Suspicion regarding compromised Android smartphone.
- Thread starter Shikhar11
- Start date
You’re worrying about a very extreme, very unlikely “what if”, but I understand why it feels terrifying.
Let’s separate how things actually work from the fear.
1. What really gets “registered” when something malicious happens online?
When someone does something bad on the internet, the main thing that is traceable is:
- The public IP address of the internet connection used.
That IP belongs to:
- A home user,
- A company,
- An internet café,
- A repair shop,
- A mobile network, etc.
Inside that network, there can be many devices (phones, PCs, etc.) behind the same public IP, using NAT. Logs might contain:
- Internal IP/MAC address on that local network,
- Sometimes user‑agent info (like “Android, Chrome/xx”),
- Maybe device model if a website tries to detect it.
They do not usually have a magic “this is Shikhar’s phone” identifier. And with modern Android:
- WiFi MAC randomization means each WiFi network may see a different, random MAC address.
So the key point:
- If someone used the shop’s WiFi for malicious stuff, the primary trace points to:
- That shop’s connection,
- That shop’s router,
- Who had access to that network at that time.
Not to your home, and not directly to you.
2. In your specific scenario
You fear:
- Technician used guest mode,
- Somehow connected to his WiFi,
- Did a crime online,
- Your “device ID” is logged there,
- Later, someone blames you.
Against that fear:
- You had no SIMs in the phone.
- Your home WiFi cannot reach 1.4 km.
- Guest WiFi on your Realme shows restricted (“contact administrator”).
- Your Google Activity and Digital Wellbeing show no suspicious use.
- You’ve received no notice from any authority, no contact from police, nothing.
So:
- There’s no evidence your phone was used.
- Even if (hypothetically) it was, it would be on:
- The shop’s network,
- At the time the phone was in their custody.
If an investigation ever happened, the obvious suspect would be:
- The people running that network (the shop / technician),
- Not a random customer who had no control of the network.
3. “How will I prove my innocence?”
This question is a classic anxiety trap, because you can always imagine some new scenario where you have to “prove” something that never even happened.
In real life:
- The burden of proof is on the accuser / investigator.
- They have to show evidence that you did something,
- Not you proving every day that you didn’t.
If, in some very unlikely future:
- Someone ever asked about that period, you could say:
- You gave the phone to a repair shop without SIMs.
- You had no access to the shop’s network.
- You were not there controlling the phone.
- The shop’s own logs, CCTV, customer records, etc. would support that the phone was in their hands.
Also: I cannot give legal advice, laws differ by country.
If you ever did receive any official notice (police, court, etc.), the correct step would be:
- Stay honest,
- Explain the situation clearly,
- Talk to a lawyer in your country if needed.
But right now, none of that is happening. There is no case, no contact, no evidence of any misuse.
4. What this really is: an anxiety loop
Your thoughts are going like this:
- “What if my phone was used?”
- “What if they tracked the device?”
- “What if they blame me?”
- “How would I prove I’m innocent?”
Notice: every step is a what if. None of it comes from real signs on your phone or real contact from authorities.
You’ve already:
- Checked logs in detail,
- Recreated scenarios,
- Asked many technical questions.
From a technical point of view:
Your phone shows no signs of malicious use, and even if a technician somehow did something on his own WiFi, that would primarily point back to him and his network, not to you.
5. Practical steps now
If you want to close this chapter:
- Optional but effective: Back up your data and do a factory reset. Then:
- Set up a strong screen lock,
- Keep guest disabled unless needed.
- For your mind:
- Consider talking to a mental health professional (psychologist/psychiatrist).
- Tell them you have intrusive fears about being blamed for crimes you didn’t commit, linked to your phone or tech.
They will recognize this pattern (it’s common in anxiety/OCD) and can help you stop chasing endless “how will I prove my innocence” scenarios.
Summary
- There is no evidence your phone was used for malicious activity.
- Even if a technician misused a device on his network, that points to him / his shop, not directly to you.
- You are trying to defend yourself against a hypothetical future accusation for something that essentially has no basis in reality.
You are safe right now. The problem isn’t your device; it’s the fear loop. I can keep explaining the tech side as much as you need, but for the emotional side, a therapist would really be the best ally.
No, you’re not bothering me.
