Who tried to unlock my phone? Intruder selfies and other clues

You pick up your phone and something’s off. It wants your passcode instead of your face, or it says to try again in a few minutes, or an app you rarely use shows up in today’s screen time. The natural next question is who, and whether your phone could have taken their picture.

Intruder selfie apps promise exactly that, but what they can catch depends on whether they’re watching your phone’s lock screen or just their own. This guide explains that difference on Android and iPhone, the other clues that someone tried to get in, and what to do next.

Lock screen or one app: two different things

“Intruder selfie” gets used for two features that only look alike.

• Lock-screen capture photographs someone who types a wrong PIN, pattern or password on the phone itself, before they get anywhere. This is what most people mean when they ask who tried to unlock their phone.
• In-app capture photographs someone who types a wrong code into one particular app, usually an app locker or a vault. It only fires if they got past the lock screen (or the phone was already unlocked) and then went for that app.

Store listings often blur the two. Before you rely on one, check which screen it actually watches.

Catching lock-screen attempts on Android

Android lets an app register as a device admin, an older feature built for company-managed phones. An admin app that asks for the “watch login” policy is told by the system each time someone enters a wrong PIN, pattern or password, and can read how many attempts have failed. Intruder selfie apps hook into that and then try to take a front-camera photo.

The catch is everything around that hook:

• Since Android 9, apps running in the background can’t use the camera at all. Apps have to work around that, and how well they manage it varies by phone and Android version.
• Google has been deprecating parts of device admin since Android 9, so these apps lean on a feature that is slowly being retired.
• You have to grant device admin and camera access, and the app has to stay installed and running. If you’ve switched off camera access in Quick Settings, nothing gets photographed.

So if you try one, test it: lock your phone, enter a wrong PIN the number of times it asks for, and see whether a photo actually appears. Stock Android has no intruder photo setting of its own. If your phone’s maker offers one, it will be in that brand’s security or app lock settings, so check there before installing anything.

Why no iPhone app can watch the lock screen

iOS gives apps no way to know when someone enters a wrong passcode, and no way to switch on the camera by themselves while the phone is locked. No setting or permission changes this, so any iPhone app promising intruder photos is talking about its own lock screen, not your phone’s.

What iPhone does do is slow guessers down. After repeated wrong passcodes, the lock screen shows an iPhone Unavailable or Security Lockout message with a timer, and the wait grows as wrong attempts pile up. Face ID also asks for your passcode after five unsuccessful attempts to match a face. You can also turn on Erase Data in Settings › Face ID & Passcode, which wipes the phone after ten failed passcode attempts in a row. Think twice if a small child plays with your phone, and only use it if you have a recent backup.

Break-in alerts inside an app

In-app capture is more modest, but it works the same way on both platforms because the app is on screen when the wrong code is typed. It answers a narrower question: not “who tried my phone?” but “who tried to get into this app?”

That’s what the break-in alert in Calculator Locker, our calculator vault app, does. Three wrong vault codes and the front camera quietly takes a photo, with the time and the code they tried, waiting for you inside the vault. It only works after you’ve allowed camera access. To be plain about it: it does not watch your phone’s lock screen, and it won’t tell you if someone unlocked your phone and did something else.

It’s most useful in the situation a vault is built for: someone who already has your unlocked phone, finds a calculator and starts guessing. Seeing the code they tried also tells you something, for example that they were trying your birthday. One thing to know: iPhone (iOS 14 and later) and Android 12 and later show a green camera indicator at the top of the screen while any app uses the camera, so an observant person may notice it.

Other signs someone tried to get in

Without a photo, you’re looking for traces. None of these proves anything on its own; phones get pocket-dialled, kids tap screens, and Face ID asks for a passcode after every restart. Look for a pattern.

Screen Time shows how often the phone was picked up and which apps were used, so check the hours when you know the phone wasn’t with you. On Android, Digital Wellbeing has a “times opened” view that counts unlocks and app opens. On some phones the menu is called Digital Wellbeing & parental controls.

A face or fingerprint you didn’t add is the most serious clue, because it means someone had your unlocked phone and wanted easier access later. iPhone doesn’t show a list of enrolled faces, so if you’re unsure whether someone added an alternate appearance, Apple’s advice is to reset Face ID and set it up again.

What to do if someone is trying to get in

1. Change your passcode. On iPhone: Settings › Face ID & Passcode › Change Passcode. On a Pixel: Settings › Security & privacy › Device unlock › Screen lock; on other Android phones, search Settings for “screen lock”. Use six digits or more, and stop unlocking where someone can watch your fingers.
2. Review biometrics. iPhone with Touch ID: Settings › Touch ID & Passcode, delete prints you don’t recognise. iPhone with Face ID: reset Face ID if in doubt. Pixel: Settings › Security & privacy › Device unlock › Fingerprint. Samsung: Settings › Security and privacy › Biometrics › Fingerprints.
3. Check your account’s devices. On iPhone, tap your name in Settings and scroll to the device list; tap one you don’t know and choose Remove from Account. For Google, go to myaccount.google.com › Security & sign-in › Your devices › Manage all devices and sign out anything unfamiliar. If you find one, change that account’s password too.
4. Turn on theft protection. On iPhone (iOS 17.3 and later), Stolen Device Protection is in Settings › Face ID & Passcode. Away from familiar places, it requires Face ID or Touch ID for sensitive actions, and adds an hour’s delay before changes like a new passcode. On Android, go to Settings › Google › All services › Theft protection and turn on Identity Check (biometrics for key settings outside trusted places) and Failed Authentication Lock, which locks the screen after repeated failed attempts. On new Android 17 phones these protections are on by default.
5. Lock what matters most. A second lock on the apps that hold your private things means a known passcode isn’t enough. Our comparison of Locked Folder, Secure Folder and Private Space shows which built-in options have their own lock.

A word on photographing people

An intruder selfie is a photo of someone who didn’t agree to it. Rules on recording people differ between countries and states, especially in shared homes and workplaces. In most everyday cases, keeping a photo on your own phone for your own information is very different from sharing it.

So keep it low-key. Use the photo to understand what happened, don’t post it, and if it shows a crime such as theft, give it to the police rather than confronting anyone. If the face in the photo belongs to someone you live with, a calm conversation will usually do more than the picture. And if you’d rather they had nothing to find in the first place, a calculator vault that opens with a code only you know keeps private things private without any photos at all.