Halfway through the month, a message arrives from your mobile provider: your data allowance is nearly used up. Yet you have not used your phone any more than usual. Something has been using data while you were busy doing something else.
Often the explanation is harmless: a photo backup, a system update. Sometimes, though, behind usage that does not add up there is an app sending information without you knowing. That is exactly what background data is: the traffic an app generates when you are not using it, meaning when it is not open on your screen.
This post organises the countermeasures into four moments: prevent unnecessary and hidden usage, detect spikes when they appear, respond if an app behaves suspiciously, and recover a stable situation. It is the practical, hands-on side of the recommendation on monitoring your data usage: knowing your normal traffic so that you notice early when something is not normal.
Before you start: why the order matters
Not all apps carry the same weight. Restricting everything makes your phone awkward to use and tempts you to undo it all two days later: it is better to start where the risk and the waste are greatest.
The order of priority that works in almost every case is this one:
- apps you do not recognise or do not remember installing;
- apps that use a lot of data without you using them, especially if almost all their traffic is in the background;
- apps you installed and never opened again, which stay active and keep updating;
- sync services: photo backups, cloud storage, automatic updates;
- video, music and social network apps, which use a lot but in a predictable way;
- everything else, at your own pace.
If you have ten minutes, spend them on the first three: that is where unusual usage can be a security signal, not just a cost.
Get to know your normal usage
What to do. Open your phone’s settings and look for the section on data usage: almost every system shows a list of apps sorted by how much data they use, with a total for the period. Look through it calmly, without changing anything, and note down the three or four apps that use the most.
Why it counts. You can only recognise a spike if you know the baseline: someone who knows what a “normal” month looks like notices straight away when it doubles.
Don’t forget. Align the counting period with your billing cycle, meaning the days on which your provider renews your data allowance. On some phones the count starts from the last time you reset it manually: check when it started counting.
Limit background data for apps that do not need it
What to do. In each app’s settings, or in the mobile data section, look for the option that controls background traffic. Depending on the system it is called “background data”, “background app refresh” or something similar; on some phones you can also take away an app’s access to mobile data altogether, leaving it Wi-Fi only.
Apply the restriction to apps that do not need to alert you to anything in real time: games, shopping, tools you use only now and then.
Watch out. Do not restrict apps from which you expect instant notifications, such as messaging or your banking app: your messages could arrive late.
Turn on data saver
What to do. Data saver is an operating system mode that reduces background traffic for all apps at once and lowers the quality of some content. Make it your default setting if your allowance is limited, and add exceptions only for the apps that really need them.
Updates and backups on Wi-Fi only
What to do. Set the official app store to download app updates on Wi-Fi only, and do the same for photo backups and document syncing. Updates are still important: they should be moved, not switched off.
Why it counts. Updates and backups are among the most common causes of harmless spikes: taking them off the mobile network makes your usage more regular, and an anomaly easier to spot.
Set up warnings and limits
What to do. Many phones let you set a warning, meaning a notification when you go past a certain amount of data, and a limit, beyond which mobile data is switched off. Set the warning at about two thirds of your allowance. If your phone does not offer this feature, many providers send alerts by text message or show them in your online account.
Keep only what you use on your phone
What to do. Install apps only from the official app stores and remove the ones you have not opened in months. Every installed app can update and communicate even when you are not using it. The full reasoning is in the recommendation on removing apps you no longer use.
A comparison of the available options is in the post on tools for checking data usage.
2. Detection: noticing early
Look at per-app statistics once a month
What to do. On the day your allowance renews, open the list of apps by data usage and compare it with the one you noted the first time. There is only one question: is there anything new at the top of the list?
Tell foreground from background
What to do. Many systems separate foreground traffic, generated while you are using the app, from background traffic. An app that uses a lot of data in the background, and that you rarely open, deserves a second look.
Notice the apps you do not recognise
What to do. If a name you do not recognise appears in the list, do not uninstall it on impulse: first try to find out what it is. Some system components have obscure technical names but are perfectly legitimate; a recently downloaded app with high usage, on the other hand, is a good place to start.
Recognise the harmless explanations
What to check. Before assuming the worst, rule out the most common causes: an operating system update, a backup that started after you took a lot of photos, sharing your connection with another device. If you use your hotspot, also check who is connected: the recommendation on your mobile hotspot password explains how to protect it.
Another frequent source of confusion is a VPN, a service that routes all your phone’s traffic through an encrypted connection: in some statistics it shows up as the app using the most data, because it also counts the traffic of other apps.
Which spikes deserve attention, and how to read them, is explained in the post on spikes in data usage.
3. Response: what to do when an app behaves strangely
If you have ruled out the harmless causes and an app keeps using data for no reason, move forward step by step.
Take notes before changing anything
What to do. Take a screenshot of the list of apps by usage and of the suspicious app’s page, with the date. It will be useful if you need to ask for help or dispute a charge.
Take away the app’s access to background data
What to do. This is the first containment step: restrict the app’s background traffic, or remove its access to mobile data completely. Then use the force stop option, which closes the app and its running processes until you open it again.
Review the permissions
What to do. Check what the app is allowed to do: access to contacts, location, photos, microphone, text messages. Revoke anything that does not fit its purpose. The method is in the recommendation on checking what your apps can do.
Disable or remove the suspicious app
What to do. If you do not need the app, uninstall it. If it is a pre-installed app that cannot be removed, look for the “disable” option. If you cannot uninstall it because it has been given administrator permissions, meaning special powers over the device, remove those first from the security settings. The full procedure is in the recommendation on finding and removing unknown apps.
