Technology-Facilitated Abuse: Safety Planning for Devices and Accounts Guide

When an abuser controls or can see your phone, accounts, location and home devices, ordinary security advice can put you in more danger, because a sudden lock-out tells them you are trying to get away. Technology-facilitated abuse covers shared and known passwords, family location sharing, hidden trackers, stalkerware, smart home devices used to frighten or watch, and accounts the abuser set up or still pays for. This guide sets out a safety-first order for dealing with it: get support from a safe device, record what is happening, then make changes in a planned sequence. It is written for people experiencing abuse, and for the friends, family members, advocates and IT helpers supporting them. It builds on our Spyware and Stalkerware Guide, which explains how monitoring apps work; this page is about the wider set of devices and accounts and the order in which to act.

Key takeaways

• Safety comes before security. The US Federal Trade Commission warns that taking steps against monitoring could tip off an abuser and that removing stalkerware may lead to escalation, so speak to a trained advocate before you change anything.
• Ask for help from a device the abuser has never touched. Use a friend's phone, a work or library computer, or a new pay-as-you-go phone to contact helplines and to research what to do.
• Most tech abuse uses ordinary features, not hacking. Known passwords, shared cloud accounts, family location sharing, a car app or a doorbell account are far more common routes than exotic spyware.
• Record before you reset. A factory reset or deleting an app removes the evidence along with the problem. Keep an incident log and save copies somewhere the abuser cannot reach.
• A clean device and fresh accounts are the strongest fix. A new phone with accounts the abuser cannot access is the safest option; when you rebuild, reinstall apps from the store rather than from an old backup.

Get help first: helplines and a safe device

If you are in immediate danger, call 999 in the UK or 911 in the US. For everything else, the first step is to talk to someone trained in domestic abuse and stalking, ideally before you change any settings. Advocates can help you build a personal safety plan and a technology safety plan, preserve evidence, connect with local services and understand how to deal with the police.

• Use a safe device: the FTC advises against contacting an advocate or the police from a device that may be monitored. If someone can see your phone, they may be able to see your searches and messages, including this page.
• Consider leaving the phone behind: when you go to meet an advocate, a lawyer or the police, a monitored phone can reveal where you are and, in some cases, what is said near it.

Map how the abuser could be reaching you

Before changing anything, write down (on paper or on the safe device) every way the person could be seeing, hearing or controlling your life through technology. Stop Stalkerware, a coalition of advocacy groups and security companies, notes that the most common sign of monitoring is an abuser who seems to know too much, with no other explanation. Working out which route they are using tells you what to fix and in what order.

Record what is happening before you change anything

Deleting an app, resetting a phone or removing a tracker can also delete the evidence you may need for a protection order, a stalking report or a criminal case. Stop Stalkerware notes that deleting stalkerware also deletes evidence, and recommends speaking to the police first if you plan to report. The Safety Net Project's documentation tips give practical detail.

• Keep an incident log: for each event, record the date and time, where it happened (for example a link to a post), the technology involved, any witnesses, any report you made (the officer and date) and a short description.
• Do not delete threats: keep messages, emails and posts, even the upsetting ones, because the pattern matters. Keep original emails rather than forwarding them, since forwarding strips identifying information, and save the full email header.
• Screenshots with care: some messaging and social apps tell the other person when you take a screenshot or screen recording. If in doubt, photograph the screen with a second, safer device and check the image is readable.
• Link messages to the person: capture the contact page or profile as well as the messages, so it is clear which number or account sent them.
• Store copies out of reach: if the abuser can get into your devices or cloud accounts, keep copies on a device or account they have never had access to, or with an advocate or solicitor.
• Act quickly on provider records: mobile providers keep message content only for a short time. If you are working with the police, ask them early about a preservation request.

Secure accounts in a safe order

Once you and your advocate have decided it is safe to act, work through accounts in order of what gives the abuser the most reach. Start with the accounts that control others: your main email (which can reset every other password), your Apple Account or Google account (which holds location, photos and backups), and your mobile phone account (which receives reset codes).

