A strange app icon you don't remember installing. Battery dropping from full to flat by lunchtime. Pop-ups appearing over apps that never showed ads before. Spyware on Android rarely announces itself, and the app responsible usually has a name dull enough that you scroll right past it. Safe Mode gives you a clean room to work in: your phone starts with only the system software running, so anything you downloaded sits switched off and harmless. That window is where you find the intruder — and remove it without giving up your photos, messages, or contacts.

Why Safe Mode Is the Right First Move

Safe Mode is Android's built-in troubleshooting state. It loads the operating system and the apps that came with the phone, and it deliberately skips every app you installed yourself. Spyware almost always falls into that second group, which means Safe Mode effectively handcuffs it while you work.

It also tells you something useful. If the odd behaviour disappears in Safe Mode — no pop-ups, no phantom notifications, battery back to normal — the cause is a third-party app. If the behaviour continues even in Safe Mode, the problem is more likely tied to a preinstalled app, a work or management profile, your Google account, or a compromised network. That distinction saves you an hour of guessing.

One thing to be clear about: Safe Mode is not a cure. It is a controlled environment for diagnosis and removal. The spyware is still on your phone, just asleep.

How to Boot Android into Safe Mode

On most modern Android phones, this takes about fifteen seconds:

1. Press and hold the power button until the power menu appears.
2. Press and hold the on-screen Power off or Restart option for a second or two.
3. When the prompt asks whether you want to reboot into Safe Mode, tap OK.
4. Wait for the phone to restart. You'll see the words Safe mode in a corner of the screen.

If that prompt never appears

Some phones and Android versions don't offer the long-press shortcut. In that case, power the device off completely, then hold the power and volume down buttons together until the logo appears. On a few models it's volume up instead. Once you're in, the grey "Safe mode" label confirms it worked. To leave Safe Mode, just restart the phone normally.

Confirm the Culprit Before You Delete Anything

Spend two minutes in Safe Mode watching for the symptoms you came for. Check your battery screen, notification shade, and recent data usage. If your phone suddenly behaves, you've confirmed a downloaded app is responsible and you can hunt with confidence.

Typical spyware symptoms: unexplained battery drain, heat while idle, mobile data disappearing, pop-ups outside the browser, apps opening by themselves, and notifications for services you never signed up for.

Keep in mind that some monitoring tools are installed with your phone's management profile rather than as a normal app. If your Settings menu shows a work profile or a device administrator you don't recognise, that's a different removal path — see below.

Find the App That Doesn't Belong

In Safe Mode, open Settings > Apps > See all apps and switch the sort order to installation date. Spyware usually lands on your phone the same day your problems started. Then work through the usual hiding places:

• Blank or vague names. Entries like "System Service", "WiFi Helper", or a random string of letters that you never installed.
• Missing icons. An app with no launcher icon is often designed to be forgotten.
• Device admin apps. Settings > Security > Device admin apps. Anything with admin rights can resist uninstallation.
• Accessibility services. Settings > Accessibility > Downloaded apps. This permission lets software read your screen and tap for you — spyware loves it.
• Notification and usage access. Check Settings > Apps > Special access.
• Install unknown apps. A browser or file manager allowed to sideload APKs is a common entry point.

Running a Google Play Protect scan from the Play Store app is worth doing too, though it won't catch everything.

Uninstalling the Spyware Without Losing Your Data

Removing an app does not touch your photos, videos, messages, or contacts. Those live in separate storage. The only thing you lose is the app's own data, which is exactly what you want gone.

1. If the Uninstall button is greyed out, go to Device admin apps and turn off admin rights for that app first.
2. Return to Settings > Apps, select the app, and tap Uninstall.
3. If no uninstall option exists, try Disable, then use Play Protect's removal option on the app's Play Store page.
4. Reboot out of Safe Mode and watch for a day to confirm the symptoms are gone.

If a work profile or management profile is involved

A profile controlled by an employer or another person won't uninstall like a normal app. In Settings, look for Work profile or Device admin and remove the profile if you're certain it isn't legitimate. Removing a work profile erases its data, so if the phone belongs to your employer, speak to IT before doing anything. And if someone else set up monitoring on your phone without your knowledge, that is a safety matter as much as a technical one — installing tracking software on another adult's device is illegal in many places. Keep evidence, and consider contacting law enforcement or a domestic abuse support service rather than handling it alone.

When Uninstalling Isn't Enough

Some spyware is stubborn. If it reinstalls itself, if the phone is rooted without your knowledge, or if the malware lives in the system partition, uninstalling won't hold.

A factory reset is the reliable answer — but back up carefully first. Copy photos, videos, documents, and contacts to a computer or a trusted cloud account. Do not restore a full phone backup afterwards; that restores apps too, and may bring the spyware back with them. Instead, reinstall apps from the Play Store one at a time as you need them. And change your Google account password before you set the phone up again, so a compromised account can't reinstall anything.

A Calm Habit for Next Time

Once the phone is clean, change the passwords for your main accounts, turn on two-factor authentication, and sign out of devices you don't recognise in your Google account's security settings. Keep Play Protect active, leave "install unknown apps" switched off for anything but a brief, deliberate sideload, and update Android when the prompt appears. Most Android spyware arrives through a link, a pirated APK, or physical access to an unlocked phone — so the practical defence is boring and effective: install from official stores, keep your screen lock strong, and when the phone starts behaving strangely, reboot into Safe Mode before you panic.

Photo: Yudi Ding / Pexels