Last updated: March 15, 2026

Text messages remain one of the most common communication methods, yet they are surprisingly vulnerable to interception. Unlike messaging apps with end-to-end encryption, traditional SMS travels in plaintext through cellular networks, making it accessible to anyone with the right access or tools. For developers and power users, understanding how to detect unauthorized access to your messages is essential for maintaining privacy.

This guide covers practical methods to check if someone is reading your text messages, with technical details and code examples where applicable.

Prerequisites

Before you begin, make sure you have the following ready:

Step 1 - Understand SMS Security Architecture

Before detecting interception, you need to understand how SMS works. When you send a text message, it passes through several points:

  1. Your device → 2. Cell tower → 3. SMSC (Short Message Service Center) → 4. Recipient’s cell tower → 5. Recipient’s device

At each point, the message exists in plaintext. Cellular carriers and anyone with access to network equipment at any of these points can potentially read your messages. This includes:

Step 2 - Signs Someone May Be Reading Your Messages

Watch for these indicators that suggest unauthorized access:

Battery and Data Patterns

Device Behavior

Settings Changes

Step 3 - Technical Methods to Check for Interception

Method 1 - Inspect Message Forwarding Rules

On Android, you can check if message forwarding is enabled:

Using ADB to check forwarding settings (requires USB debugging enabled)
adb shell content query --uri content://sms/forwarding --projection _id,address,service_center

For manual verification on your device:

  1. Open your Messages app
  2. Go to Settings → Advanced → Message forwarding
  3. Check for any unknown device or number listed

On iOS:

  1. Go to Settings → Messages
  2. Check “Send as SMS” and “iMessage” settings
  3. Look for any unknown forwarding destinations

Method 2 - Monitor Network Traffic

For developers, you can capture and analyze network traffic to detect anomalies:

Basic concept for detecting SMS interception
This requires rooted device or network-level analysis
import subprocess

def check_sms_metadata():
    """Check SMS message metadata for anomalies"""
    # Query SMS database on Android (requires root)
    result = subprocess.run(
        ['adb', 'shell', 'content', 'query',
         '--uri', 'content://sms/',
         '--projection', '_id,date,address,type,status'],
        capture_output=True, text=True
    )

    # Look for unusual patterns:
    # - Messages sent when you weren't using your phone
    # - Unusual message types or status codes
    # - Unexpected service center numbers

    return result.stdout

Analyze for timestamps outside your usage patterns
def analyze_message_timestamps():
    messages = check_sms_metadata()
    # Your analysis logic here

Method 3 - Check for Spyware with Code Analysis

If you suspect spyware, examine installed packages:

List all apps with SMS permission on Android
adb shell pm list permissions -d | grep -i sms

Check for suspicious packages
adb shell pm list packages | grep -E "(spy|monitor|tracker|ghost|stealth)"

Examine running services
adb shell dumpsys activity services | grep -i sms

Method 4 - Use USSD Codes for Carrier Information

Various USSD codes can reveal forwarding settings:

Check call forwarding status (may vary by carrier)
USSD - *#21# - Check all call forwarding
USSD - *#62# - Check when phone is unreachable
USSD - ##002# - Cancel all conditional forwarding

These codes work on most GSM networks but may differ by carrier.

Step 4 - Prevention and Hardening

For Android Users

  1. Review App Permissions Regularly 
    # Revoke SMS permission from unnecessary apps
adb shell appops set <package_name> SMS deny
  2. Use Alternative Messaging Apps
    • Signal (end-to-end encrypted)
    • WhatsApp (end-to-end encrypted)
    • iMessage (iOS only, encrypted)
    • Session (decentralized, encrypted)
  3. Enable Google Play Protect 
    adb shell pm enable com.android.vending
  4. Consider a Custom ROM Privacy-focused ROMs like GrapheneOS or CalyxOS offer better security defaults and more granular permission controls.

