WARNING: LEGAL AND ETHICAL DISCLAIMER
Accessing, monitoring, or intercepting communications on a device, account, or network without the explicit, informed consent of the owner is illegal in nearly all jurisdictions. In the United States, such actions violate the Computer Fraud and Abuse Act (CFAA), the Electronic Communications Privacy Act (ECPA), and various state-level wiretapping and anti-stalkerware laws. Similar laws exist globally (e.g., GDPR in Europe, the Computer Misuse Act in the UK). This article is written strictly for educational, defensive, and cybersecurity awareness purposes. Do not attempt to use these methods on any device you do not own or have explicit legal authority to monitor.

Technical Analysis and Fact-Check: Remote Phone Monitoring Claims

Part 1: Fact-Checking the Video’s Claims

1. USSD and Call-Forwarding Codes (e.g., **21*)

• The Claim: Dialing a code like **21*[phone_number]# redirects all calls and voicemails to another device.
• The Reality: Partially True, but Misleading. **21* is a legitimate GSM standard feature for “Unconditional Call Forwarding.” It does work to forward calls. However, it requires physical, unlocked access to the target phone to dial the code. Furthermore, modern mobile carriers and smartphones often display a persistent notification in the status bar when call forwarding is active, and many carriers send an automated SMS alert to the device owner when forwarding is enabled. It does not forward text messages, only voice calls and voicemails.

2. Verizon Message Family (formerly Message+)

• The Claim: You can link a target phone to your account by sending a six-digit code, allowing you to monitor all texts, including deleted ones, without installing software.
• The Reality: Misleading. Verizon Message Family is a legitimate parental control and multi-device messaging tool. However, it is not a stealth tool. To link a device, the target user must actively open the invitation and approve the six-digit code on their screen. If an attacker intercepts this code (e.g., via SIM swapping), it constitutes a separate, severe cybercrime. The tool is designed for transparent, consensual family sharing, not covert surveillance.

3. Tenorshare 4uKey + XNSPY

• The Claim: Use Tenorshare 4uKey to recover an Apple ID password from a device, then link it to an online monitoring dashboard like XNSPY to see everything.
• The Reality: Highly Exaggerated. Tenorshare 4uKey is a legitimate password recovery and screen-unlock utility. However, it cannot magically “extract” a plaintext Apple ID password from a locked, untrusted device. Bypassing an Apple ID typically requires the device to be erased, updated, or already “trusted” by the computer running the software. Furthermore, XNSPY is a known commercial stalkerware application. Even if iCloud credentials were obtained, Apple’s Two-Factor Authentication (2FA) would block the login attempt without physical access to the trusted device to approve the sign-in.

Part 2: The Legal Reality

• Stalkerware Laws: Many U.S. states and countries have explicitly criminalized the sale and use of “stalkerware” (software designed to secretly monitor a person’s device).
• Wiretapping Statutes: Intercepting electronic communications without consent is a felony under federal and state wiretapping laws.
• Civil Liability: Victims can sue for invasion of privacy, emotional distress, and statutory damages, which often far exceed any criminal fines.

Part 3: Threat Landscape – 10 Other Technological Methods Used for Unauthorized Monitoring

1. SIM Swapping: Social engineering a mobile carrier to port a victim’s phone number to an attacker-controlled SIM card, thereby intercepting all SMS-based Two-Factor Authentication (2FA) codes and calls.
2. Phishing and Credential Harvesting: Deploying fake iCloud, Google, or carrier login pages via SMS (smishing) or email to steal usernames and passwords.
3. Covert Stalkerware Installation: Apps like mSpy or FlexiSPY that require brief physical access to a device to install, but then hide their icon and run in the background, logging keystrokes, GPS, and messages.
4. SS7 Network Exploitation: Advanced attackers leverage vulnerabilities in the global Signaling System No. 7 (SS7) telecom protocol to intercept SMS messages and calls at the carrier level, without touching the target phone.
5. Cloud Backup Compromise: Exploiting weak, reused, or breached passwords to log into a victim’s iCloud or Google Drive, where full device backups (including message histories) are stored.
6. Man-in-the-Middle (MitM) Attacks: Intercepting unencrypted Wi-Fi traffic on public networks to capture session cookies or credentials, allowing attackers to hijack active web sessions.
7. OAuth Token Theft: Tricking users into granting malicious third-party applications access to their cloud accounts via deceptive “Sign in with Google/Apple” permission screens.
8. Hardware Keyloggers: Physically attaching a small device between a keyboard and a computer (or using compromised charging cables, aka “O.MG cables”) to record every keystroke, including passwords.
9. Exploiting Unpatched OS Vulnerabilities: Using known Common Vulnerabilities and Exposures (CVEs) or zero-day exploits to gain root/jailbreak access to a device remotely (e.g., via a malicious link).
10. Smart Home/Ecosystem Abuse: Misusing legitimate features like “Drop In” on Amazon Alexa, shared family location tracking, or synced browser histories to monitor a victim’s activities.

