How to Find Out Who Tried to Unlock Your Android Phone

You picked up your phone and something felt off. Maybe it was face-down when you left it face-up. Maybe the lock screen showed a message about too many attempts. Maybe you just have a feeling.

The question you actually want answered is not was there an attempt — it is who. And that turns out to be a much harder question, because the two are handled by completely different parts of your phone.

What Android tells you by itself

Modern Android has become genuinely good at protecting a device after a failed unlock. Depending on your version and manufacturer, the system can lock down harder after repeated wrong attempts, delay further tries, require your full credential rather than a fingerprint, and make sensitive account changes difficult for someone holding the phone.

All of that is about protecting the device. None of it is about identifying the person.

That distinction is the whole problem. From Android's point of view, a failed unlock is an authentication event: the wrong code went in, so the door stays shut. The system has no reason to care who pressed the keys, so it does not record it.

What you can usually check yourself, without any extra software:

• The lock screen itself. If your phone is enforcing a cooldown or demanding your PIN instead of your fingerprint, something triggered it.
• Your Google account activity. Signing in at your account's security page shows recent device activity and sign-ins. This catches account-level access, not someone poking at your lock screen.
• App last-used times. Digital Wellbeing or your battery/usage screens show when apps were opened. An app you did not open, opened at a time you were not there, is a real signal.
• Notification history. Android can keep a short log of dismissed notifications. Someone clearing alerts to hide their tracks may not know it exists.

These are worth checking. They will often tell you that something happened. They will not hand you a name or a face.

Why the photo is the thing that actually answers the question

A failed unlock attempt is a strangely perfect moment to capture evidence, and it is worth understanding why.

At the instant someone enters the wrong code, they are holding the phone at a comfortable distance, looking directly at the screen, usually in adequate light, with their face square to the front camera. It is, by accident, close to ideal conditions for a portrait. And it happens within seconds or minutes of the phone leaving your control — while the device is still nearby, still on a network, and still able to send something out.

That is why intruder-detection apps exist as a category. They treat the failed unlock not as a door staying shut, but as a trigger: something happened, capture what you can, and get it off the device immediately.

What is worth capturing at that moment:

• A front-camera photo. The one thing that answers "who".
• Time and location. A photo alone shows a face. A photo with coordinates and a timestamp shows a face, a place and a moment — which is what a police report can actually use.
• A short audio clip, where local law permits it. Background noise often tells you more than the image: a vehicle, a crowd, a room.

The critical part is the last step. Evidence that stays on the phone leaves with the phone. It has to be sent somewhere you still control — an email inbox is the practical choice, because you keep it regardless of what happens to the hardware.

Setting it up on your phone

PinGuard is built for exactly this job: it watches for failed unlock attempts and turns each one into a photo, a location and a timestamp delivered to your inbox. Our step-by-step setup walkthrough covers the whole configuration, including a step where you deliberately trigger it so you can see what an alert looks like before you ever need one.

A word on honesty here: no app can identify a stranger for you. What it can do is hand you a photograph, a place and a time — and let you, or the police, take it from there. If the person is someone you know, a photograph usually ends the question immediately.

If it turns out to be someone close to you

This is worth saying plainly, because the searches that lead people to this article are often not about strangers.

If you find that a partner, family member or colleague has been trying to get into your phone, that is a situation about trust and safety, not about technology. Evidence can help you be certain rather than suspicious. It does not tell you what to do next, and it can escalate things. If you feel unsafe, talk to someone you trust before you confront anyone.

The short version

Android tells you that your device defended itself. It does not tell you who it defended itself against. If the "who" matters to you, you need something that treats a failed unlock as a moment to capture evidence — and you need to set it up before the moment arrives, because there is no way to go back and collect it afterwards.