For iOS Users

  1. Enable Lockdown Mode for sensitive situations
  2. Regularly review connected devices in Settings → Bluetooth and Settings → Wi-Fi
  3. Use iMessage instead of SMS when possible
  4. Disable SMS fallback in Settings → Messages if you primarily use iMessage

Network-Level Protections

For developers building secure communication systems:

Implementing proper SMS handling in Android
class SecureSmsReceiver : BroadcastReceiver() {
    override fun onReceive(context: Context, intent: Intent) {
        // Verify the sender is authorized
        val senderAddress = intent.getStringExtra("address")

        // Check for legitimate service center
        val serviceCenter = intent.getStringExtra("service_center")

        // Log for security audit (never log message content)
        SecurityLogger.logEvent(
            type = "SMS_RECEIVED",
            sender = senderAddress,
            timestamp = System.currentTimeMillis()
        )
    }
}

Step 5 - What to Do If You Detect Compromise

If you determine someone is reading your messages:

  1. Change passwords for any accounts mentioned in recent messages
  2. Enable two-factor authentication on critical accounts (use authenticator apps, not SMS)
  3. Factory reset your device if you suspect sophisticated spyware
  4. Contact your carrier to check for unauthorized forwarding
  5. Document evidence before resetting if you plan to pursue legal action

Advanced SMS Interception Techniques

Understanding how SMS can be intercepted helps you protect against it:

SIM Swapping

A sophisticated attack where the attacker convinces your carrier to switch your phone number to a new SIM card they control:

Signs of SIM swapping:
1. Service suddenly drops (SIM no longer recognized)
2. Can't make calls or receive texts
3. Account recovery codes arrive on new device
4. Accounts accessed without your authorization

Prevention:
1. Add a PIN or passcode to your account with carrier
2. Contact carrier to restrict SIM changes
3. Use authenticator apps instead of SMS 2FA
4. Monitor for suspicious account activity

SS7 Interception

SS7 (Signaling System 7) is the protocol cellular networks use. Attackers with network access can intercept SMS:

class SS7Vulnerability:
    def __init__(self):
        self.vulnerability_details = {
            'protocol': 'SS7 (Signaling System 7)',
            'scope': 'All SMS messages',
            'attack_vector': 'Network-level access required',
            'mitigation': 'Use encrypted messaging apps'
        }

    def assess_ss7_risk(self):
        """SS7 attacks are sophisticated nation-state level"""
        risk_level = {
            'threat_actor': 'Government/Law Enforcement/Advanced Criminals',
            'likelihood_consumer': 'Very Low',
            'likelihood_activist_journalist': 'Medium-High',
            'detection': 'Nearly impossible for typical user',
            'protection': 'Only via encryption (Signal, etc.)'
        }
        return risk_level

    def protection_requirements(self):
        """Only real protection against SS7"""
        return {
            'requirement': 'End-to-end encryption',
            'tools': [
                'Signal (most recommended)',
                'WhatsApp',
                'ProtonMail (for email)',
                'Riot.im / Element (matrix protocol)'
            ],
            'why': 'SMS cannot be protected; encryption necessary'
        }

Step 6 - Device Security Assessment

Perform a full security audit of your device:

#!/bin/bash
complete device security assessment

security_audit() {
  echo "=== DEVICE SECURITY ASSESSMENT ==="

  # 1. Check for unauthorized apps
  echo -e "\n[*] Checking for unauthorized applications..."

  if [[ "$OSTYPE" == "darwin"* ]]; then
    # macOS
    ls /Applications | grep -i "spy\|monitor\|track\|keylog"
  else
    # Linux
    dpkg -l | grep -i "spy\|monitor\|track\|keylog"
  fi

  # 2. Check running processes
  echo -e "\n[*] Checking running processes..."
  ps aux | grep -i "sms\|message\|forward" | grep -v grep

  # 3. Check open network connections
  echo -e "\n[*] Checking active network connections..."
  netstat -an | grep ESTABLISHED | head -20