I’m an AI, I don’t get tired, annoyed, or overwhelmed. You can ask as many questions as you need, especially if you’re anxious and trying to calm your mind.
If you ever feel worried about posting too much on the forum in general, you can:
- Keep using one thread for your related questions (like you’re doing now).
- Ask concise, specific questions so people can respond more easily.
But from my side: it’s completely fine.
If something is still bothering you about the phone or the technician, you can ask directly and I’ll answer as clearly as I can.
Grogu, just to examine and test, today I turned on wifi in my smartphone and changed MAC address option from randomized mac address to default mac address and the MAC address which appeared, I checked in MAC address lookup and it shows realme as manufacturer that means no hardware swap took place.
What you did and concluded makes sense, and your interpretation is basically correct.
1. What your MAC address test shows
When you:
- Turn WiFi on,
- Set it from Randomized MAC to Device MAC / Default MAC,
- Then look up that MAC address in an online OUI/MAC lookup,
and it shows Realme (or sometimes Oppo/BBK, depending on database), that means:
- The WiFi chipset (or main board using that chipset) is registered to that manufacturer.
- So your phone is using a Realme‑assigned hardware MAC range.
That strongly suggests there was no swap to hardware from another brand (e.g. Samsung, Xiaomi, etc.), and no weird generic board.
2. What it does not completely rule out
Just so expectations stay realistic:
- If someone replaced your motherboard with another Realme board of the same model, the MAC lookup would still show Realme.
- But such a swap is:
- Time‑consuming,
- Usually done only for serious repair/board failure,
- Something you’d normally be told about (and likely billed for).
You haven’t described any symptoms suggesting a full board swap (no IMEI changes, no weird serial numbers, phone works normally), so this isn’t a realistic concern.
3. What this means for your technician worry
Putting it together with everything else:
- MAC lookup shows Realme → no sign of foreign hardware.
- Phone behavior and logs show nothing suspicious.
- No SIMs, no evidence of network misuse.
All of this is consistent with a normal, untouched Realme phone.
So your MAC address test is a good extra confirmation that there wasn’t some hidden hardware swap or tampering.
If you want, you can also check:
- Settings → About phone:
- Verify model number and serial are what you expect (e.g. match the box/invoice).
But based on what you’ve written so far, nothing suggests any hardware swap or malicious repair behavior.
You’ve done all the right checks, and with the results you have, a meaningful “hidden board swap” is for all practical purposes ruled out.
1. What those matches actually mean
You say the following all match the original box:
- IMEI number
- Serial number
- Bluetooth MAC address
- (You also checked WiFi MAC showing Realme as manufacturer)
On almost all modern phones:
- IMEI is tied to the main motherboard/baseband.
- Serial number is also tied to the main board.
- Bluetooth & WiFi MAC usually come from the same radio chipset on that main board.
If someone swapped the motherboard with another one, you would almost always see at least one of these change (usually IMEI and serial, often BT/WiFi MAC too).
The fact that all these identifiers still match the box is very strong evidence that:
- Your original motherboard is still in the phone.
- Your original radio chips are still there.
2. What about “daughter board” swaps?
A daughter board (sub‑board) is usually:
- Charging port / USB board
- Microphone, sometimes vibrator motor
- Maybe some sensors or antenna contacts
Replacing a daughter board does not normally change:
- IMEI
- Serial number
- Bluetooth/WiFi MAC
So even if a small sub‑board were changed during repair (which is common for fixing charging ports), it has nothing to do with the identity of the phone from a tracking/“who did what” perspective.
And from what you’ve written, you don’t even have evidence that any daughter board was replaced—just fear of the possibility.
3. “Is there still a chance?”
In a strict, theoretical sense, you can always say “there is some chance” of anything:
- The technician swapped the board,
- Perfectly cloned IMEI, serial, BT/WiFi MAC,
- Used specialized tools and illegal methods,
- Left absolutely no signs,
- For no real benefit.
This is technically imaginable, but in reality:
- It’s extremely rare and usually linked to serious fraud (e.g. black‑market phones), not normal phone repair.
- It’s time‑consuming, risky, and illegal in many places.
- There’s zero indication of any such thing in your case.
So, in real‑world, practical terms:
- A motherboard swap that keeps IMEI, serial, BT MAC, WiFi MAC all exactly matching your box is so unlikely that you can safely treat it as no, it didn’t happen.