1. Change passwords from a safe device: if your phone or laptop may be monitored, a new password typed on it can be captured. Make each password new, long and not shared. A password manager helps. See the Password Managers Explained for Everyone Guide.
2. Check recovery details: remove any recovery email address or phone number that the abuser controls or knows, or they can reset the password straight back. See the Account Recovery Planning Guide.
3. Sign out other devices: on a Google account, go to Security and sign-in, then Your devices, then Manage all devices, and sign out anything you do not recognise. Google notes that several sessions with the same device name may be different devices, so sign out all of them.
4. Turn on two-step verification: both the FTC and Stop Stalkerware recommend it. Make sure the second step goes to a phone or security key only you hold. See the Two-Factor Authentication for Everyone Guide.
5. Review connected apps and shared access: check email forwarding rules, delegated mailbox access, shared calendars, shared photo albums and linked accounts in social apps. A forwarding rule can quietly send every message to the abuser. See the Securing Your Email Account Guide.
6. Separate the phone contract: if the abuser is the account holder on your mobile contract or family plan, they may see call records and can ask for a replacement SIM. Ask the provider about moving your number to an account in your own name, ideally with an advocate's help.

Using Apple Safety Check

On an iPhone with iOS 16 or later, Safety Check is in Settings, then Privacy and Security, then Safety Check. It needs an Apple Account that uses two-factor authentication. It offers two paths:

A Quick Exit button closes Settings and returns to the Home Screen, keeping any changes already made. Apple lists important limits: Safety Check cannot review non-Apple accounts or passwords, social media sharing, devices signed in to a different Apple Account, or sharing settings on an iPad or Mac, and Screen Time restrictions or a device management profile may remove options. Apple also notes that some apps tell the other person when sharing resumes, so treat any change as something they might notice.

Location sharing and hidden trackers

Location is often the most dangerous thing an abuser can see. Check each place it can leak: phone location sharing (Find My, Google Maps location sharing), family sharing groups, social media check-ins and map features, photo location tags, fitness apps, and the car's app. Stopping all of these at once is obvious; your advocate can help you choose whether to stop sharing, or to keep it running until you have moved somewhere safe. See the Location Data Privacy Guide.

If you get a tracker alert

• iPhone: alerts that an AirTag or Find My accessory is moving with you need iOS 17.5 or later, with Bluetooth on, Tracking Notifications allowed and Airplane Mode off. Tap the alert and use Play Sound; on phones with Ultra Wideband, Find Nearby shows the distance and direction to an AirTag.
• Android: Unknown tracker alerts work on Android 6 or later and include AirTags. You can run a manual scan from Settings, then Safety and emergency, then Unknown tracker alerts, then Scan now. Google keeps alerts for 48 hours.
• Identify before disabling: holding an NFC-capable phone near the white side of an AirTag opens a page with its serial number and the last four digits of the owner's phone number. Photograph this; it is evidence.
• Think before you switch it off: disabling a tracker stops it reporting, but Google notes the owner may still see the last location it reported, and the abuser may notice it has gone quiet. If you feel unsafe, both Apple and Google advise going to a public place and contacting the police. Apple states that tracking people without consent is a crime in many countries and that law enforcement can request information about a tracker's owner.
• Turning off your own Bluetooth does not help: both Apple and Google say that switching off Bluetooth, Location Services or Airplane Mode on your phone does not stop the tracker sharing its location with its owner.

Smart home, cars and shared household technology

Refuge's tech safety site shows an ex-partner remotely triggering a smart home device at night, and has guides for doorbells, cameras, smart speakers, smart TVs, smart plugs and smart locks. The key fact about these devices is that control sits with whoever owns the account in the app, not with whoever lives in the house.

• Find the owner account: for each device (doorbell, camera, thermostat, lock, speaker), check which account it is registered to and who else is listed as a member or shared user. If the abuser is the owner, you may not be able to remove them; resetting the device to factory settings and setting it up again under your own account is often the only clean fix.
• Change the home Wi-Fi and router password: the abuser may know the Wi-Fi password and the router's admin password, which can show which devices are connected. Change both once it is safe. See the Smart Home Security Guide.
• Connected cars: manufacturer apps can show where a car is. Check who is registered on the car's account and remove anyone who should not be there; a dealer can help if the abuser is the registered owner. Also check the car physically for trackers.
• Children's devices: family controls, games consoles and children's phones may still be linked to the abuser's account and can reveal location. Raise these with your advocate, because changes may affect child arrangements.