Part 4: Technical Mitigation – How to Prevent This From Happening to You

1. Neutralize Call Forwarding

2. Enforce Strong, Phishing-Resistant Multi-Factor Authentication (MFA)

• Hardware Security Keys: YubiKey or Google Titan (FIDO2/WebAuthn standard).
• Authenticator Apps: Authy, Google Authenticator, or Raivo OTP.
• Enable Apple Advanced Data Protection or Google’s Advanced Protection Program for high-risk accounts.

3. Audit Trusted Devices and Active Sessions

• Apple: Settings > [Your Name] > Scroll down to see all trusted devices. Remove any you do not recognize.
• Google: myaccount.google.com > Security > “Your devices” > Manage all devices. Sign out of unknown sessions.
• Carriers: Log into your Verizon/AT&T/T-Mobile portal and review linked “multi-device” or messaging services.

4. Lock Down App Permissions (Especially on Android)

• Accessibility Services: (Settings > Accessibility). Malicious apps abuse this to read screen content.
• Device Admin Apps: (Settings > Security > Device Admin Apps). Revoke any unknown entries.
• Notification Access: Ensure no unknown apps can read your incoming messages.

5. Secure Cloud Backups

• Use a unique, 16+ character password generated by a reputable Password Manager (e.g., Bitwarden, 1Password) for your Apple ID and Google Account.
• Enable End-to-End Encryption (E2EE) for your cloud backups (e.g., Apple’s Advanced Data Protection), ensuring that even the cloud provider cannot decrypt your data.

6. Monitor for Anomalies

• Unexpected battery drain or device overheating.
• Strange spikes in mobile data usage.
• Random reboots or the screen turning on by itself.
• Receiving unexpected 2FA codes via SMS (this means someone has your password and is trying to log in).

7. Enable Lock Screen Protections

8. Keep Software Updated

9. Use End-to-End Encrypted Messaging

10. Never Share Verification Codes

The “Phone Monitoring” Video Transcript: Technical Reality, Legal Consequences, and Defense

 “How To See What Someone Is Doing On Their Phone,” and the established technical and legal realities of the commercial surveillance software (often called “stalkerware”) industry that such videos typically promote.

Bottom Line Up Front: The tools and methods typically presented in videos like this—commercial spy apps such as mSpy or FlexiSPY—do work technically, but they are illegal to use on a non-consenting adult’s device in most jurisdictions, including the United States and the European Union. They function by exploiting physical access or iCloud credentials to install hidden software that exfiltrates private data. The following article details how these tools operate, lists ten other surveillance methods (including non-consensual ones), and provides concrete technical steps to prevent and detect such intrusions on your own device.

1. Do the Tools Work? (Technical Fact-Check)

Yes, they work. Commercial spyware marketed to consumers is functional, though its reliability depends on the target device’s operating system and the level of access the installer has.

The Critical Caveat: Legality
Using these tools on a device belonging to another adult without their informed, explicit consent is illegal in the United States under the Computer Fraud and Abuse Act (CFAA) and the Wiretap Act . The U.S. Department of Justice has successfully prosecuted spyware makers (e.g., the founder of pcTattletale) for facilitating this illegal surveillance . Even installing such software on a spouse’s phone without consent is actionable under federal wiretapping statutes . Legitimate uses are generally limited to parental monitoring of minor children (with transparency) or employer monitoring of company-owned devices (with clear policy disclosure).

2. Ten Other Technical Surveillance Methods

Beyond commercial spy apps, there are numerous technical avenues—some legitimate (for security research or parental control), many malicious—used to monitor a phone’s activity.

1. iCloud Backup Extraction: If an attacker knows the target’s Apple ID and password (and the account lacks 2FA), they can use forensic tools or even the spy app’s web dashboard to download synced iMessage data, photos, and backups without ever touching the physical phone .

2. Android Accessibility Service Abuse: Malicious apps trick the user into enabling “Accessibility” permissions. This grants the app the ability to read screen content (including passwords and messages), intercept notifications, and perform clicks on the user’s behalf .

3. Notification Listener Access: Android allows apps to read all incoming notifications. A malicious app with this permission can silently forward every WhatsApp, SMS, and email preview to an attacker’s server .

4. Device Administrator Abuse: Spyware requests Device Admin privileges, making it difficult to uninstall (it can block uninstallation attempts) and granting broad control over the device’s lock screen and data wiping capabilities .

