Your phone knows where you go, who you talk to and what you buy. Most apps use that access responsibly. Some collect far more than they need, and a few are designed to spy. The good news: you can check in about ten minutes.
Warning signs
- Permissions that don't fit. A torch, wallpaper or calculator app asking for your contacts, SMS, microphone or location.
- Battery or data drain. An app you rarely open near the top of your battery or mobile data usage.
- Constant notifications and pop-up adverts, especially ones that appear outside the app.
- Apps you don't remember installing, or apps with no name or icon.
- Your phone feels hot or slow when you aren't using it.
A 10-minute permission audit
On Android
- Open Settings → Security & privacy → Privacy → Permission manager (the exact names vary by phone).
- Check the high-risk permissions first: SMS, Contacts, Microphone, Camera, Location, Files.
- For each app, ask: does it really need this? If not, choose "Don't allow" or "Ask every time".
- Check Settings → Accessibility for any app you don't recognise. Accessibility access lets an app read your screen, which is exactly what banking malware wants.
On iPhone
- Open Settings → Privacy & Security.
- Review Location Services, Contacts, Photos, Microphone and Camera one by one.
- Use the App Privacy Report (at the bottom of the Privacy & Security page) to see which apps have accessed your data and contacted websites recently.
Keep it clean
- Install apps only from Google Play or the Apple App Store, and check the developer, downloads and recent reviews.
- Avoid "modded" or cracked apps from websites and Telegram channels. They're a common way to spread malware.
- Delete apps you haven't used in three months.
- Keep your phone updated. Updates close the holes that spyware uses.
Be careful with loan apps
Some predatory loan apps ask for access to your contacts and photos, then use them to shame borrowers. Before installing any loan app, check that the lender is properly registered with the relevant Nigerian regulators, read the permissions carefully and never grant contacts access.
Our course Recognising Everyday Threats includes a full lesson on risky apps and permissions.