permissions now, then stop using that app until you have checked recent access and basic account safety.

Do not do these things

  • Do not grant more permissions to “test” what happens.
  • Do not sign in again, verify your identity, or enter payment details in the app while you are unsure.
  • Do not delete everything in a rush before taking a quick record of what you saw.
  • Do not assume it is definitely hacked or definitely harmless from one screen.
  • Do not confront anyone about possible monitoring if that could put you at risk.

What to do now

  1. Make a quick record.
    Take a screenshot of the permissions screen. Note the app name, the app version if shown, and which of camera, microphone or location is enabled.

  2. Revoke the sensitive permissions.

    • iPhone: Settings → Privacy & Security → Camera, Microphone or Location Services → turn the app off, or set location access to Never if that option is shown.
    • Android: Settings → Security & Privacy, or Privacy → Permission manager → Camera, Microphone or Location → choose the app → set access to Don’t allow where available. Wording can vary by Android version and phone maker.

  3. Stop the app from running for now.

    • Android: open the app’s App info page and choose Force stop if available.
    • iPhone or Android: if the app is non-essential and you do not trust it, uninstall it for now. You can decide later whether to reinstall it from the official app store.

  4. Check whether the app recently used the camera, microphone or location.

    • iPhone: Settings → Privacy & Security → App Privacy Report. If App Privacy Report is on, check Data & Sensor Access for recent camera, microphone or location use. If it is off, turn it on so it can record future access.
    • Android: Settings → Security & Privacy, or Privacy → Privacy dashboard. Check camera, microphone and location to see which apps accessed them and when, if your Android version supports this.

  5. Run the built-in safety checks that are available.

    • Android: open Google Play Store → profile icon → Play Protect → run a scan and make sure Play Protect is on.
    • iPhone: check for any available iOS update when you are somewhere safe with enough battery or power.

  6. Check for settings that could explain unexpected permission changes.

    • iPhone: Settings → General → VPN & Device Management. Screenshot any profile or management entry you do not recognise. If it is a work, school or managed phone, contact the organisation’s IT or admin before removing anything.
    • Android: Settings → Security → Device admin apps, and Settings → Accessibility. Screenshot any unfamiliar app or service with powerful access before changing it.

  7. Secure key accounts from a safer device if you can.
    If you think someone else may have had access to your phone, use a different trusted device to check your main email account and any account linked to the suspicious app. If it is safe to do so, change the password, remove sessions you do not recognise, and turn on 2-step verification.

  8. If this could involve stalking, harassment or someone with physical access to your phone, prioritise personal safety.
    Use a different device for sensitive messages if you can. Ask someone you trust or a specialist support service for help before making changes that might alert the other person.

  9. If money was stolen, accounts were accessed, or you believe malware is involved, report it through the right UK route.
    If you live in England, Wales or Northern Ireland, use Report Fraud for cyber crime and fraud. If you live in Scotland, report cybercrime or fraud to Police Scotland; use 999 for an emergency and 101 for non-emergency police contact.

What can wait

  • You do not need to decide today whether to replace your phone.
  • You do not need to diagnose whether this was a bug, an update, a mistaken tap, or malicious activity before revoking the permissions.
  • You do not need to write a long complaint or contact the app developer right now.
  • You do not need to confront anyone while you are still checking whether the phone is safe to use.

Important reassurance

Unexpected permission access can feel frightening. It can happen because of an app update, a confusing prompt, a shared device, or a setting you tapped while distracted. Revoking access and checking recent activity is a reasonable first step.

Scope note

These are first steps only to reduce immediate risk and buy time. If there are signs of spyware, stalking, repeated compromise, stolen money, or unauthorised account access, later decisions may need specialist technical, legal, safeguarding or police support.

Important note

This guide is general information, not legal, technical, financial, therapeutic, medical or other professional advice. If you are in immediate danger, call 999 when it is safe to do so.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us