How do they get in?¶

Access in this context is rarely dramatic. It does not usually involve breaking in to anything. It involves using doors that were already open, or that were opened during the relationship and never properly closed.

The following layers describe where those access points tend to be. Each layer has its own risks and its own starting points for protection.

The identity layer¶

This is the highest-risk surface and the right place to start.

Email account recovery is the most common entry point. If someone can access your primary inbox, they can trigger password resets across almost every other service. Recovery options (backup email addresses, phone numbers) set up during the relationship may still point to infrastructure the abuser controls.

SIM swapping and phone number control: mobile providers can be socially engineered into transferring your number to a new SIM. Once they have your number, they receive your verification codes. This is technically possible with enough personal information, much of which an intimate partner already has.

Password reset chains: a sequence of linked accounts where access to one enables access to the next. Email unlocks banking. Banking unlocks identity. Each link is an opportunity.

The device layer¶

Physical access is the most direct route to device compromise, and it is often already available in a domestic context.

Stalkerware and monitoring applications can be installed in minutes on an unlocked device. Most are designed to be invisible: they do not appear in the app list, they do not drain the battery noticeably, and many are actively designed to evade detection by security tools. Some abusers use repurposed productivity or parental control apps; others use dedicated commercial stalkerware products.

Devices that were shared, given as gifts, or set up by the abuser may contain pre-installed monitoring or have settings configured to report usage back. Old devices that still hold active sessions or cloud sync connections are a particular risk even after they are no longer in daily use.

Cloud backups syncing silently: photos, messages, contacts, and device backups uploading to a shared or monitored cloud account without any visible indication. A device can be switched and a new account created while years of data continues to flow somewhere accessible.

The account layer¶

Social media accounts carry contact lists, private messages, location check-ins, and the ability to communicate as you to your entire network.

Banking and financial accounts are used for surveillance of spending, blocking access to money, or generating debt. Joint accounts and shared payment methods are particularly difficult to fully separate.

Work accounts are frequently overlooked. If a work email address or calendar was ever accessible, or if login credentials were shared, professional communications and schedules may still be visible.

Shared subscriptions (streaming services, cloud storage, family plans) are easy to forget. Each one is a potential observation point or a lever for disruption.

The environment layer¶

Smart home devices: locks, cameras, thermostats, doorbells, smart speakers. Any of these controlled via a shared account or with default credentials that were never changed can continue to be operated remotely after separation. The home becomes observable and manipulable from a distance.

Vehicles increasingly contain connectivity features: GPS history, Bluetooth device logs, and remote access through manufacturer apps. A car set up during a relationship may still be registered to a shared account.

Physical trackers: small Bluetooth tracking devices (AirTags and similar) can be hidden in bags, clothing, or vehicles. They are small, inexpensive, and designed to be unobtrusive. Detection requires active checking; they are not visible to the naked eye.

The social layer¶

Friends, family members, and mutual contacts can be used as information sources, sometimes without their knowledge. Information shared in group chats, social media posts visible to mutual contacts, or casual conversation passed back through a social network all create exposure.

Employer manipulation is a recognised tactic: false reports, defamatory communications, or pressure applied through professional channels can damage employment or create a situation where the survivor’s credibility is undermined at work.

Platform reporting systems can be abused to get accounts suspended or content removed. Repeated or coordinated false reports can trigger automated platform responses that act against the person being targeted rather than the person making the reports.

A word on this section¶

None of these entry points require sophisticated technical skill. They require proximity, patience, and familiarity with someone’s digital habits. That is exactly what an abusive partner has.

Recognising the surfaces is the first step. The goal is not to close every door at once but to know which ones exist, and to start with the ones that matter most.