A phone battery draining fast almost always has an ordinary explanation: the phone is a few years old, you used the sat nav all afternoon, an update has just arrived. Sometimes, though, it is the first way your phone lets you know that something is working inside it without you having asked.
This post brings those signs together: the ones you can find in your phone’s statistics, and the ones you notice simply by using it. For each one you will find what it means, where you can see it and what to do. In technical circles they are called indicators of compromise, or IOCs (Indicators of Compromise): observable traces suggesting that something is not working the way it should. Here the trace concerns malware, meaning software designed to act on a device against the interests of the person using it: collecting data, showing adverts, using the phone’s resources on someone else’s behalf.
It is the diagnostic deep dive on the recommendation on spotting malware on your phone: there you will find the principle, here the list of signs and how to read them.
What indicators mean in this case
To do what it was written to do, malware needs to work. And working, on a phone, has a cost: battery, heat, memory, data. That is why it often leaves traces even when you cannot see it.
An indicator, here, is one of those costs that has no explanation: an app that uses far more than you use it, a phone that is warm while it sits still on the table, a slowdown that appeared from one day to the next.
It is not proof. It is a signal that deserves a check: the same short battery life may come down to the phone’s age or a recent update. The value of an indicator lies in putting you in a position to check, rather than resigning yourself to a phone that “just works like that now”.
Why they matter more when the change is sudden
A phone that is getting older gets worse slowly. The battery loses capacity month after month, apps get a little heavier with every version, and the decline is so gradual it almost goes unnoticed.
Malware, on the other hand, arrives at a specific moment: usually together with an app you installed, a file you opened, a permission you granted. That is why the signs need to be read against how your phone behaved before, not against an ideal phone.
The useful question is not “does my battery run down quickly?” but “since when has it run down quickly, and what changed during that time?”. If the answer lines up with a new app, the signal deserves to be taken seriously. If it lines up with three years of everyday use, probably not.
Technical indicators: in your phone’s statistics
These are the ones the phone’s operating system records and shows in its settings, usually in the “battery”, “data usage” and “apps” sections. You do not need any particular skills: you just need to know where to look.
| Indicator | What it means | Why it matters | Where you see it | What to do |
|---|---|---|---|---|
| An app using a disproportionate share of the battery | An app you rarely use appears at the top of the battery usage list | An app that uses power without being used is working on its own account | Settings, “battery” section, usage by app | Check when you installed it and what it does; if you do not recognise it or do not need it, remove it |
| High background activity | The app shows as active for long periods in the background, meaning while you are not using it | A lot of malware does its work precisely when the screen is off | Details for the individual app in the battery section | Restrict background activity in the app’s settings and see whether usage changes |
| Data used overnight | An app used data at times when the phone was not being used | It may point to data being sent out or downloaded without your knowledge | Settings, “data usage” section, usage by app | Compare it with the apps that genuinely run backups or overnight syncing; turn off data for the suspicious app |
| Apps you do not remember installing | An app you do not recognise appears in the full list, sometimes without an icon | A hidden app can keep running without showing itself | Settings, full list of installed apps | Look up the name, check the developer and, if you do not need it, uninstall it |
| Special powers granted to an app | An app is active in the accessibility services or among the device administrators | Accessibility lets an app read the screen and act on your behalf; administrator status makes an app hard to remove | Settings, “accessibility” and “device administrators” sections | Withdraw these powers from any app that is not a tool you chose, then consider uninstalling it |
| A warning from the system’s protection | The phone or the app store flags an app as potentially harmful | Built-in protection checks apps after installation too | Security notification, security section of the settings | Follow the warning and remove the app; do not treat it as a false alarm |
Data usage deserves separate attention, because it is sometimes the clearest signal of all: you will find it covered in full in the post on spikes in data usage.
Signs you can observe yourself
These do not require you to open any settings: you notice them through everyday use, often before you even know what they mean.
| Signal | What it means | Why it matters | How you notice | What to do |
|---|---|---|---|---|
| Battery suddenly draining fast | The phone reaches the evening with much less charge than usual, even though your habits have not changed | A hidden process is using power continuously | You have to charge it more often for the same use | Open the battery statistics and look for an app that seems out of place |
| A warm phone at rest | The phone heats up while it is still, with the screen off and not charging | Heat is the sign of a processor at work; at rest it should not be | You pick it up from the bedside table or your pocket and it feels warm | Check the apps active in the background and the ones installed recently |
| Sudden slowness after an installation | The phone slows down, freezes or restarts apps from one day to the next | The timing matches a new app: the link needs checking | A keyboard that lags, apps that close on their own | Remove the most recently installed app and see whether things go back to normal |
| Adverts outside apps | Adverts appear on the home screen, over other apps or when you unlock the phone | This is the typical sign of adware, software that makes its money from adverts forced onto you | Adverts that appear even when no app is open | Identify the recently installed apps and remove the one generating them |
| Charges or subscriptions you do not recognise | Paid services you did not sign up for appear on your bill or in the app store | Some malicious apps sign you up to subscriptions on your behalf | Credit running down, app store receipts, bank statement | Cancel the subscriptions, contact your mobile provider and remove the suspicious app |
| Messages sent in your name | Someone receives messages from you that you did not write | An app with too many permissions can send messages or links to your contacts | Friends, colleagues or relatives point it out to you | Warn your contacts through a different channel and check your apps’ permissions |
A concrete example
Sarah needs to scan a document for some paperwork and installs the first free app she finds. It works, and she forgets about it.
