Most of us only look at our data usage when the allowance is about to run out, and the explanation is almost always mundane: a weekend of videos, a photo backup, a hefty update. Every now and then, though, that number is telling you something else: that an app is talking to the outside world more than it should, at times when nobody is using it.
This post brings together the signs to look for when you notice spikes in data usage: the ones you find in the data counters and the ones you notice simply by using your phone, with what they mean and what to do. In technical circles they are called indicators of compromise, or IOCs (Indicators of Compromise): observable traces suggesting that something is not working as it should. Here the trace is traffic, meaning the amount of data a device sends and receives over its connection.
It is the diagnostic deep dive on the recommendation about monitoring your data usage: there you will find the habit to build and where the counters are; here, the list of signs and how to read them.
What indicators are in this case
An app that collects information in secret has to send it somewhere sooner or later. Photos, contacts, messages, locations: to leave the phone they go through the connection, and the connection has a counter. That is why data usage is one of the few signs that malware — software designed to act on a device against the interests of the person using it — struggles to hide completely.
A spike, however, is not proof. It is a signal that deserves a check: the same spike may come from a sync you had forgotten about, or from a family member who borrowed your phone to watch a match. The value of the indicator lies in giving you a name and a time period to start from, rather than a vague suspicion about “the whole phone”.
Why they matter more when you know your normal usage
A number on its own says nothing: three gigabytes a month is a lot for someone who only uses email, and very little for someone who makes video calls every day.
Signs only become readable against a point of comparison: your usual consumption, the three or four apps that normally sit at the top of the list, the hours when traffic tends to cluster.
So the useful question is not “am I using a lot?”, but “what has changed compared with usual, and since when?”. If the change coincides with a new habit — a video streaming subscription, a trip with the maps switched on all day — the spike already has an explanation. If it coincides with a recently installed app, or with nothing you can recognise, it deserves a check.
Technical indicators: in the data counters
These are the ones the operating system records and shows in the settings, usually in the section on mobile networks or data usage. On a computer you will find them in the network settings or in the activity monitor, the tool that shows what is running at any given moment.
| Indicator | What it means | Why it matters | Where you see it | What to do |
|---|---|---|---|---|
| High usage from an app you rarely use | An app you seldom open appears at the top of the list, ahead of the ones you use every day | An app that uses data without being used is communicating on its own account | Settings, data usage by app, for the current and previous period | Check when you installed it and what it does; block its background data and see whether usage changes |
| Disproportionate background traffic | Almost all of the app’s usage happens in the background, meaning when it is not open on screen | Syncing a little is normal; sending a lot without being open is not | The app’s detail page, where the system separates foreground and background | Review its permissions and, if you do not need it, remove it |
| Traffic at night or with the screen off | Usage is concentrated in hours when the phone was idle, often while charging | It is a convenient moment for anyone who wants to send data without being noticed | Daily or hourly usage chart, if the system shows one | Compare it with the apps that genuinely run overnight backups; cut off data to any app with no reason to be active |
| Usage rising with no change in habits | The total goes up from one month to the next while your habits stay the same | A steady, continuous flow of data can go unnoticed precisely because it grows slowly | Comparing billing periods in the phone’s counter or in your mobile provider’s account area | Find the app that has climbed the list the most and check what has changed for it |
| Hotspot traffic you did not switch on | The counter shows data passed through the hotspot, the feature that shares your connection with other devices, on days you did not use it | Someone may have joined your connection, or sharing may have been left on | “Hotspot” or “tethering” entry in data usage | Turn sharing off and change the password; the specific signs are covered in the post on unknown devices on your hotspot |
| Unknown system apps with heavy traffic | A name that looks like a system service, but that you do not recognise, appears in the list | Some malicious apps pick generic, reassuring names to blend in with system components | The data usage list, compared with the full list of installed apps | Look up the exact name from another device, check the developer and, if it does not belong to the system, remove it |
Signs you can observe yourself
These do not require opening any settings: you notice them in everyday use, often before you even know what they mean.
| Sign | What it means | Why it matters | How you notice it | What to do |
|---|---|---|---|---|
| Data allowance running out earlier than usual | Your allowance is used up mid-month, even though you have not done anything different | It is often the first way hidden usage becomes visible | A usage warning from your mobile provider or the system, a connection slowed down until renewal | Open the per-app list and look for whatever has climbed since last month |
| Network icon active while idle | The connection symbol, where the system shows it, indicates traffic while you are not doing anything | Something is sending or receiving data at that moment | You notice it when you unlock the phone after it has been left alone | Open data usage by app and see what has been active in the last few hours |
| Home connection slower for no reason | The Wi-Fi slows down even when nobody is watching videos or downloading | A device in the house may be using bandwidth continuously | Pages that load sluggishly, video calls that keep dropping | Check which devices are connected to the router and what they are using |
| Extra charges on your line | Charges appear for traffic over your limit or for services you do not recognise | Unusual usage can turn into a real cost | Credit going down, a higher bill, messages from your mobile provider | Check the itemised bill and the per-app usage for the same period |
A concrete example
Sarah works as a freelance graphic designer and uses her phone for everything. For some time now, at the start of each month, she has been glancing at the data usage list: she usually finds the same apps there, in the same order.