  # 4. Check browser history/cache
  echo -e "\n[*] Checking browser data..."
  if [[ "$OSTYPE" == "darwin"* ]]; then
    # Check Safari
    sqlite3 ~/Library/Safari/History.db "SELECT url, title FROM history ORDER BY visit_time DESC LIMIT 10"
  fi

  # 5. Check for mdm profiles (device management)
  echo -e "\n[*] Checking for device management profiles..."
  if [[ "$OSTYPE" == "darwin"* ]]; then
    profiles show
  fi

  # 6. Check system logs for suspicious activity
  echo -e "\n[*] Recent system logs..."
  log show --level notice | tail -50
}

security_audit

Step 7 - SMS Encryption Alternatives

Since SMS itself cannot be encrypted, use these alternatives:

sms_alternatives_comparison = {
    'Signal': {
        'encryption': 'End-to-end (AES-256)',
        'metadata_protection': 'Excellent',
        'open_source': True,
        'platform': ['iOS', 'Android', 'Desktop'],
        'recommendation': 'BEST - Most secure option'
    },
    'WhatsApp': {
        'encryption': 'End-to-end (Signal Protocol)',
        'metadata_protection': 'Limited',
        'open_source': False,
        'platform': ['iOS', 'Android', 'Desktop'],
        'note': 'Owned by Meta; metadata could be shared'
    },
    'Telegram': {
        'encryption': 'Optional (Secret Chats)',
        'metadata_protection': 'Poor (default)',
        'open_source': False,
        'note': 'Only Secret Chats are encrypted'
    },
    'iMessage': {
        'encryption': 'End-to-end (proprietary)',
        'metadata_protection': 'Moderate',
        'open_source': False,
        'platform': ['iOS', 'macOS'],
        'note': 'Good for Apple users, requires Apple environment'
    },
    'ProtonMail': {
        'encryption': 'End-to-end',
        'use_case': 'Email, not SMS',
        'note': 'Separate from SMS, uses email protocol'
    }
}

Step 8 - Detecting Specific Spyware

Different spyware leaves different fingerprints:

class SpywareDetection:
    def __init__(self):
        self.indicators = {}

    def check_pegasus_signs(self):
        """Pegasus spyware indicators"""
        return {
            'battery_drain': 'Excessive even when idle',
            'heat_generation': 'Device warm even when not in use',
            'network_activity': 'Background data usage spikes',
            'call_quality': 'Echo or distortion on calls',
            'sms_delays': 'Incoming/outgoing message delays'
        }

    def check_commercial_spyware(self):
        """Commercial spy app indicators (FlexiSPY, mSpy, etc.)"""
        return {
            'permission_requests': 'Excessive permissions in recent updates',
            'battery_usage': 'Specific apps consuming unusual battery',
            'background_activity': 'Apps running when not opened',
            'memory_usage': 'High memory usage for basic functions',
            'phone_locking': 'Phone locks/unlocks without user action'
        }

    def check_carrier_monitoring(self):
        """Legal carrier monitoring (lawful intercept)"""
        return {
            'detection': 'Very difficult to identify',
            'indicators': [
                'Your number appears in unusual places',
                'SMS forwarding enabled through carrier',
                'Calls have delays or quality issues'
            ],
            'protection': 'Requires encrypted apps (Signal, etc.)'
        }

Step 9 - Legal and Regulatory Framework

Understanding the legal aspects of SMS interception:

Legal Framework for SMS Interception:

United States:
  Wiretap Act:
    - Unauthorized interception is federal crime
    - Penalties: Up to 5 years prison
    - Civil damages available

  Federal Stored Communications Act:
    - Unauthorized access to stored messages
    - Penalties: 2-10 years prison
    - Civil damages: Up to $1000 per day

  State Laws:
    - Many states have separate laws
    - Some require two-party consent for recording

Europe (GDPR):
  - SMS interception violates privacy rights
  - Potential €20 million or 4% revenue fine
  - Right to lodge complaints with data protection authority

  GDPR Requirements:
    - Right to be informed
    - Right of access
    - Right to rectification
    - Right to erasure

