How to check your iPhone for a virus (and remove it)

iPhones rarely get viruses in the traditional sense. Every app runs in its own sealed space and cannot reach into other apps or the system, and apps can only be installed from the App Store after Apple reviews them. That is why the scary warnings most people see are fake. Still, there are a few real ways something unwanted can end up on an iPhone, and this guide checks each one, for free, in about 10 minutes.

Fake virus warnings vs real signs

• Fake: a web page says “Your iPhone is infected” or “3 viruses found”, often with a countdown, a fake Apple logo or a phone number to call. Websites cannot scan your phone. It is an advert trying to scare you into installing an app, paying, or calling a scammer.
• Fake: calendar invitations or events full of virus warnings and links. These come from a spam calendar subscription, not a virus.
• Worth checking: pop ups in Safari even on normal sites, a profile you did not install, apps you do not remember, new accounts in Settings, or your Apple Account showing devices you do not own.
• Usually not a virus: battery drain, heat or slowness. These are almost always an app, an update or an aging battery.

How to check iPhone for virus and malware

Worried someone is watching your phone?

The most common real threat is not a virus but a person you know who had access to your phone or your Apple Account, for example a former partner. They may be seeing your location through Find My, reading synced messages on another device, or have added their face or fingerprint. Apple’s Safety Check is built for this.

Also check Settings › Face ID & Passcode for an Alternate Appearance you did not set up, and your AirTags and Find My for unknown items. An iPhone alerts you if an unknown AirTag seems to be traveling with you.

Apple threat notifications and Lockdown Mode

Highly advanced spyware exists, but it is expensive and used against a small number of targeted people, such as journalists, activists, lawyers and officials. It is designed to leave no visible signs. If Apple detects such an attack, it sends a threat notification: a message on the Lock Screen and in Settings, an email to your Apple Account address, and a banner when you sign in at account.apple.com.

Apple says it never asks you to click links, install apps or profiles, or give your password or a code in these notifications. If you get an email claiming to be one, sign in at account.apple.com yourself; a real notification shows a banner there. If you are at risk, turn on Lockdown Mode in Settings › Privacy & Security. It limits some features, such as certain message attachments and link previews, in exchange for much stronger protection. Apple says it knows of no successful mercenary spyware attack against a device with Lockdown Mode on.

Signs your Apple Account was accessed

• You get sign-in or verification code alerts you did not request.
• Emails from Apple about a password change, a new device or purchases you did not make.
• Your password suddenly stops working, or security questions and trusted phone numbers have changed.
• Unknown devices in the list under Settings › your name, or unfamiliar purchases in Media & Purchases › View Account › Purchase History.

If you see any of these, change your Apple Account password immediately, check that your trusted phone number is yours, and remove unknown devices. If you are locked out, go to iforgot.apple.com to recover the account. A hacked account is a much more common problem than a hacked phone, and fixing it quickly limits the damage.

Tapped a scam link or entered your details?

• Apple Account password: change it straight away in Settings › your name › Sign-In & Security.
• Card details: call your bank using the number on the back of the card, and ask for a new card.
• Other passwords: change any password you typed on the page, and anywhere else you use it. The Passwords app lists passwords that appeared in data leaks under Security.
• Installed a profile or app because a page told you to: remove it using the steps above.

Pop ups keep coming back?

If fake warnings return after clearing Safari, check your content blockers in Settings › Apps › Safari › Extensions and remove any you do not trust. Close all Safari tabs, including tab groups and Private tabs, since one open scam tab can reload itself. Avoid tapping Allow when a website asks to send notifications.

Are iPhone security apps worth it?

Security apps cannot scan an iPhone the way antivirus scans a PC, whatever their adverts suggest. What some do well is block known scam websites, filter spam texts and calls, or monitor whether your email appears in data breaches. If those features are useful to you, a reputable one is fine. Avoid any app you found through a pop up warning, and be wary of apps that charge a weekly subscription after a short trial.