Getting to a clean device

The FTC says a new phone with accounts the abuser cannot access is the safest option; if you keep the phone, do a full factory reset. Stop Stalkerware describes a new phone as the most thorough option and a factory reset as nearly as effective. In either case, follow this order.

1. Save what you need first: copy evidence and important photos to a safe place before resetting or replacing the device.
2. Check for rooting or jailbreaking: a rooted or jailbroken phone can make stalkerware easier to install. The Safety Net Project publishes a guide to checking this (techsafety.org/rootjailbreakcheck).
3. Set up the new or reset phone with new accounts or freshly secured ones: use a new Apple Account or Google account if the old one may be compromised, or one you have already secured from a safe device.
4. Do not restore apps from a backup: the FTC warns that restoring from a backup can reinstall stalkerware. Download apps again from the official store and reinstall only the ones you need.
5. Lock it down: set automatic locking with a passcode of at least six digits, changed if the abuser may know the old one; biometrics are an option. Keep the system and apps updated, and keep the phone with you so nobody has unsupervised access.

Guidance for advocates, employers and IT helpers

People supporting a survivor often have more technical skill than safety training. The safe approach is to support the survivor's plan, not to "fix" the device for them.

• Let the survivor decide the order: a well-meaning helper who removes an app or resets a router can trigger escalation. Agree each step with the survivor and, where possible, their advocate.
• Employers: a work laptop or phone can be a safe device for contacting help, if the person is comfortable that work IT staff may see activity. Safety Net notes that printers may log activity and that work or school accounts may be visible to IT staff, so be clear about what is monitored.

How you know the plan is working

Recovery from tech abuse is about whether the abuser has lost visibility and control. Useful checks, revisited every few weeks with an advocate:

• Knowledge test: does the person still know things they should not (where you were, who you spoke to)? If yes, a route is still open.
• Account review: signed-in device lists on each main account show only your devices, and recovery details are only yours.
• Location and household review: no location sharing with the abuser, no tracker alerts, and every smart device and the car app on accounts you control.

Common failure patterns

• Locking everything at once: changing every password and cutting all sharing in one evening, before the survivor has a safety plan, can provoke escalation. The FTC and Stop Stalkerware both warn about this.
• Searching for help on the monitored phone: the abuser sees the searches and the call to the helpline. Use a safe device.
• Resetting before recording: a factory reset removes stalkerware and the evidence of it.
• Restoring the old backup onto a new phone: this can bring the monitoring app back, and old account settings with it.
• Forgetting recovery details: a new password is useless if the abuser's email address is still the recovery address.
• Fixing the phone but not the house or car: the doorbell, smart speaker or car app is still on the abuser's account and still shows where you are.

Framework mapping

For organisations that support survivors (employers, housing providers, charities), the same steps fit standard security frameworks:

Practitioner checklist

• Contact a domestic abuse or stalking helpline from a device the abuser has never had access to.
• Agree a technology safety plan with an advocate before changing settings.
• List every route: passwords, shared cloud accounts, location sharing, trackers, apps, smart home, phone contract, car.
• Start an incident log and store evidence copies out of the abuser's reach.
• Secure main email, Apple Account or Google account and mobile account first, including recovery details and signed-in devices.
• Use Apple Safety Check (iOS 16 or later) or Google's Manage all devices page, choosing a targeted or emergency approach deliberately.
• Scan for trackers on iPhone or Android and photograph any tracker's details before disabling it.
• Move smart home devices, Wi-Fi, router and car apps to accounts you control.
• Move to a new or factory-reset phone, reinstalling apps from the store, not from a backup.
• Recheck every few weeks: does the abuser still know things they should not?

Standards and references

• US Federal Trade Commission: Stalkerware, What To Know
• Apple: How Safety Check on iPhone works to keep you safe
• Apple: What to do if you get an alert that an AirTag or Find My accessory is with you
• Google: Find unknown trackers (Android unknown tracker alerts)
• Refuge: National Domestic Abuse Helpline
• Refuge: Tech Safety guides
• NNEDV Safety Net Project: Documentation Tips for Survivors of Technology Abuse and Stalking
• Coalition Against Stalkerware: Information for survivors

Related NHI Mgmt Group resources: Spyware and Stalkerware Guide · Location Data Privacy Guide · Smart Home Security Guide · Doxxing Prevention Guide · Hacked Social Media or Email Account Recovery Guide