5. SIM Swapping: An attacker convinces the mobile carrier to port the victim’s number to a SIM card they control. This allows them to intercept SMS-based two-factor authentication codes and calls .

6. SS7 Protocol Exploitation: The global telecom signaling system (SS7) has known vulnerabilities that allow sophisticated attackers (often state-level or high-end criminal groups) to intercept calls and track location by exploiting trust between carriers .

7. Public Wi-Fi Interception (MitM): On unsecured or malicious Wi-Fi networks, an attacker can perform a Man-in-the-Middle attack to capture unencrypted traffic. While most modern apps use TLS, misconfigured apps or older protocols can leak data .

8. Bluetooth Exploitation: Leaving Bluetooth on in public can allow attackers within range to attempt to pair with the device or exploit known Bluetooth vulnerabilities to extract data .

9. Phishing/Smishing for Credentials: Sending a fake “login alert” text or email that directs the victim to a lookalike page to steal their Apple ID or Google Account password, thereby gaining access to cloud backups and location data .

10. Side-Channel Timing Attacks (e.g., “Careless Whisper”): A research technique that exploits delivery receipts in WhatsApp/Signal. By measuring the Round-Trip Time (RTT) of messages sent to an invalid ID, an attacker can infer if the target’s phone screen is on, if they are on Wi-Fi or cellular, and even map their daily routine, all without sending a visible notification .

3. Technical Ways to Prevent This From Happening to You

Prevention requires a layered defense strategy, focusing on securing physical access, cloud accounts, and OS permissions.

A. Hardening Your Device Against Spyware Installation

• Lock Down Cloud Credentials: This is the single most important step for iPhone users. Enable Two-Factor Authentication (2FA) on your Apple ID and Google Account. Without the 2FA code, an attacker cannot access your iCloud backups, even if they know your password.

• Disable “Install from Unknown Sources”: On Android, ensure this setting is OFF. This prevents sideloading of APKs from outside the Google Play Store, which is the primary vector for stalkerware installation.

• Use a Strong Screen Lock: Use a 6+ digit PIN or a strong alphanumeric password. Avoid pattern locks, which are easier to shoulder-surf. Never share your passcode with anyone you do not trust implicitly.

• Enable Apple’s Lockdown Mode (If High Risk): If you are a journalist, activist, or suspect you are a target of sophisticated spyware, enable Lockdown Mode. It severely restricts device functionality (e.g., blocks unknown iMessage attachments, strips location data from shared photos) and has been proven to stop zero-click attacks like Pegasus .

B. Auditing Permissions (The Detection Phase)

If you suspect your phone is compromised, check these specific settings:

1. Android – Accessibility & Notification Access:

   • Go to Settings > Accessibility. Scroll to the bottom. Look for any app you do not recognize (often named “System Service,” “Device Health,” or “Sync”). Disable and uninstall it immediately .

   • Go to Settings > Apps > Special app access > Notification access. Revoke access for any app that does not need to read your notifications (e.g., a smartwatch app might need it, but a random “System Update” app does not) .

2. Android – Device Admin Apps:

   • Go to Settings > Security > Device admin apps. If you see an app you did not explicitly authorize (e.g., a corporate MDM profile or a known find-my-phone app), deactivate it and uninstall .

3. iOS – Profile & Device Management:

   • Go to Settings > General > VPN & Device Management. If there is a configuration profile or MDM profile installed that you did not create (e.g., from your employer or a school), it could be monitoring your traffic. Delete it if it is not legitimate.

4. Check for Spyware Signs:

   • Unexplained Battery Drain: Spyware runs constantly in the background, uploading data .

   • Data Usage Spikes: Check your cellular data usage in Settings. Spyware exfiltrates large amounts of data.

   • Overheating: A phone that is hot to the touch while idle or during a call may be running surveillance processes .

C. Emergency Response (If You Find Spyware)

If you discover stalkerware, do not immediately delete it if you are in a potentially abusive situation. The person who planted it may escalate if they lose access. Contact a domestic violence hotline or the Coalition Against Stalkerware for a safety plan .

If you are safe to proceed:

1. Turn on Airplane Mode to cut the attacker’s connection .

2. Reboot into Safe Mode (Android only). This disables third-party apps, allowing you to uninstall the spyware without triggering password prompts that the spyware may display .

3. Change All Passwords from a different, trusted device (e.g., a laptop). Change your Apple ID/Google password first, then banking and social media.

4. Factory Reset the phone as a last resort. Note that this erases all data; ensure you have a backup of your essential photos and contacts made after the spyware was removed (if possible) or from a previous clean backup.