Run a full scan
What to do. Use the protection tool built into your system or a reputable security app downloaded from the official app store, and start a full scan of the device, not the quick one. An antivirus scan compares apps and files with the known characteristics of malware, meaning software designed to cause harm or to spy. Follow the tool’s instructions to remove whatever it finds.
If the spike does not stop
What to do. If the unusual usage continues after these steps, or comes with other signs, the problem may run deeper. In that case, follow the guide on what to do if your phone has malware, which takes you step by step through what comes next.
4. Recovery: getting back to a stable situation
Check costs and charges
What to check. Look in your provider’s online account for extra usage, premium services you did not sign up for, or subscriptions you do not recognise. Report anything that does not add up straight away: the time allowed for disputes is limited.
Change your most important passwords, if needed
What to do. If the suspicious app had access to the contents of your phone, or if you entered credentials while it was installed, change the passwords for your main email account and your bank from a different, trusted device.
Fine-tune the restrictions
What to do. Over the following days, check that your legitimate apps still work properly. If messages arrive late or your backup no longer starts, add a targeted exception rather than removing all the restrictions.
Build a monthly routine
What to do. Close the loop with a habit: a monthly check of per-app statistics, the usage warning always on, updates and backups on Wi-Fi.
A plan in three ten-minute sessions
If the idea of going through every setting stops you before you start, here is a version you can do in three sittings.
Session 1 — Look (10 minutes)
- Open your data statistics and align the period with your billing cycle.
- Note down the apps that use the most data and how much of it is in the background.
- Mark the apps you do not recognise or have not opened in months.
This single session gives you your baseline.
Session 2 — Restrict (10 minutes)
- Limit background data for apps that do not need to alert you in real time.
- Turn on data saver, if your allowance is limited.
- Move app updates, backups and syncing to Wi-Fi only.
- Set a warning at about two thirds of your allowance.
Session 3 — Clean up and check (10 minutes, repeatable every month)
- Remove the apps you no longer use.
- Review the permissions of the apps still at the top of the list.
- Compare your usage with the previous month and with your provider’s figures.
In three sessions you have more predictable usage and a method for noticing when it changes.
Common mistakes when limiting background data
Even people who decide to act often trip up in the same places.
- Restricting everything, messaging included. Notifications arrive late, the phone seems broken and you end up removing every restriction.
- Switching off updates to save data. Updates fix vulnerabilities: they should be moved to Wi-Fi, not removed.
- Looking only at the monthly total. The total tells you how much you used, not what used it.
- Mistaking a harmless spike for an infection. A backup or a system update can use several gigabytes in one night, with nothing harmful going on.
- Stopping at the restriction. If a suspicious app is using data secretly, cutting off its background data contains it but does not remove it: it needs to be uninstalled and a scan needs to be run.
Action checklist
Stage 1 — Prevention
- ☐ Counting period aligned with your billing cycle
- ☐ Background data restricted for apps that do not need it
- ☐ Updates, backups and syncing set to Wi-Fi only
- ☐ Usage warning turned on
Stage 2 — Detection
- ☐ Per-app statistics checked and compared with the previous month
- ☐ Background traffic of the apps at the top of the list reviewed
- ☐ Harmless causes ruled out (updates, backups, hotspot, VPN)
Stage 3 — Response
- ☐ Screenshots of usage saved with the date
- ☐ Suspicious app restricted, force-stopped and stripped of unnecessary permissions
- ☐ Suspicious app uninstalled or disabled
- ☐ Full scan completed
Stage 4 — Recovery
- ☐ Costs and premium services checked with your provider
- ☐ Main passwords changed, if the app could read sensitive data
- ☐ Monthly reminder set for checking the statistics
Mini-scenario
Mark receives the warning he set up the week before: he has already used two thirds of his allowance, halfway through the month.
He opens the per-app statistics. At the top is a document-scanning app he installed three weeks earlier and opened only once, with almost all of its traffic in the background.
Mark does not panic and does not delete anything on impulse. He takes a screenshot, removes the app’s access to mobile data and force-stops it. He checks the permissions: contacts and text messages, which are not needed to scan a sheet of paper. Then he uninstalls it, starts a full scan and checks in his provider’s online account that no premium services have been activated. Finally, he sets a reminder for next month’s check.
Twenty minutes, in the right order.
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Skills | Knowing how to read per-app statistics and use the settings that limit background traffic |
| Awareness | Understanding that unusual usage can be a cost, but also a security signal |
| Secure Behaviour | Turning the data check into a monthly routine, not a reaction to the bill |
Reference level: FL2 — Beginner. This is the level at which you know the main warning signs and regularly apply a few well-chosen settings, following clear guidance and without needing technical skills.
Conclusion
Limiting background data is not only about making your allowance last longer. It makes your phone’s usage predictable, and predictable usage is where an anomaly shows up straight away. No setting on its own guarantees a clean device, but a few minutes a month let you notice changes early.
What to do right now. Open your phone’s data statistics today, note down the three apps that use the most, and set a warning at about two thirds of your allowance. If this is all you do, you already have the basis for recognising a spike.
To see where you stand, the digital resilience self-assessment gives you a reference point.
Related content
- Monitoring your data usage — the recommendation this belongs to
- Tools for checking data usage — the technologies that make these settings possible
- Spikes in data usage — what to watch in order to notice in time
- Consequences of unusual data usage — what you avoid by acting early
- Data exfiltration from phones — what you are protecting yourself against
Related resources
Short pieces from the Resources section, for readers who want to focus on a single aspect:
- Unexpected Phone Charges: When the Bill Is the Signal
- Phone Running Slow: Malware, or Just an Older Device?
- Adware on Your Phone: Reading the Unwanted Ads
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