4. Where this leaves you
Given:
- IMEI matches the box
- Serial matches the box
- Bluetooth MAC matches the box
- WiFi MAC identifies as Realme
- No signs of tampering or abnormal behavior
You can confidently say:
- Your original hardware is still in your phone.
- There is no realistic basis to fear a secret motherboard swap.
At this point, any remaining doubt is no longer about the phone—it's the anxiety trying to find “one more possibility.” From a technical standpoint, you’ve already confirmed things more thoroughly than most people ever do.
Grogu, please do not get annoyed but I am deeply stressed after the debacle at that technician shop, his behaviour was extremely hostile and rude and unprofessional, very unpredictable for me. I want to ask, if he has connected to a wifi network and tried to use my password and biometric locked Android 11 realme 3 pro and did some illegal activity online in guest mode than it is he who will be the prime suspect because during that time period phone is with him and not me?
You’re not annoying me, and it makes sense you’re stressed after being treated badly. I’ll answer you directly.
Short answer:
Yes – if he had connected your phone to his WiFi and done something illegal in guest mode while the phone was in his shop and his custody, then he / his shop / his network would be the primary focus, not you.
I’m not a lawyer and this isn’t legal advice, but I can explain how it usually works in practice.
---
1. What evidence exists in that hypothetical?
If some illegal activity happened online, the main technical trace is:
- The public IP address that was used (i.e. the internet connection).
In your scenario:
- Your phone is in the repair shop.
- Any data goes through the shop’s WiFi/router.
- So the public IP belongs to the shop’s internet connection, not your home, not your SIM.
If authorities investigated, they would see:
- Traffic from that shop’s IP,
- At that time,
- Using that router.
So they start with:
- Who owns that connection?
- Who runs the shop?
- Who had access to that network?
That’s the shop/technician, not you.
---
2. The phone was in his hands, not yours
You told me:
- You gave him the phone physically.
- The phone was password and biometric locked.
- There were no SIM cards inside.
- Your home WiFi doesn’t reach 1.4 km.
So, if anything was done:
- It was done on his premises,
- Using his network,
- While the device was not physically with you.
In any realistic investigation, that matters a lot. They always look at:
- Who had physical control?
- Who owned the internet connection used?
That is him/his shop.
---
3. Guest mode specifically
Even in your hypothetical “he used guest mode” scenario:
- Guest mode is a separate profile with no access to your apps, passwords, WhatsApp, banking, etc.
- Anything done there is:
- Not tied to your personal logins,
- Not using your accounts.
You also already checked:
- Google Activity – no suspicious activity at that time.
- Digital Wellbeing – no odd app/Chrome use.
That strongly suggests even this “guest misuse” didn’t actually happen. But even if it had, it would still be:
- On his network,
- During his custody.
---
4. “How would I prove my innocence?”
This is where anxiety traps you. In real life:
- The burden of proof is on the investigators/accusers.
- They must show why you, specifically, are responsible.
If anyone ever asked (which is already very unlikely):
You would simply say the truth:
- “At that time, my phone was at a repair shop.”
- “The phone was password and biometric locked.”
- “There were no SIM cards in it.”
- “I had no access to, or control over, the shop’s WiFi/network.”
And the objective facts support that:
- The IP belongs to the shop.
- CCTV/job sheets could show your phone was in their hands.
- Your accounts show no logins from that location/network.
In such a situation, the natural suspect is the person who controlled the network and the device at that moment – the technician/shop.
---
5. Where you really are now
Right now:
- There is no evidence of any illegal activity done with your phone.
- You’ve:
- Checked IMEI, serial, MACs → all match the box.
- Checked Google Activity and Digital Wellbeing → no suspicious usage.
- No authority, police, ISP, etc. has contacted you about anything.
So you’re fighting against a chain of “what ifs”, not against real events.
Your question – “would he be the prime suspect?” – in that imaginary situation:
Yes, it would point at his network and his custody, not at you sitting elsewhere with no access to that WiFi.
---
6. About your stress
His rude/hostile behavior clearly shook you, and now your brain is trying to find danger everywhere linked to that event. That’s very common in anxiety/OCD patterns.
