PanicStation.org
UK USA
us Technology & digital loss unknown admin app • device administrator app • phone administrator access • suspicious admin permission • app has full control • device management profile • unknown device management • mdm profile on phone • phone may be compromised • phone hacked signs • malware on android phone • strange apps installed • unwanted app permissions • spyware worry • stalkerware concern • unfamiliar vpn on phone • accessibility service abuse • admin access on android • vpn & device management iphone

What to do if…
you notice unknown apps with administrator access on your phone

Short answer

Assume the phone may be compromised: disconnect it from networks, remove unknown administrator/device-management access, then secure your key accounts from a different, known-clean device.

Do not do these things

  • Don’t keep using the phone for sensitive activity (banking, email recovery, password manager) until admin/device-management access is removed and you’ve re-secured accounts.
  • Don’t open the unknown admin app, “approve” prompts, or grant it more permissions.
  • Don’t immediately wipe the phone without first noting the app/profile name(s) if it’s safe to do so (you may need them for your bank, employer, or a report).
  • Don’t disable built-in security features just to make warnings stop.
  • If this is a work/school-issued phone, don’t remove management profiles/admin controls until you’ve checked with the issuing organization.

What to do now

  1. Disconnect quickly.

    • Turn on Airplane mode (and, if available, turn off Wi-Fi and Bluetooth too).
    • Keep the phone powered on while you remove admin/device-management access.

  2. Document what you’re seeing (fast, minimal, if safe).

    • Screenshot the screen showing the unknown app(s)/profile(s) with administrator/device-management access.
    • Write down: app/profile name, icon, and when you first noticed it.

  3. If it’s an iPhone: check for unknown management profiles and remove them if possible.

    • Go to Settings → General → VPN & Device Management.
    • If you see a profile or “Management” you don’t recognize, delete it, then restart the iPhone.
    • If removal is blocked and this is (or might be) a work/school device, pause and verify with the organization.

  4. If it’s Android: remove unknown “Device admin” access, then uninstall.

    • Go to Settings → Security (or Security & privacy) → Device admin apps / Device administrators.
    • Switch off admin access for anything you don’t recognize.
    • Then uninstall the app (Settings → Apps → the app → Uninstall).
    • If you can’t remove it, use Safe Mode (next step).

  5. Use Safe Mode on Android if removal is blocked.

    • Reboot into Safe Mode (third-party apps won’t run).
    • Repeat step 4 to disable admin access and uninstall the unknown app.
    • Restart normally to exit Safe Mode.

  6. Run a built-in scan (Android Play Protect).

    • Open Google Play Store → profile icon → Play Protect → run a scan.
    • Follow any removal prompts.

  7. Check common “silent control” areas and turn off anything you didn’t enable.

    • Accessibility services (can control screens): Settings → Accessibility.
    • Notification access (can read codes): Settings → Notifications → Special access / Notification access.
    • VPN: remove unknown VPNs.

  8. From a different, known-clean device, secure accounts in priority order.

    • Start with email, then Apple ID/Google Account, then banking.
    • Change passwords and turn on multi-factor authentication where available.
    • For email, check for unexpected forwarding/filters.

  9. If you lost money or personal info, report and get help.

    • Use FTC consumer guidance for hacked accounts/identity concerns.
    • If this involves cyber-enabled fraud, extortion, or losses, you can file a report with the FBI’s IC3.
    • Be careful to avoid lookalike reporting sites: type the official address yourself and don’t follow random links.

  10. If you can’t get confidence the phone is clean: factory reset is the safest “reset to zero”.

  • Factory reset removes apps and data.
  • Be careful with backups: only restore from a backup you’re confident was made before the unknown admin app/profile appeared. If you can’t be sure, reset and rebuild without restoring apps/settings until stable.
  • If you need to save irreplaceable items first (photos/contacts), do the minimum you can and avoid carrying over apps or device settings.

What can wait

  • You don’t need to figure out exactly “who” or “how” right now.
  • You don’t need to confront anyone or post about it.
  • You don’t need to install new security products immediately—regain control first (remove admin access/profiles, scan, secure accounts).
  • You don’t need a perfect long-term plan today.

Important reassurance

This is a reasonable thing to take seriously. Unknown administrator/device-management access can allow powerful control, and focusing on quick containment and account security is the right first move.

Scope note

This guide covers first steps to reduce immediate harm and regain control. If the problem persists (apps reappear, you can’t remove management, or you suspect targeted harassment), you may need specialist help later.

Important note

This is general information, not professional security, legal, or law-enforcement advice. Phone settings vary by model and software version. Some administrator/management controls are legitimate on employer- or school-managed devices—verify with the issuing organization if you’re unsure before removing required management.

Additional Resources
Support us