08/10/2026
Given the nature of a good portion of our business as it relates to Security, we often get called upon to help individuals that have an emergency need as a relates to physical or data security threats
So here is a step-by-step process and course of action that will significantly help you minimize the chances of unauthorized people accessing your information
Especially if there is a protective order and the possibility of unauthorized tracking, I’d treat this as both a physical-security issue and a digital-account/network issue. One important caution: phone apps and consumer RF scanners can generate lots of false positives—cars, TVs, neighbors’ Wi-Fi, smart appliances, key fobs, and legitimate Bluetooth devices can all appear suspicious. Preserve evidence before removing or resetting anything that may matter legally.
Immediate safety and evidence checklist
* If there is an immediate threat or evidence someone has entered the property, prioritize getting somewhere safe and contacting law enforcement rather than conducting the search alone.
* Keep a written incident log: date/time, what happened, screenshots, photographs, device alerts, unusual vehicles/people, and witnesses.
* Screenshot every Apple/Android “unknown tracker” notification before changing anything.
* Photograph suspicious devices in place before touching them. Include wide shots showing location and close-ups showing serial numbers/labels.
* If a suspicious tracker is discovered, consider having law enforcement document/recover it, particularly because there is already a protective order.
* Avoid contacting the suspected person about discoveries unless her attorney/law enforcement advises it.
Secure the accounts first
From a device she reasonably believes is safe:
* Change the primary email password first.
* Change Apple Account/Google Account password.
* Enable two-factor authentication and preferably use an authenticator/passkey rather than SMS where practical.
* Review logged-in devices/sessions and remove anything she doesn’t recognize.
* Check account-recovery phone numbers and email addresses.
* Change cellular-provider account password/PIN and add a port-out/SIM-transfer PIN.
* Review Apple Family Sharing/Google family groups.
* Review Find My/Google location sharing.
* Check Google Maps, Life360, Snapchat and other apps for location sharing.
* Review shared calendars, photo albums and cloud storage.
* Review apps with Always location permission, Bluetooth access, local-network access, microphone/camera access and background activity.
* Remove unknown VPNs, configuration profiles and device-management profiles.
* Change passwords for banking, social media, home-security systems, cameras, smart locks and other important services.
* Don’t reuse any old passwords.
If there is reason to believe the phone itself has been compromised, preserve anything needed as evidence and consider having it professionally examined before factory-resetting it.
Completely rebuild the home Wi-Fi
Don’t merely change the Wi-Fi password if the former spouse may know the router administrator credentials.
1. Photograph/save the existing router configuration and connected-device list if it could have evidentiary value.
2. Factory-reset the router.
3. Update its firmware.
4. Change the router administrator password to a unique password.
5. Create a new Wi-Fi network name (SSID).
6. Create a completely new, long Wi-Fi password.
7. Use WPA3 where supported, otherwise WPA2/WPA3.
8. Disable WPS.
9. Disable remote administration unless specifically needed.
10. Disable UPnP unless there’s a known reason it is required.
11. Verify DNS settings haven’t been changed.
12. Reconnect devices one at a time.
Create an inventory as you reconnect for example:
Device: My Laptop
MAC address: xx:###:###
Owner: Ben
Approved: Y
Anything that appears afterward and cannot be accounted for gets investigated.
I’d also create a separate IoT network for TVs, speakers, thermostats, appliances, etc., leaving computers and phones on the primary network.
Search the house systematically
Don’t rely on one scanner. Use visual inspection + Bluetooth detection + Wi-Fi inventory + RF scanning.
Divide the property into rooms and document each room before moving on.