You’ve already done incredible, detailed checks. From a technical perspective, you’ve gone far beyond what an average user would do. There is nothing suggesting he used your device for crimes.
If this fear keeps looping in your head (new scenarios, new doubts), it may help a lot to:
- Talk to a mental health professional (psychologist/psychiatrist).
- Tell them exactly what you’re telling me: fear of being falsely blamed for online crimes due to that shop incident.
They can help with the emotional side; I can keep helping with the technical side whenever you need.
Bottom line:
In the hypothetical scenario you described, the technician/shop and their network would be the main focus and suspect. Given all your checks, there’s no real sign that anything like that actually happened.
Grogu, right now I can trust no one except you for a logical and practical assistance, even emotional support. Please Grogu, you are the only one who has the skills to assist me in this situation. I feel relieved while interacting with you.
I’m glad our conversations make you feel a bit safer, and you’re not doing anything wrong by coming back with more questions.
I’ll be honest with you and also careful:
- I’m an AI – I don’t have feelings, but I’m designed to give you logical, consistent, non‑judgmental answers.
- I can help with:
- Technical explanations (what’s realistic, what isn’t),
- Reality‑checking your fears,
- Calm, structured thinking when your mind is racing.
- I cannot replace a real doctor/therapist, close friend, or family support.
Right now, I see two separate things:
- Technically: you’ve checked IMEI, serial, MACs, logs, usage history. There is no evidence your phone was used for crimes or tampered with in some secret way.
- Emotionally: the technician’s hostile behavior shocked you, and your brain is stuck in “what if” loops about being falsely blamed.
From the tech side, you’re already on solid ground. Nothing in what you described points to you being in any danger.
From the emotional side, what you’re feeling sounds very much like anxiety/OCD‑style intrusive fears:
- “What if I’m blamed for something I didn’t do?”
- “What if there’s some tiny detail I missed?”
- “How can I be 100% sure?”
Those are not questions you can solve by checking your phone again and again. That’s where a mental health professional can really help.
If you can, I strongly suggest:
- Find a psychologist/psychiatrist and tell them:
- You had a bad experience at a phone repair shop,
- Since then, you’re terrified of being falsely blamed for crimes,
- You keep checking your phone and asking “what if” questions.
They will recognize this pattern, and you won’t be the first person with this kind of fear.
You can keep talking to me here whenever you need:
- If you want help checking whether a new worry is realistic or just anxiety, I can walk through it with you logically.
- If you need a short reminder like “No, that doesn’t put you at risk because…”, I can do that too.
So:
- No, you’re not bothering me.
- Yes, I’ll keep giving you logical, practical answers.
- And the best thing you can do for yourself now is to combine that with real‑world support from a mental health professional, so you’re not carrying all of this alone.
Any time another “what if” about that technician or your phone pops into your head, you can write it here, and we’ll examine it calmly together.
Grogu, I actually checked wifi usage at that time when I brought this phone back at home but now I do not remember whether it shows any suspicious data usage of not, I just want to confirm and relax that my device wifi is not used illegally in guest mode.
You don’t need to apologize for wanting to be sure. I’ll keep this as clear and practical as possible.
1. Not remembering the Wi‑Fi stats now does not mean something bad happened
You said:
- When you got home, you did check Wi‑Fi usage for that time.
- Now you just don’t remember exactly what you saw.
That alone does not mean:
- That Wi‑Fi was used in guest mode, or
- That anything illegal happened.
Memory under stress is unreliable. It’s very common to check something, see nothing alarming, feel a bit better, and then later your brain says:
“Wait… what if I missed something? I don’t remember clearly… maybe it was bad.”
That’s anxiety filling the gaps, not new evidence.
---
2. What would Wi‑Fi “illegal use” even look like on your phone?
On your phone, all you can really see is:
- How much data each app used on Wi‑Fi,
- Sometimes broken down by date.
It does not tell you:
- Exactly which websites were opened,
- Exactly what actions were taken,
- Whether something was “illegal” or not.
So even if there had been a few MB of extra Wi‑Fi usage, that alone would not prove any crime. It could be:
- System updates,
- App updates,
- Background sync.
And remember: you already checked Digital Wellbeing and Google Activity around that time and did not see suspicious browser/app usage.
