How do they get in?¶

Access in this context is rarely dramatic. It does not usually involve breaking in to anything. It involves using doors that were already open, or that were opened during the relationship and never properly closed.

The access points cluster into a few layers, each with its own risks and its own starting points for protection.

The identity layer¶

This is the highest-risk surface and the right place to start.

Email account recovery is the most common entry point. If someone can access your primary inbox, they can trigger password resets across almost every other service. Recovery options (backup email addresses, phone numbers) set up during the relationship may still point to infrastructure the abuser controls.

SIM swapping and phone number control: mobile providers can be socially engineered into transferring your number to a new SIM. Once they have your number, they receive your verification codes. This is technically possible with enough personal information, much of which an intimate partner already has.

Password reset chains: a sequence of linked accounts where access to one enables access to the next. Email unlocks banking. Banking unlocks identity. Each link is an opportunity.

Because everything else recovers from here, this is the layer to secure first. The reclaim your primary email runbook does it in an order designed not to tip off someone who is watching, and two-factor authentication on that inbox closes the SIM-swap route.

The device layer¶

Physical access is the most direct route to device compromise, and it is often already available in a domestic context.

Stalkerware and monitoring applications can be installed in minutes on an unlocked device. Most are designed to be invisible: they do not appear in the app list, they do not drain the battery noticeably, and many are actively designed to evade detection by security tools. Designed to evade is not the same as undetectable: checking a device for stalkerware covers the safe way to look, and the suspected device compromise playbook covers what to do about a compromised device without alerting whoever installed it. Some abusers use repurposed productivity or parental control apps; others use dedicated commercial stalkerware products.

Devices that were shared, given as gifts, or set up by the abuser may contain pre-installed monitoring or have settings configured to report usage back. Old devices that still hold active sessions or cloud sync connections are a particular risk even after they are no longer in daily use.

Cloud backups syncing silently: photos, messages, contacts, and device backups uploading to a shared or monitored cloud account without any visible indication. A device can be switched and a new account created while years of data continues to flow somewhere accessible.

The account layer¶

Social media accounts carry contact lists, private messages, location check-ins, and the ability to communicate as you to your entire network.

Banking and financial accounts are used for surveillance of spending, blocking access to money, or generating debt. Joint accounts and shared payment methods are particularly difficult to fully separate.

Work accounts are frequently overlooked. If a work email address or calendar was ever accessible, or if login credentials were shared, professional communications and schedules may still be visible.

Shared subscriptions (streaming services, cloud storage, family plans) are easy to forget. Each one is a potential observation point or a lever for disruption. Mapping and unwinding these deliberately, rather than all at once, is what the audit and revoke shared account access playbook is for.

The environment layer¶

Smart home devices: locks, cameras, thermostats, doorbells, smart speakers. Any of these controlled via a shared account or with default credentials that were never changed can continue to be operated remotely after separation. The home becomes observable and manipulable from a distance. Isolating these devices on a separate network, and removing any retained administrator account, limits that reach.

Vehicles increasingly contain connectivity features: GPS history, Bluetooth device logs, and remote access through manufacturer apps. A car set up during a relationship may still be registered to a shared account.

Physical trackers: small Bluetooth tracking devices (AirTags and similar) can be hidden in bags, clothing, or vehicles. They are small, inexpensive, and designed to be unobtrusive. Detection used to require active checking. Since 2024, both iPhone and Android raise an alert when an unknown Bluetooth tracker built to the shared standard, such as an AirTag, has been travelling with you over time, whichever phone you carry. It is a real improvement, but a generic tag or one deliberately put into a silent mode can slip past it, so a physical check still earns its place.

Friends, family members, and mutual contacts can be used as information sources, sometimes without their knowledge. Information shared in group chats, social media posts visible to mutual contacts, or casual conversation passed back through a social network all create exposure.

Employer manipulation is a recognised tactic: false reports, defamatory communications, or pressure applied through professional channels can damage employment or create a situation where the survivor’s credibility is undermined at work.

Platform reporting systems can be abused to get accounts suspended or content removed. Repeated or coordinated false reports can trigger automated platform responses that act against the person being targeted rather than the person making the reports.

Proximity, not sophistication¶

None of these entry points require sophisticated technical skill. They require proximity, patience, and familiarity with someone’s digital habits. That is exactly what an abusive partner has. These are the same surfaces the deanonymisation model describes being used at population scale; here they are turned on one person by someone who already holds the keys.

The goal is not to close every door at once but to know which ones exist, and to start with the ones that count most.

Last reviewed: 2026-07-16.