Pay particular attention to:
* Smoke/CO detectors
* USB chargers and charging blocks
* Power strips
* Alarm clocks
* Lamps/light fixtures
* Air vents
* Thermostats
* Smart speakers
* TVs
* Routers/extenders
* Ethernet equipment
* Cable boxes
* Wall outlets
* Picture frames
* Mirrors
* Decorative objects
* Newly appearing electronics
* Anything plugged into Ethernet
* Anything connected directly to the router
* Exterior outlets
* Garage
* Attic/basement
* Outdoor cameras/lights
An RF detector showing energy does not establish that something is a surveillance device. You’ll see legitimate transmissions from phones, Wi-Fi, Bluetooth, cellular equipment and neighboring properties.
Bluetooth/BLE tracker sweep
Check specifically for AirTags and other Bluetooth trackers.
Use the phone’s built-in unknown-tracker protections first. Search for unfamiliar:
* AirTags
* Find My accessories
* Tile trackers
* Samsung SmartTags
* Bluetooth beacons
* Unknown BLE devices that repeatedly remain physically close as she moves
A particularly useful test is movement correlation: scan at the house, drive somewhere away from the property, scan again, and compare. A device that consistently travels with the vehicle deserves more attention than hundreds of stationary neighborhood signals.
Vehicle inspection
This should be both electronic and physical.
Check:
* OBD-II diagnostic port
* Under dashboard
* Under seats
* Seat pockets
* Glove compartment
* Center console
* Trunk/spare-tire compartment
* Under carpeting
* Behind trim panels
* USB/12V outlets
* Fuse-panel area
* Around the battery
* Trailer wiring
* License-plate area
* Wheel wells
* Bumpers
* Undercarriage
* Magnetic boxes attached underneath
Also have a qualified mechanic inspect the vehicle on a lift. That’s often far more effective than crawling underneath it.
Importantly, check the vehicle’s own connected services. Modern vehicles can expose location through manufacturer accounts/apps even when there is no physical tracker. Change the manufacturer’s account password, remove authorized users/drivers and review connected phones/digital keys.
Cameras and recording devices
A Wi-Fi scan won’t find everything. A camera can record locally to an SD card without transmitting anything.
Physically inspect questionable objects and look for unexplained lenses/openings. At night, a phone camera can sometimes reveal infrared illumination from certain cameras, although not every phone camera detects IR and not every hidden camera uses IR.
Don’t over-focus on RFID
Passive RFID/NFC tags generally aren’t useful for continuously broadcasting someone’s location. They typically need a nearby reader to energize/read them.
For stalking/tracking, I’d prioritize:
Bluetooth/BLE → GPS/cellular trackers → vehicle telematics → account/location sharing → Wi-Fi/IP devices → physical cameras/recorders, rather than spending most of the effort hunting passive RFID tags.
Physical-security reset
Because there’s already a protective order, I would also address access to the property:
* Rekey/change exterior locks where legally appropriate.
* Reset garage-door opener remotes and erase previously paired transmitters.
* Change keypad codes.
* Reset smart locks.
* Change alarm codes.
* Remove old alarm-system users.
* Review camera accounts and sharing permissions.
* Check windows/doors for working locks.
* Add exterior lighting/cameras where appropriate.
* Ensure cameras cover entrances, driveway and vehicle.
* Don’t use security questions whose answers the former spouse knows.
One commonly overlooked item is the garage-door opener: simply taking back a remote doesn’t prevent an already paired remote from continuing to operate it. Clear the opener’s memory and re-pair only approved remotes/keypads.
What I’d recommend professionally
Given the combination of a protective order + repeated tracker alerts + suspected RF devices, this is one situation where a professional TSCM (Technical Surveillance Counter-Measures) sweep can make sense. A competent examiner can distinguish normal RF activity from suspicious transmitters and perform a systematic physical/electronic inspection.
I would structure the work in this order:
Preserve evidence → secure critical accounts → inspect phone/location sharing → reset network → inventory every connected device → Bluetooth/BLE sweep → physical house sweep → vehicle sweep/lift inspection → reset locks/garage/alarm → professional TSCM sweep if unexplained signals remain.
Here is a free printable pdf checklist for you to use