This month something is different. The total is a third higher, and she has not changed her habits. Scrolling down the list, in second place she finds a photo collage app, installed a few weeks earlier for a job and opened twice. It has used more data than her email. Opening the detail view, she sees that almost all the traffic happened in the background, and the daily chart shows small spikes every night, between one and five in the morning.
She looks for the simplest explanation first, a cloud save: but she never created an account, and the collages are still in her gallery.
Sarah blocks background data for the app, checks its permissions — access to all her photos and contacts — and uninstalls it. She then runs a full security scan of the phone and, as a precaution, changes her email password. The following month her usage is back to normal.
A single spike would have had plenty of explanations. A rarely used app, traffic entirely in the background and a night-time pattern, taken together, told a different story.
What to check right away
In the phone’s data counter
- the top five apps on the list, compared with the ones you actually use;
- the split between foreground and background for the apps you rarely open;
- the current period’s usage compared with the previous one;
- the hotspot entry, if the system shows one.
In the list of apps
- apps installed around the time the spike began;
- names that look like system services but that you do not recognise;
- the permissions of apps that use a lot of data in the background.
On your other devices
- usage by program on your computer, in the network settings or the activity monitor;
- the devices connected to your home router, if the connection has slowed down for no reason.
If you find a suspicious indicator
- Stay calm. A spike is a reason to check, not proof that the phone has been compromised.
- Look for the simple explanation first. Backups, updates, videos, video calls: if one of these matches the period, the signal ends there.
- Limit before you remove. Block background data for the suspicious app and watch for a few days: if usage drops sharply, you have found the source.
- Remove what you do not need and revoke excessive permissions from the apps you keep.
- Run a full security scan with the system’s built-in protection or with an antivirus tool downloaded from the official app stores.
The settings for reducing hidden traffic are explained step by step in the post on how to limit background data. If you want to understand how an app gets information out, you will find the mechanism in the post on data exfiltration from phones: exfiltration means exactly that, moving data from a device to the outside without the consent of the person using it.
What is not an indicator
Telling them apart helps you avoid two opposite mistakes: worrying about perfectly legitimate usage, and getting used to ignoring the real signs.
| Situation | Why it is usually not a signal |
|---|---|
| Photo backup to the cloud | The first backup, or the one after switching phones, can move many gigabytes in a few days. It settles down once the archive is in sync |
| System and app updates | They download large packages, sometimes overnight and automatically: the spike is concentrated and then disappears |
| High-quality video | Streaming and social networks with autoplaying videos use a lot of data by nature: the top of the list is where they belong |
| Video calls and sat nav | An hour on a video call or a long journey with the maps on can explain a jump in the total on their own |
| A newly set-up phone | In the first few days, apps and the system sync email, contacts, photos and settings all at once |
In all these cases the explanation has a name and a time period, and usage returns to normal once the activity ends.
The rule of thumb: one isolated signal deserves a check; two signals together deserve action.
How often to check
You do not need a demanding routine. You need to know your normal usage well enough to notice when it changes.
| Frequency | What to check |
|---|---|
| When a usage warning arrives | The per-app list for the period: this is when the check pays off most |
| In the weeks after installing a new app | Its usage, and in particular its background usage |
| Once a month | The total and the top apps on the list, compared with the previous month |
| Every 2–3 months | The full list of apps, any system entries you do not recognise, your computer’s usage |
| After lending your phone or sharing your hotspot | The hotspot entry and the devices that connected |
Two important warnings
An indicator is not proof. A spike in data usage is, in most cases, the sign of a legitimate activity you had forgotten about. Check before you get alarmed, and before removing an app you use, find out what it does and why it uses data.
No indicators is not a guarantee. An app that only sends small amounts of text, such as messages or locations, can stay below the threshold of what anyone notices. That is why the main defence is still prevention: installing apps from official sources, granting only the permissions that are needed, removing what you do not use. Indicators help you notice in time; they do not replace these habits.
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Skills | Knowing how to read usage by app, tell foreground from background and recognise traffic that does not add up |
| Awareness | Understanding that a hidden app has to communicate with the outside world, and that this traffic leaves a measurable trace |
| Secure Behaviour | Comparing usage with your own normal and calmly checking every spike that has no explanation |
Reference level: FL3 — Autonomous. This is the level at which you know your usual consumption, can tell a harmless spike from a suspicious one and act on it without needing outside support.
Conclusion
A spike in data usage is not a reason to look at your phone with suspicion. It is a piece of information: almost always it tells you that you watched more videos than usual or that a backup kicked in; occasionally, that an app is talking to someone without your knowledge. The way to tell the two apart is to know your own normal.
What to do right now. Open your phone’s settings, find data usage and look at the top five apps for this month. If they match what you use, you have just set your point of comparison for next time. If there is one you did not expect, you have a precise place to start. To see where you stand on the other aspects of your digital security too, you can take the digital resilience self-assessment.
Related resources
Short guides from the Resources section, for anyone who wants to focus on a single aspect:
- Unexpected Phone Charges: When the Bill Is the Signal
- Home Network Attack Surface: Counting What Is Connected
Related content
- Monitoring your data usage — the recommendation this belongs to
- Data exfiltration from phones — the attacks that generate these signals
- How to limit background data — what to do, in the right order
- Impact of hidden data traffic — what gets hit when a signal is confirmed
- Spotting the signs of malware on your phone — the other signs, beyond traffic
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