Over the next few days she notices that her phone reaches mid-afternoon with the battery almost empty. The first explanation that comes to mind is the most reasonable one: the phone is three years old, so perhaps the battery is simply worn out. Then one evening she picks it up from the bedside table and it is warm, even though it has been sitting still and unplugged for hours.
That detail is what makes her stop. She opens the battery statistics: at the top of the list, ahead of the sat nav and the messaging apps she uses all day, is the scanning app she opened just once. In the data section, the same app has used data overnight.
Sarah uninstalls it, runs a check with her phone’s built-in protection and changes her email password, because the scanned document contained her personal details. Over the following days, the battery goes back to lasting as long as it used to.
One signal on its own — the battery — had a plausible explanation. Two signals together, plus a new app in the same period, told a different story.
What to check right away
In the battery statistics
- the apps at the top of the usage list, compared with the ones you actually use;
- how long the apps you rarely use have been active in the background;
- usage over the last few days compared with a few weeks ago, if your phone shows it.
In the list of apps
- recently installed apps, especially those from the period when the problem began;
- apps you do not remember installing, including those without an icon: the method for finding and removing unknown apps is explained in its own recommendation;
- apps active in the accessibility services and among the device administrators.
On data and costs
- data usage by app, especially overnight;
- active subscriptions in the app store and paid services on your line;
- transactions on the card linked to your phone.
If you find a suspicious indicator
- Stay calm. A signal is a reason to check, not proof that the phone is compromised.
- Start with the most recent app. If the problem began after an installation, that app is the first candidate.
- Withdraw special powers, such as accessibility and device administrator status, before uninstalling the app.
- Run a check with the system’s built-in protection or with a security app downloaded from an official source.
- Change your important passwords from another device, if you have entered credentials or sensitive details in the meantime.
The full sequence, in the right order, is in the post on what to do if your phone has malware. If you want to understand why an app ends up using so much, you will find the mechanisms in the post on malware hidden in apps.
What is not an indicator
Telling them apart helps you avoid two opposite mistakes: worrying about the normal wear of your phone, and getting used to ignoring the real signals.
| Situation | Why it is usually not a signal |
|---|---|
| An ageing battery | After a few years the battery holds less charge: the decline is gradual and affects all apps in the same way. Many phones show the battery’s “health” in the settings |
| An update that has just been installed | For a few days the system reorganises files and apps in the background: usage and heat can rise, then return to normal |
| Heavy apps you genuinely use | Sat nav, video calls, games, streaming and the camera use a lot by nature: the top of the list is exactly where they belong |
| A phone that gets warm while charging | Charging, especially fast charging, warms the phone up; what counts is heat at rest and unplugged |
| A weak network signal | In areas with poor coverage, the phone uses more power to stay connected |
| Lots of adverts inside a free app | It is a common business model; it becomes a signal when the adverts leave the app |
Keeping the system up to date is still a good habit: the recommendation on keeping your software up to date explains why a few days of inconvenience are worth it.
The rule of thumb: one isolated signal deserves a check; two signals together deserve action.
How often to check
You do not need a demanding routine. You need to know how your phone behaves when everything is fine, so you notice when it changes.
| How often | What to check |
|---|---|
| When you notice a change | Battery statistics and the apps installed in the same period: this is when a check pays off most |
| In the days after installing a new app | Battery life, heat at rest, adverts outside apps |
| Once a month | A quick look at the battery and data usage lists, so you know which apps are usually there |
| Every 2–3 months | Full list of apps, accessibility and device administrators, subscriptions in the app store |
| After a warning from the system’s protection | The flagged app and any apps installed at the same time |
Two important caveats
An indicator is not proof. A battery that does not last is, in most cases, a battery that is ageing or a phone that is working hard for legitimate reasons. Check before you worry, and before removing an app you use, check what it does and why it uses so much.
No indicators is not a guarantee. Some malware is written to use very little and go unnoticed, especially the kind that only reads data. Built-in protection against harmful apps filters out a great deal too, but not everything. That is why the main defence remains prevention: installing apps from official sources, granting only the permissions that are needed, keeping the system up to date. Indicators help you notice in time; they do not replace those habits.
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Skills | Knowing how to read your phone’s battery and data statistics and recognise usage that does not add up |
| Awareness | Understanding that malware leaves traces in the resources it uses, even when it cannot be seen |
| Secure Behaviour | Linking a change in your phone to what was installed in the same period, and checking calmly |
Reference level: FL2 — Beginner. This is the level at which you learn to observe methodically: knowing where to look and telling a signal apart from normal wear, before you can solve every problem on your own.
Conclusion
A phone battery draining fast is not a reason to view your phone with suspicion. It is information: sometimes it tells you the phone is getting older, sometimes that an app is doing something it should not. The way to tell the two apart is knowing where to look.
What to do right now. Open your settings, go to the battery section and see which apps use the most. If they all match what you use, you have just created your reference point for next time. If there is one you do not recognise, you have somewhere to start. To see where you stand on the other aspects of your digital security too, you can take the digital resilience self-assessment.
Related resources
Short guides from the Resources section, for anyone who wants to focus on a single aspect:
- Phone Running Slow: Malware, or Just an Older Device?
- Unexpected Phone Charges: When the Bill Is the Signal
- Adware on Your Phone: Reading the Unwanted Ads
Related content
- Spotting malware on your phone — the recommendation this belongs to
- Malware hidden in apps — the attacks that generate these signals
- What to do if your phone has malware — what to do, in the right order
- Impact of malware on your phone — what gets hit when a signal is confirmed
- Spikes in data usage — the signal that often goes hand in hand with the battery
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
