Leaving the advertising aside, what exactly can a message monitoring program capture? The answer is technical and worth knowing because it explains why some products work, why most promises are false, and why the trail always appears.
How this type of program works internally
There's no magic or network interception involved. Every program in this category relies on permissions granted manually on the device, and each permission explains an advertised feature.
Accessibility service
It's the central permission. Created for screen readers, it allows an application to read the content displayed in other applications. This is how you capture the text of a message. after that it was deciphered and drawn on the screen — never in transit.
Practical consequence: what doesn't appear on the screen isn't captured. Messages deleted before being displayed aren't recorded.
Access to notifications
It allows you to read the content of notifications. This is what underpins the "deleted messages" feature: the program saves the notification, and it survives even if the message is deleted from the conversation.
Device administrator
It registers the program as administrator to make uninstallation more difficult. It doesn't add capture capabilities—only resistance to removal.
Location, microphone, camera, contacts
Common permissions, granted one by one, that support tracking and recording. In the current Android system, microphone and camera usage turn on a visible indicator in the status bar.
What they actually achieve
- Message text displayed on the screen, in any application.
- Notification content, including messages that were later deleted.
- Call log: numbers, date, time and duration.
- GPS location with history.
- List of installed applications and usage time for each.
- Periodic screenshots and keystrokes, depending on the product.
What they can't achieve, no matter how much they advertise, is what they can't.
Works without installation.
This is the most important limitation. On Android, someone needs to have the unlocked device in their hands for several minutes, download the file from outside the store, disable protections, and grant each permission. There is no remote version of this.
Works only with a phone number.
It doesn't exist. A number is an identifier, not an access key. Any website that promises that is running a scam.
Break the encryption
WhatsApp and Signal's end-to-end encryption isn't bypassed—it's surrounded. The program reads the message after it's been converted to text on the screen. Outside the device, the content remains inaccessible.
Log in to iPhone without credentials
On iOS, there is no installation in this format. What is offered is access via iCloud, which requires login, password, and a two-step verification code — which is sent to the person's own device.
To remain invisible indefinitely.
Android requires persistent notification for accessibility services, Play Protect flags the category, and each system update closes more loopholes. Invisibility is temporary by design.
The traces that always remain
- Battery: Continuous screen capture and data transfer consume a lot of data. A sharp drop in usage without a change in behavior is the most common sign.
- Heat: Constant processing heats up the device even when it's idle.
- Data: Everything needs to be sent to a server. Consumption appears in the usage per application.
- Performance: Slow performance and freezing without apparent cause.
- System lists: Entries in Accessibility and Device Administrators are often generically named.
How to check your device
- Settings › Accessibility: Turn off any service that you don't recognize.
- Applications, with the system apps displayed: look for names like “Service”, “Sync”, “Update Service”.
- Security › Device administration apps: Remove anything you didn't install.
- Data usage per app: Investigate high consumption of something unknown.
- WhatsApp › Connected devices: Disconnect unwanted sessions and enable two-step verification.
- Play Protect: Run a manual check.
The suspicion was confirmed: backup of photos and documents only, factory reset, and password change from another device.
The legal part
Installing this type of program on an adult's cell phone without their knowledge is considered unauthorized access to a computer system., Article 154-A of the Penal Code, with imprisonment from 1 to 4 years and a fine — a greater penalty if the content of private communications is obtained, and an increase of one to two-thirds in case of disclosure.
Legal use exists in three situations: minor child, adult who has freely and knowingly consented, and corporate device with a written policy.
To supervise children
O Google Family Link It's free, official, and visible on the device: time limits per app, installation approval, content filters, and location. On the iPhone, the Usage Time It serves the same purpose. Neither of them reads conversations — and now it's clear why: doing so would require precisely the accessibility service that store policies restrict.
Google Family Link
AndroidFrequently Asked Questions
Do they read deleted messages?
Only if the notification has appeared before. Anything that has never been displayed is not captured.
Do they work without internet?
They capture data locally, but need a connection to send it. Without a network, the data remains stored on the device.
Is rooting or jailbreaking necessary?
For basic functions, no. For advanced features, some products require it—which greatly increases the chance of detection and damaging the device.
Does the antivirus detect it?
Many systems detect it, and Play Protect does too. Manual verification by accessibility and administrators remains more reliable.
Does a factory reset remove it?
It virtually removes the entire category. Beware of old backups that might bring the program back.
In summary
These programs read what has already appeared on the screen, using permissions granted manually with the device in hand. They don't break encryption, they don't work remotely, they don't operate solely with the number, and they don't remain invisible forever. Understanding this is useful for both parties: it identifies fraud and shows exactly where to look if the suspicion is about your own cell phone.
How to truly take advantage of it.
- Enable installation approval. It prevents new apps from appearing without your knowledge, which is half the problem.
- Use the official tool. Google Family Link on Android and Screen Time on iPhone: free, visible on the device, and without requiring you to disable any protection.
- Review the agreement every few months. Limits that don't match age become a source of conflict and challenges.
- Set a limit per application, not just a total limit. Allowing free study time and restricting short video time works better than a single limit.
Common mistakes that are costly
- Don't believe promises of monitoring based solely on a phone number; it doesn't exist.
- Relying on evidence obtained through unauthorized access in a legal proceeding—it is discarded and exposes whoever produced it.
- Disabling Play Protect to install files from outside sources is the most common vector for banking trojans.
- Installing hidden software on an adult's cell phone is a crime under article 154-A, punishable by 1 to 4 years imprisonment.
Before installing: what's already on the device
To find a lost device, Find My Device and Find My iPhone are free and come standard: they sound an alarm even when the device is on silent, show it on a map, and remotely lock and erase it. It's worth checking today if they are activated — once lost, you can't configure them anymore.
