us Technology & digital loss

What to do if…
your phone shows a sudden spike in data usage and you fear an unknown upload is running

Produced and maintained by PanicStation.org Published: 2 July 2026 Last reviewed: 17 July 2026 Editorial policy USA guide

Short answer

Disconnect the phone first by turning on Airplane mode or turning mobile data off, then check which app or service used the data before deleting, wiping, or installing anything.

Do not do these things

Don’t factory reset or delete apps before you write down what used the data; it can remove useful clues.
Don’t install “stop uploads”, “track hackers”, or “fix it fast” apps from pop-ups, ads, texts, or unfamiliar sites.
Don’t keep cellular data on just to watch what happens.
Don’t follow links in surprise messages about a data overage, SIM change, number transfer, or locked account.
Don’t assume it is definitely hacking; cloud backups, updates, hotspot use, Wi-Fi assist features, VPNs, and streaming can cause large data spikes.

What to do now

Stop the connection.
Turn on Airplane mode. Then check that Cellular Data or Mobile Data is off and Personal Hotspot, tethering, or mobile hotspot is off.
Use internet only if you need it for recovery.
Keep mobile data off. Use Wi-Fi only on a network you control, such as your home network. Avoid public Wi-Fi for account recovery if you have another option.
Write down the top data users before changing anything.
- iPhone: Settings → Cellular → review the app list and System Services.
- Android: Settings → Network & internet, Connections, or similar → Data usage or App data usage. You can also search Settings for data usage or app data usage.
  Note the top 1–3 apps or services, the amount of data, and the time period shown.
Check the most common non-hacking causes.
Look for:
- photo or video backup, such as iCloud Photos, Google Photos, or another cloud app
- app or operating system updates over cellular
- music or video streaming left running
- hotspot or tethering used by a laptop, tablet, car, or another device
- a VPN app or security app routing traffic
- Wi-Fi assist or similar settings that use cellular data when Wi-Fi is weak
Block the specific data source without deleting it yet.
Turn off cellular data for the app if your phone allows it. On Android, use Data Saver and app data usage controls where available. On iPhone, use the per-app cellular data toggles and consider Low Data Mode.
If the top user is unfamiliar, isolate it.
Force close the app, stop its mobile data access if available, and disconnect any VPN you did not intentionally enable. If you see a profile, management setting, MDM, work profile, VPN, or configuration you do not recognise, keep the phone disconnected while you verify whether the phone is managed by work, school, or another device owner.
Check for wireless account takeover signs.
Use another phone if your service is unreliable. Contact your wireless provider through its official app, website, bill, or known customer-service number if you notice sudden loss of service, a SIM changed message, a number transferred message, carrier alerts you did not request, or you cannot receive calls or texts.
Secure the accounts that could control recovery.
Start with your email account, Apple Account or Google Account, wireless carrier account, and financial accounts. From a trusted device or connection, check recent security activity, unknown devices, recovery phone numbers, recovery emails, and new forwarding or sharing settings.
Use official fraud guidance if the spike links to SIM swap, number transfer, money loss, or identity misuse.
Use your wireless provider’s official fraud process and the FCC or FTC guidance listed below. Keep notes of dates, alerts, account changes, and provider contacts.

What can wait

You do not need to decide right now whether to replace the phone.
You do not need to do a factory reset before you have written down the data source and secured key accounts.
You do not need to change every password at once; focus first on email, Apple or Google, carrier, and financial accounts.
Deep cleanup, device replacement, and a full security review can wait until the phone number, email, and main accounts are stable.

Important reassurance

A sudden data spike often has an ordinary cause, especially backups, updates, streaming, hotspot use, or weak Wi-Fi. Disconnecting first is still the right move because it limits any further upload while you calmly check what happened.

Scope note

These are first steps to stop possible data movement, identify the likely source, and reduce the chance of account takeover. Later decisions may need help from your wireless provider, account provider, bank, or a qualified security professional.

Important note

This is general information, not professional security, legal, financial, law-enforcement, or technical support advice. Phone menus vary by model, carrier, and software version; when unsure, disconnect first and use official support channels.

Additional Resources

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us