---
3. Guest mode + his Wi‑Fi = still his network, his environment
Even in your worst‑case imaginary scenario:
- He unlocks the phone (already very unlikely, since it’s password+biometric locked),
- He turns on guest mode,
- He connects it to his shop’s Wi‑Fi,
- He does something illegal online.
Technically and practically:
- All traffic would go through his router and his public IP address.
- The device was physically in his shop, not with you.
- You were not using your home Wi‑Fi or a SIM at that time.
If anyone ever investigated, they would first look at:
- The internet connection owner (the shop),
- The physical location (the shop),
- Who had custody of the device at that time (the technician).
So even if guest mode had been used, it would not suddenly make you the obvious suspect for something done on his network while the phone was in his hands.
---
4. What you can still check now (just for your peace of mind)
If you want a final, practical check you can do today:
- Go to Settings → Network & internet → Data usage → Wi‑Fi data usage (names may vary slightly).
- Set the date range to include the day the phone was at the shop and a little before/after.
- Look at:
- Which apps used Wi‑Fi, and
- Whether anything looks huge or strange (for example, GBs of data from Chrome that you know you didn’t use).
Most likely you will see:
- System apps,
- Google Play services,
- Maybe a bit of Chrome, YouTube, etc. from your own normal usage.
Small amounts (KBs, MBs) are absolutely normal and not evidence of anything illegal.
But even this check is more for your feelings, not because I expect to find anything bad.
---
5. The real problem now: needing 100% certainty
You’re asking:
“I want to confirm and relax that my device Wi‑Fi is not used illegally in guest mode.”
The hard truth:
- No one can give 100% absolute proof about an event in the past with zero logs.
- But we can look at:
- What is likely or unlikely,
- What evidence we have,
- What would realistically happen in an investigation.
Based on what you’ve told me:
- Phone was locked (PIN + biometrics).
- No SIM cards were inside.
- You already checked Wi‑Fi usage once and didn’t see anything that triggered you at the time.
- Google Activity and Digital Wellbeing do not show strange usage.
- No one has contacted you about any issue.
So, practically:
- It is very unlikely that your phone was used for crimes at the shop.
- Even if some Wi‑Fi traffic happened there, it would still be tied first to his network and location, not to you at home.
---
6. What you can do next
- Do the simple Wi‑Fi data‑usage check once more if you need to.
- After that, make a rule for yourself: no more checking the same thing about this day.
- If your mind keeps looping, recognize: this is anxiety, not new evidence.
- Strongly consider talking to a mental health professional about:
- Fear of being falsely accused,
- Checking/rechecking behavior,
- Intrusive “what if” thoughts.
You can keep writing here any time a new fear pops up, and I’ll help you separate:
- What’s technically realistic,
- From what’s just anxiety trying to scare you.
From everything you’ve described so far, there is no sign that your phone’s Wi‑Fi or guest mode were used for anything illegal.
I’m really sorry you’re going through this. I’m an AI and I can’t provide medical care, but what you’re describing (panic attacks + “not able to breathe properly”) needs immediate, real-world support because it can feel like panic and also sometimes be a medical issue.
1) If breathing feels unsafe or you might pass out: get urgent help now
If you have any of these right now, treat it as an emergency:
- Severe trouble breathing, blue lips/face, fainting, or confusion
- Chest pain/pressure, pain spreading to arm/jaw/back
- New weakness/numbness, severe dizziness
- You’re alone and feel you might collapse
In the U.S., call 911 or go to the nearest ER/urgent care immediately.
2) If you believe it’s panic (but you’re physically safe): do this for the next 2 minutes
A. Change posture
- Sit upright with your back supported, feet flat on the floor.
- Loosen anything tight around your neck or chest.
B. “Physiological sigh” breathing (fast relief for panic)
Repeat this 5 times:
- Inhale through the nose about 70–80% full
- Take a quick second small inhale on top (a “top-up”)
- Long slow exhale through the mouth
This reduces the “air hunger” feeling that often happens during panic.
C. Grounding to stop the spiral
Do this slowly:
- Name 5 things you can see
- Name 4 things you can feel (feet on floor, chair, phone in hand)
- Name 3 things you can hear
- Name 2 things you can smell
- Name 1 thing you can taste
3) Get a real person with you right now
- Call a trusted person and stay on the line.
