PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
your phone shows a sudden spike in data usage and you fear an unknown upload is running

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Cut the connection first: turn on aeroplane mode, or switch off mobile data, then check which app or system service used the data before deleting anything.

Do not do these things

  • Don’t factory reset, wipe the phone, or delete apps straight away; you may lose clues and account access you still need.
  • Don’t keep testing by turning mobile data on and off while panicking; if there is a real upload, that can let it continue in bursts.
  • Don’t install “cleaner”, “data saver”, or “security” apps from adverts, pop-ups, or unexpected messages.
  • Don’t click links in unexpected texts or emails about “data usage”, “account locked”, “new SIM”, or “security alert”.
  • Don’t assume it is definitely a hack; cloud backups, app updates, hotspot use, streaming, and system downloads can look alarming.

What to do now

  1. Freeze the data use.
    Turn on aeroplane mode. If you need calls or texts, turn aeroplane mode off but keep Mobile Data off. Also check that Personal Hotspot or tethering is off.

  2. Write down what you see before changing more settings.
    Note the time, the amount of data used, any warning from your mobile provider, and any app name shown in the data screen. A screenshot can help if you can take one without reconnecting mobile data.

  3. Find the likely source.

    • iPhone: Settings → Mobile Service → scroll to see app mobile data use. Some devices or screens may say Mobile Data or Cellular.
    • Android: Settings → Network and Internet or Connections → Data usage → App data usage or similar.
      Look for the top one to three items and whether the spike happened today, overnight, or across several days.

  4. Check the common large-data causes first.
    Look for mobile-data use by photo or video backup, iCloud Photos, Google Photos, app updates, system updates, streaming apps, navigation apps, VPN apps, or hotspot/tethering used by another device.

  5. Stop the specific source without deleting it yet.
    Turn off mobile data for the app if your phone allows it. On Android, restrict background data for that app where available. On iPhone, turn on Low Data Mode for mobile data. On Android, turn on Data Saver; it reduces background data use but does not fully block all data transmission.

  6. If the top item is unknown, a VPN, or an app you do not recognise, contain it.
    Force close the app, turn off its mobile data or background data access where available, and disconnect any VPN you did not intentionally enable. If you see VPN, Profiles, Device Management, or a work or school management setting and you are not sure what it is, keep the phone disconnected while you check whether it is legitimate.

  7. Check whether the mobile account itself may be affected.
    Use another phone or a trusted device to contact your mobile provider if you have lost signal, received a “SIM changed” or “number moved” message, cannot receive calls or texts, or see provider-account changes you did not make. Ask the provider to secure the account and stop any unauthorised SIM or account changes.

  8. Protect accounts if there are takeover signs.
    If you see password reset messages you did not request, new-device login alerts, or locked accounts, secure your email and key accounts first, starting with the account that controls password resets. Use a trusted device if possible.

  9. Report scam messages or fraud if relevant.
    Forward suspicious texts to 7726. If you believe fraud or cyber crime has happened, use Report Fraud in England, Wales or Northern Ireland. If you are in Scotland, contact Police Scotland on 101. If a crime is happening now or someone is in immediate danger, call 999.

What can wait

  • You do not need to decide now whether to factory reset the phone, replace it, or change every password.
  • You do not need to prove whether it was definitely hacked before stopping the data flow and securing the mobile account.
  • Deep cleanup, full reinstalling, and long-term security changes can wait until the phone is disconnected and your key accounts are stable.

Important reassurance

A sudden data spike is often caused by ordinary background activity, especially photos, videos, app updates, streaming, or hotspot use. Cutting the connection first limits further data use and gives you time to check calmly.

Scope note

These are first steps to stop possible uploading, identify the likely source, and protect access. Later decisions may need help from your mobile provider, device maker, account provider, or a suitable specialist.

Important note

This is general information, not legal, medical, financial, therapeutic, security, or other professional advice. Phone menus vary by model, network, and software version; when you cannot confirm a setting, disconnect first and investigate from a safer device.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us