When mobile data looks wrong, first preserve the evidence, then decide whether you have a usage problem, a device-setting problem, or a possible account incident. Do not reset counters, delete messages, or factory-reset the phone before recording what happened. If service suddenly disappears and you receive an unexpected notice about a SIM change, contact the carrier through a trusted channel immediately.
Open an incident record before changing settings
Write down the exact time you noticed the issue, the affected line and device, the billing-cycle dates, the carrier's total, and the phone's total. Capture per-app usage, system services, active SIM or eSIM, roaming state, background-data controls, Wi-Fi Assist or comparable switching behavior, and any recent operating-system, app, plan, or device change. Save screenshots of alerts and carrier messages, but redact account numbers, one-time codes, and full SIM identifiers from shared notes.
Apple exposes per-app cellular usage and system-service information on iPhone and advises users to check with their carrier for the most accurate current-period total. Google exposes total and per-app data on Pixel and notes that the phone and carrier may measure usage differently. A mismatch is a lead to investigate, not proof of fraud or a broken device.
Classify the incident by observed symptoms
An ordinary usage spike usually still leaves the line working. Look for one app with a large increase, background transfer, tethering, roaming, or a billing-cycle mismatch. A possible account or SIM incident is different: the FTC identifies a sudden loss of service or an unexpected notice that a SIM was activated on a new device as possible signs of a SIM-swap scam. Do not assume every outage is a SIM swap, but escalate those symptoms promptly.
For a usage spike, temporarily restrict the affected app's cellular or background access while preserving the screenshots. For possible SIM or account compromise, call the carrier using a number from its official site, app, or billing statement. Ask it to check recent SIM, eSIM, and number-transfer activity and to secure the account. Use a different trusted device if the phone number may no longer be under your control.
Contain, recover, and watch linked accounts
After the carrier confirms the line is under your control, review the carrier-account PIN or password and the recovery methods on important email, financial, and social accounts. The FTC recommends stronger authentication than text-message codes for accounts that support it, such as an authenticator app or security key. Check for unfamiliar password resets, sign-ins, transfers, or profile changes. Contact the relevant provider directly for anything suspicious.
For a non-security data spike, restore connectivity one app at a time and watch a small, repeatable action. Compare the device's per-app change with the carrier total after its reporting delay. Record what you changed and whether the spike stopped.
Close the incident with evidence, not a guess
A useful closeout names the cause as confirmed, probable, or unknown. Include the time range, affected line, observed symptoms, preserved totals, carrier case number, containment actions, restored settings, and follow-up date. Never label an unexplained spike as theft without evidence. If the cause remains unknown, keep monitoring through the next billing cycle and preserve the record so a repeat event can be compared instead of reconstructed from memory.
Sources
- SIM Swap Scams: How to Protect Yourself — Federal Trade Commission, Oct. 23, 2019
- Use cellular data on your iPhone or iPad — Apple Support
- Reduce and manage mobile data usage — Google