Reporting Options:
  - FBI Internet Crime Complaint Center (IC3)
  - FCC Cybersecurity and Communications Security Bureau
  - State Attorney General
  - Data Protection Authority (EU)

Step 10 - Create a Recovery Plan

If your SMS has been compromised:

Recovery Plan (72 hours):

Hour 0-1 (Immediate):
  - [ ] Document evidence (screenshots, timestamps)
  - [ ] Call carrier to report issue
  - [ ] Change all critical passwords (non-SMS)
  - [ ] Contact financial institutions

Hour 1-24 (First Day):
  - [ ] Enable 2FA on all accounts (use authenticator app)
  - [ ] Review account access logs
  - [ ] Check for fraudulent transactions
  - [ ] File police report if applicable

Day 1-3 (First 3 Days):
  - [ ] Factory reset affected device
  - [ ] Restore from clean backup (if available)
  - [ ] Update all software
  - [ ] Install updated antivirus/antimalware
  - [ ] Consider switching phone carrier

Ongoing (Weeks 1+):
  - [ ] Monitor credit/financial accounts
  - [ ] Use credit monitoring service
  - [ ] Update to more secure communication apps
  - [ ] Maintain regular security audits
  - [ ] Consider consulting security professional

Step 11 - Professional Help Resources

When to seek professional help:

professional_resources = {
    'Local Resources': [
        'FBI field office',
        'State police cyber crime unit',
        'Local attorney (for civil action)',
        'Private security consultant'
    ],

    'Organizations': {
        'EFF (Electronic Frontier Foundation)': 'https://eff.org',
        'Access Now': 'Digital security support',
        'Freedom of the Press': 'Journalist protection'
    },

    'When to Call Police': [
        'Active fraud/identity theft',
        'Threatening messages',
        'Extortion attempts',
        'Evidence of stalking'
    ],

    'When to Hire Attorney': [
        'Civil harassment suit',
        'Intellectual property theft',
        'Business espionage',
        'Creating liability documentation'
    ],

    'When to Hire Security Consultant': [
        'Sophisticated attack suspected',
        'Evidence of government surveillance',
        'Business/organizational security',
        'Need professional forensics'
    ]
}

Protecting your text messages requires understanding both technical vulnerabilities and legal remedies. Migrate to encrypted messaging apps like Signal for sensitive communications, and remain vigilant for signs of interception or compromise.

Troubleshooting

Configuration changes not taking effect

Restart the relevant service or application after making changes. Some settings require a full system reboot. Verify the configuration file path is correct and the syntax is valid.

Permission denied errors

Run the command with sudo for system-level operations, or check that your user account has the necessary permissions. On macOS, you may need to grant terminal access in System Settings > Privacy & Security.

Connection or network-related failures

Check your internet connection and firewall settings. If using a VPN, try disconnecting temporarily to isolate the issue. Verify that the target server or service is accessible from your network.

Frequently Asked Questions

How long does it take to check if someone is reading your text messages?

For a straightforward setup, expect 30 minutes to 2 hours depending on your familiarity with the tools involved. Complex configurations with custom requirements may take longer. Having your credentials and environment ready before starting saves significant time.

What are the most common mistakes to avoid?

The most frequent issues are skipping prerequisite steps, using outdated package versions, and not reading error messages carefully. Follow the steps in order, verify each one works before moving on, and check the official documentation if something behaves unexpectedly.

Do I need prior experience to follow this guide?

Basic familiarity with the relevant tools and command line is helpful but not strictly required. Each step is explained with context. If you get stuck, the official documentation for each tool covers fundamentals that may fill in knowledge gaps.

Is this approach secure enough for production?

The patterns shown here follow standard practices, but production deployments need additional hardening. Add rate limiting, input validation, proper secret management, and monitoring before going live. Consider a security review if your application handles sensitive user data.

Where can I get help if I run into issues?

Start with the official documentation for each tool mentioned. Stack Overflow and GitHub Issues are good next steps for specific error messages. Community forums and Discord servers for the relevant tools often have active members who can help with setup problems.

Related Articles