Additional resource for the lesson “When Your Phone Slows Down: Malware or Age?” — Online Security course
A phone running slow is usually just a phone getting older. Occasionally it is something using the processor, the battery and the data connection while you are not looking. This resource is about telling the two apart, calmly.
A. Why this matters
Phones slow down. Storage fills, batteries age, operating systems grow heavier than the hardware they are running on. Most of the time that is the entire explanation.
But software installed without your understanding does have a cost, and that cost shows up in the same places: processor use, battery, data. Which is why the symptom is worth knowing how to read rather than worth worrying about.
The key idea: the symptom alone means very little. What matters is whether it appeared suddenly, and whether it arrived alongside something else.
B. Key concepts
Six ideas about reading the signals.
Mobile malware
Software installed on a phone that does something other than what it appears to. It may use the processor, collect information, or send data elsewhere.
Why it matters to you: Understanding that it needs resources to operate is what makes the symptoms legible rather than mysterious.
Gradual versus sudden
Age produces slow decline over months. Software producing a load usually produces a change you can date.
Why it matters to you: This single distinction does most of the diagnostic work. ‘It has been getting slower for a year’ and ‘it became slow last Tuesday’ are different situations.
The cluster of symptoms
Slowness on its own means little. Slowness plus rapid battery drain plus unexplained data use plus the device running warm is a pattern.
Why it matters to you: One symptom is noise. Three that arrived together are worth investigating.
Battery and data statistics
Both Android and iOS show which apps consumed battery and data, and how much.
Why it matters to you: This is the most useful screen on the phone for this question. An app you do not recognise near the top of either list is the concrete signal.
Where it came from
Software installed outside the official stores, or bundled with something else.
Why it matters to you: Almost every case traces back to an install. Recalling what changed around the date the symptoms started usually identifies it.
Scanning and removing
Both platforms have built-in protection, and reputable security apps exist for Android.
Why it matters to you: Useful, but secondary. Reviewing what is installed and removing what you do not recognise resolves most situations directly.
C. A practical example: slow since Tuesday
A phone that was fine becomes noticeably slow. Not gradually — the owner can name the week.
- The battery now lasts until mid-afternoon instead of the evening.
- The phone is warm when it has not been used.
- Mobile data ran out well before the end of the month for the first time.
That combination is the pattern. Looking at the battery statistics shows an app near the top that the owner does not recognise — installed the previous week, alongside a file converter downloaded from a search result.
What resolves it
- Uninstall the app that does not belong.
- Run the built-in protection, or a reputable scanner on Android.
- Change the password on the accounts used from the phone during that period, starting with email.
- Check what else was installed at the same time.
The last step matters most and is the one people skip. If something was collecting information for a week, the credentials used in that week are the thing to change.
D. Try it yourself: read your own statistics
Ten minutes, and worth doing once even if nothing seems wrong — it tells you what normal looks like.
Step 1 — Battery statistics
- Settings, Battery, then the per-app breakdown.
- Do you recognise everything in the top five? Do the positions make sense given how you use the phone?
Step 2 — Data statistics
- Settings, Network or Mobile data, then usage by app.
- An app you rarely open sitting high in this list is the signal worth following.
Step 3 — The installed apps list
- Scroll through everything installed. Not the home screen — the full list.
- Most people find several they do not remember installing.
Step 4 — Remove what you do not use
- Anything unrecognised, and anything you have not opened in a year.
- This reduces both the clutter and the exposure, and often the slowness too.
Doing this while everything is fine is what makes it useful later: you will know what your own baseline looks like.
E. Videos, articles and further resources
Independent and institutional sources in English.
FTC — Malware: how to protect against, detect and remove it
How to recognise, remove and avoid unwanted software, with the sequence to follow.
https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it
NCSC (UK) — What to do if your device is infected
A calm set of steps for a device that is behaving oddly, including what to do about accounts afterwards.
https://www.ncsc.gov.uk/section/respond-recover/citizen-infected-devices
FTC — How to protect your phone from hackers
Practical steps for the device that holds most of your digital life.
https://consumer.ftc.gov/articles/how-protect-your-phone-hackers
Google — Use Play Protect to keep your apps safe and your data private
How Android’s built-in scanning works and how to review installed apps. Platform documentation.
https://support.google.com/android/answer/2812853?hl=en
NCSC (UK) — Cyber security advice for you and your family
The UK national authority’s advice hub for individuals: short, practical guidance written for people who are not IT professionals.
https://www.ncsc.gov.uk/section/advice-guidance/you-your-family
CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world
Links checked in August 2026.
F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior
This lesson sits on the Awareness pillar at level FL2: the skill is interpretation, not repair.
Skills
- Reading battery and data statistics per app.
- Reviewing the full list of installed applications.
- Knowing the order of steps after finding something: remove, scan, then change credentials.
For professionals and organizations
- Giving people a clear route to report a suspect device rather than handling it alone.
Awareness
- Understanding that slowness alone is weak evidence, and a cluster of symptoms is strong.
- Recognising that a datable change is more informative than a gradual one.
- Knowing that credentials used during the period matter more than the device itself.
For future instructors and ambassadors
- Keeping this proportionate. Most slow phones are old phones, and saying so builds more trust than implying otherwise.
Secure Behavior
- Installing only from official stores.
- Reviewing installed apps periodically and removing what is unused.
- Changing credentials after removing anything suspicious, rather than assuming removal is the end.
For organizations
- Keeping managed devices restricted to approved application sources.
G. Questions to sit with
- Has your phone slowed gradually over a year, or did something change on a date you could name?
- Do you recognise every app in your battery statistics?
- How many installed apps have you not opened in the past year?
- If something had been running quietly for a week, which accounts would you want to change?
H. What to do now
The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply here.
Prevention
- R6 — Keep the system and apps up to date, with automatic updates on.
- R17 — Do not open attachments from unknown sources.
- MS5 — Use a browser that updates itself and limits tracking.
After finding something
- R1 — Change the affected credentials, and do not reuse them elsewhere.
- R2 — Use a password manager to make replacing several credentials realistic.
- R4 — Turn on multi-factor authentication, so a captured password is not sufficient.
- R8 — Check login alerts and recent access on the accounts used from that device.
Minimum commitment: Removing the app is the first step, not the last. What it may have seen is the actual question.
In short
- Most slow phones are simply old phones.
- A datable change, plus battery drain, plus data use, is a pattern worth investigating.
- The battery and data statistics answer the question faster than any scanner.
- After removing something, change the credentials used while it was there.
Related resources in this course
The other two symptoms, and where it comes from:
- Unexpected Phone Charges: A Sign of Malware on Mobile
- Adware on Your Phone: Reading the Unwanted Ads
- Download Security: Deciding Before You Install
Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.
If you would like to follow the whole path, the Cyber Welfare Program is free and open to everyone.
Leave a Reply