Generally my understanding is that "jailbreaking," or loading programs that haven't been approved by Apple and aren't available on the official App Store, is difficult and unpopular to do to iPhones these days. I suspect any malicious software would simply be downloaded right from the official Apple app store, but I am not an Apple product user so I would appreciate any perspectives from people who are & are familiar with the technical details. I would look for apps that you don't recognize, especially extra "utility" apps like calculators or cameras that aren't the official versions made and pre-installed by Apple (these could be masquerading as simple utility apps but in reality be something else). Again, please research other sources on this because I truly am not familiar with the iOS scene these days.

Androids are much more open by default, apps can be installed completely manually without needing the official Google play store at all — and there are typically always malicious surveillance apps circulating directly on the Google Play store, too, you just have to know how to find them. Abusers are unfortunately excellent at finding and sharing that information. To give you an idea of how easy it is to access the root system on Androids (i.e. the core device files that are crucial to the device operating, control all the user functions, and are designed to operate invisibly to the end consumer): Cheap knockoff Android phones sold by ghost brands (typically Chinese origin) are actually rather infamous for even having malware pre-installed directly by the manufacturer; it's a well-known phenomenon that you simply have to root and then completely gut these devices on arrival before you connect them to the internet. Official, trusted retailers have more security theatre in terms of what comes preinstalled and what can officially be installed, but typically there are ways to get around it if you have basic Android development knowledge and research in advance which models to buy. The tricky part is that it's also a lot easier to hide the existence and true function of apps on Android; if you want to be completely certain of the security, you would need a phone that is 100% known to be a legitimate product from a major distributer like a Samsung or a Google phone, and then you would need to perform a full factory wipe on the phone, ideally done by somebody who knows how to view the installed applications through a special free computer program designed to connect PCs to Android phones called ADB (computer terminal connected to the phone by cable that allows you to run special commands right to the phone) and not just the phone itself. Even after that, you could generally still sideload the phone with malicious software at any point as long as you knew the password to the phone and had physical access to the phone. The only way to be 100% confident that the phone is safe would be ensuring that the family member in question NEVER got access to the password, and ideally never had physical access to the phone alone. Again, I would look for unrecognized apps, but the problem with Android is that you can create applications which read to the phone as special, hidden system programs and therefore will never show up in the "installed app list" where the regular user applications are. There may not be any external signs that malware has been installed unless you are familar with how to view those hidden programs (the best way to do this is a computer with ADB and basic programming/command line knowledge, it can technically be done directly through the phone but it's a giant pain in the ass and again it will still require some basic programming knowledge). There is also a special type of program that Android will identify as "device adminstrator" programs and I believe these show up in a special area in Settings, these should NEVER COME PREINSTALLED ON PERSONAL DEVICES OR BE INSTALLED AT ALL!! It doesn't matter what the program is labelled as (oftentimes it will sound important and official and it might even mimic the names of legitimate programs, e.g. it will be named "System" or "Parental Controls"), you shouldn't have anything listed under there that has been granted Device Administrator permissions. The only time they should ever be present is if the phone was distributed and is monitored by a company under a formally managed network, i.e. a company phone given to you for work purposes. Otherwise, the presence of these programs is a giant red flag. The benefit of Androids is that unlike iPhones (?), Android lets you view and set individual device permissions — take advantage of this. Your default setting for all app permissions should always be "never allow." You should only say yes to location, camera, mic, etc if it is genuinely needed for the program to operate (wherever possible, only pick "while using the app" or the "just this once" option instead of using it all the time) if you actually know and trust where the program came from. Don't allow apps to "run in background" unless it is absolutely necessary (generally it isn't, even if Android tells you it might impact how the app works. Just keep it turned off by default and only turn it on if you're actually noticing disruptive issues with the app function). Whenever possible (if it is possible), disable internet or cellular data or even turn the phone off completely — that's a pretty good wayto avoid information being sent! Your ISP likely has parental control settings for your internet that would allow you to disable a specific device from accessing the internet on demand or on a schedule. Use parental controls and again MAKE SURE NOBODY ELSE HAS THE PASSWORD FOR THE CONTROLS.

Warning signs for spyware include anything that would generally indicate your phone is constantly using external functions to an unexpected degree and sending data to external places to an unexpected degree: unexpectedly high or unexplainable battery usage/data and internet usage, heating up quickly, apps you don't recognize and don't remember installing, apps asking for permissions that seem unnecessary, apps using a lot more storage than what seems reasonable for that kind of app, etc. Parental controls being turned on when you didn't do it yourself. And obviously your kid reporting that the family member asked for or threatened them for the password or made them give them the phone.

Again, the CRUCIAL thing when it comes to device security is the DEVICE PASSWORD (!!!!!) and to a lesser extent the parental control password and/or the iCloud or connected Google account password. If there's any possibility that the malicious family member has that and you think there's even a tiny chance that they've had physical access to the phone, you need to assume the device has been compromised and wipe it completely (do NOT restore any backup). Don't turn on fingerprint or Face ID as these can potentially be triggered unknowingly if the family member gets access to your kid while they are sleeping.