What to check first

Quietly regaining visibility into devices, accounts, and what’s being shared.

Before you change every password or torch your tech, take a breath.
The first step is simple: get a sense of where things stand—without alerting anyone watching or adding more stress.

This guide walks through the key areas to check. It’s tiered by urgency, from quiet observations to deeper dives. You don’t need to tick every box at once. Start with what’s easy, and move outward from there.

Quick digital self-check (low risk, low noise)

You can do this right now, without any tools:

  • Have you noticed anything strange? Sudden battery drain? Settings changing themselves? Apps you didn’t open?
  • Are you getting unexpected login alerts or 2FA texts? Check email inboxes and phone notifications—don’t delete them yet.
  • Do some apps feel “off”? Messages marked read when you didn’t read them? Calendar entries you didn’t make?
  • Has your abuser ever had your passwords or access to your devices? If yes, assume they might still have some access—even if you’re no longer together.

These clues are enough to start investigating more deeply.

Devices: gifted, shared, or suspicious

Devices often tell the story before you do. Focus on:

  • Devices they gave you or set up

    • Is it still linked to their Apple ID, Google account, or email?
    • Does it have “remote admin” or “mobile device management” tools?

  • Shared devices (family tablets, old laptops)

    • Check for unfamiliar apps, especially with system-looking names
    • Look at installed profiles (iPhone: Settings > General > VPN & Device Management)

  • Accessories

    • Smartwatches, wireless earbuds, USB keys—some can store data or even track

If anything looks odd: Write it down, screenshot what you can, and move on to checking accounts. Don’t uninstall or wipe yet—some of this might be useful later.

Accounts: recovery options, alerts, and shared access

Email is the skeleton key. Start there. What to check:

  • Recovery email addresses and phone numbers: Go to account settings (Google, Apple, email) and see who can reset your password.
  • Recent logins and device history: Look for unfamiliar IP addresses, times, or devices
  • Shared logins: If you’re still using Netflix, banking, or email accounts they set up, stop. These accounts may be configured to forward copies of activity, track logins, or allow password resets.
  • Security questions: Are the answers things they’d know? Change them to nonsense and store offline.
  • App permissions: Some services (like Google) list “connected apps”—revoke anything you don’t recognise.

Smart home / IoT devices

Smart homes are helpful—until they’re not. What to check:

  • Cameras, lights, thermostats, locks, doorbells

    • Who has admin access?
    • Are event logs viewable (e.g., “Door unlocked at 02:31”)?
    • Are video or audio recordings being stored somewhere?

  • Wi-Fi router

    • If they installed it, they may still have login access
    • Router logs may show what devices are online and when

  • Voice assistants: Look at history of voice commands and linked accounts (Alexa, Google Assistant)

If you find anything suspicious but can’t change it safely, just note it. Later steps can help you deal with replacement or isolation.

Metadata: what’s your phone (or cloud) saying about you?

Even if your messages are private, the patterns might not be:

  • Google activity: https://myactivity.google.com – shows what’s been searched, watched, spoken, and opened
  • Apple location history: Settings > Privacy > Location Services > System Services > Significant Locations
  • Photo metadata: Tap or right-click on a photo to see where/when it was taken—even if not shared
  • Calendar events, browser sync, autofill entries: These can show daily routines, travel, and habits
  • Fitness apps & step counters: Many log location in the background, even if you’ve disabled tracking elsewhere

These are not always obvious threats—but they can feed a larger picture. If someone knows your pattern better than you do, metadata is likely involved.

A word on this section

This isn’t about proving anything to anyone else. It’s about gathering quiet clarity—for you.

Don’t try to fix it all at once. Just start noticing. Note down what you find. And if anything feels very wrong, hit pause, and come back when you’re feeling steady.

Next up: How to document digital abuse → or Technical countermeasures →