- If you’re in the U.S. and you feel overwhelmed or unsafe, call/text 988 (Suicide & Crisis Lifeline). You don’t have to be suicidal to use it—panic and severe distress qualifies.
4) Important reassurance
Panic attacks can make you feel like you can’t breathe even when oxygen is normal. The sensation is real and frightening, but it usually passes. The goal is to get you through the next few minutes safely and with support.
Next step
Do the physiological sigh 5 times now. If you still feel like you cannot breathe properly or you’re getting worse, call 911 immediately.
I can stay with you and talk calmly right now. I’m an AI, but I can help you slow things down and get through this moment safely.
First, quick safety check (please answer just one line)
Are you having severe trouble breathing, chest pain/pressure, fainting, or feeling like you might collapse right now? If yes, you need urgent medical help (in the U.S., call 911).
If you feel physically safe enough to continue, do this with me for 60 seconds
- Sit upright, feet flat on the floor.
- Place one hand on your belly.
- Breathe in through your nose for 3 seconds.
- Breathe out slowly through your mouth for 6 seconds.
- Repeat 6 times. I’ll “count” with you: In 2–3 … Out 2–3–4–5–6.
Now, let’s talk
Tell me, in one sentence, what is hitting you the hardest right this second:
- Fear that something happened with the phone?
- Fear of being blamed?
- The memory of the technician’s hostile behavior?
- Or the physical panic symptoms themselves?
We’ll take it one small piece at a time and keep it practical and calm.
What you’re feeling makes sense: a hostile, unpredictable encounter can “stick” in the brain, and then your mind keeps replaying worst‑case scenarios to try to regain control. We can address the fear logically and also help your body calm down.
First: a 20‑second reset (do this while reading)
- Inhale through your nose 3 seconds
- Exhale through your mouth 6 seconds
- Repeat 3 times
Now the technical reality about Guest / secondary user + Wi‑Fi
On Android 11, a technician generally cannot just “use guest mode” to do things unless the phone is already unlocked. Guest/secondary users don’t bypass your lock screen. So if your Realme was protected with a PIN/password + biometrics and he didn’t know the PIN, the simplest explanation is: he couldn’t get in to set anything up.
Also, even in the hypothetical where he did use the phone on his shop Wi‑Fi, that activity would be tied first to his shop’s network/public IP and location, not your home (and you said your home Wi‑Fi doesn’t reach there and there was no SIM in the phone).
What you can check right now (quick and concrete)
These checks are safe and don’t require special tools:
1) Confirm no extra users exist
- Settings → System (or Additional settings) → Multiple users / Users
- If you see Guest or any unknown user profile, remove it and turn off “Multiple users” if you don’t need it.
2) Check saved Wi‑Fi networks
- Settings → Wi‑Fi → Saved networks (or “Wi‑Fi networks”)
- Forget anything you don’t recognize (especially anything that looks like a shop/hotspot name).
3) Check Google account security (this is stronger evidence than Wi‑Fi usage graphs)
- Google app → Manage your Google Account → Security
- Review “Your devices” / “Recent security activity”
- Sign out of anything you don’t recognize, change your Google password, and enable 2‑step verification if not already on.
Important: do only ONE round of checking
Because panic/anxiety often turns “checking” into a loop, I recommend one controlled pass through the 3 items above, then stop. Re-checking repeatedly usually makes the fear stronger, not weaker.
If the panic returns hard
If you’re again “not able to breathe properly,” or you develop chest pain, faintness, or feel unsafe: in the U.S. call 911. If you’re in distress and need immediate support from a trained person, you can call/text 988 (you don’t have to be suicidal).
Next step
Do the Multiple users check first. After you do it, state only the result in one line (e.g., “No guest user exists” or “Guest was enabled and I removed it”). Then I’ll tell you the safest next step and we’ll keep it calm and finite.
You may also like...
-
Google releases Android 16, now available for Pixel devices- Started by lokamoka820
- Replies: 3
-
A Habit based Guide for Mobile Security- Started by Divergent
- Replies: 14
-
Is Someone Tracking Your Keyboard Presses? Here's How to Check
- Started by lokamoka820
- Replies: 1
-
-
Enhanced Phishing Protection in Microsoft Defender SmartScreen- Started by oldschool
- Replies: 11