How to find a hidden GPS tracker or bug with an RF scanner

If you think someone may be tracking your car or listening in on a room, a radio scan can help. Many tracking and listening devices have to transmit to be useful, and a transmitter shows up on a spectrum analyzer. This guide explains which devices transmit, when and on which frequencies, how to check a car or a room step by step by radio and by eye, how to use your phone's own tracker alerts, what to do if you find something, and what a radio sweep can't tell you.

If you're worried about your safety, talk to someone first. In the US, the National Domestic Violence Hotline is 1-800-799-7233 (or text START to 88788), and you can call 911 in an emergency. Advocates can help you decide whether and when to remove a device, because removing it can alert the person who placed it.

Think about safety before you search

Searching for a tracker is not just a technical job. If someone has gone to the trouble of hiding a device, finding or removing it can change how they behave. They may notice that the location updates have stopped, or that the device has moved to a police station. For some people that is fine. For others it raises the risk. That is why the callout above comes first.

A few points to weigh before you start:

• Search somewhere safe. Check the car in a place where you are not being watched and can leave easily, such as a busy car park in daylight or a trusted friend's driveway.
• Think about what you will do if you find something. Have a plan before you look. The section "What to do if you find a device", later in this guide, covers the options.
• Your phone and accounts may be the tracker. A hidden box is only one way to follow someone. Location sharing in a family app, a shared Apple or Google account, a car maker's connected app that shows where the car is, or software installed on your phone can all reveal your location without any extra hardware. A radio sweep of the car can't see any of these. Advocates at the hotline can help you think through phone and account safety too.
• Keep notes from the start. Write down why you are suspicious: someone knew where you were when they shouldn't have, turned up at places you went, or mentioned details of your trips. Dates and times matter later.

How a tracking device works: locate, store, report

Almost every location tracker does three jobs. Understanding them tells you which ones a radio can find.

1. Locate. The device works out where it is, usually by listening to GPS and other satellite navigation signals. Some also use nearby cell towers or Wi-Fi networks to estimate position. Listening doesn't produce any radio signal you can detect.
2. Store. It keeps the positions in memory, sometimes for weeks.
3. Report. It sends the positions to whoever placed it. This is the only step that needs a transmitter, and it is the step a spectrum analyzer can see.

A device that skips the report step, and simply stores positions until someone retrieves it, is invisible to radio. A device that reports over the phone network transmits on cellular bands. A Bluetooth item tracker such as an AirTag doesn't report directly at all; it broadcasts a short Bluetooth signal and relies on strangers' phones nearby to pass its location on. Each of these leaves a different trace, and needs a different search.

Types of tracking and listening devices

The table gives the overview. The sections after it explain each type in more detail.

Real-time cellular GPS trackers

These are the devices most people mean by "a GPS tracker". A small box, often in a magnetic case, holds a satellite navigation receiver, a cellular modem, a SIM or embedded SIM, and a battery. It works out its position, then sends it over the mobile network to a server, where whoever placed it watches it on an app or website. Battery models last from days to months depending on how often they report. Some are wired to the car's power so they never run flat.

When it reports, the tracker behaves like a very quiet phone. It transmits on the same uplink bands a phone uses to talk to a tower, in short bursts. Between reports it is silent, so you will only see it if you are recording at the right moment.

Bluetooth item trackers

Apple AirTags, Tile trackers and Samsung SmartTags are designed for finding keys and bags. They have no GPS and no cellular modem. Instead, they broadcast a short Bluetooth Low Energy signal. Phones belonging to strangers that pass nearby pick up the broadcast and report the tracker's approximate location to the maker's network, without their owners seeing anything. Because there are so many phones around, this can follow a car through a city surprisingly well.

The broadcasts are very low power and very short. They use the three Bluetooth Low Energy advertising channels, at 2402, 2426 and 2480 MHz, inside the 2400–2483.5 MHz band. On a spectrum display they look like brief, faint flickers. In any place with phones, earbuds, watches and Wi-Fi, the 2.4 GHz band is crowded, so picking out one tracker by radio is hard. Your phone's tracker alerts, covered below, are designed for exactly this job and are usually the better tool. AirTags also contain an ultra-wideband radio for precision finding, which works above the 6 GHz upper limit of the HackRF One, so you won't see that part.

GPS loggers

A logger records its route to memory and has no transmitter. Someone has to fetch it, or plug it in, to read the trips. It produces no radio signal at all, so no RF sweep can find it. The only way to find a logger is to look for it. If your suspicions involve someone who has regular physical access to your car, keep this in mind: a clean radio sweep doesn't rule out a logger.

OBD-II plug-in trackers

Every car and light truck sold in the US since the 1996 model year has an OBD-II diagnostic port, usually under the dashboard on the driver's side, near the steering column. Plug-in trackers take power from this port, so they never need charging. Many are sold openly for fleets, young drivers, and usage-based insurance. Some insurance and "connected car" dongles are cellular and report regularly; some use Bluetooth to talk to an app on a phone. A small box in the OBD-II port that you didn't put there is the easiest tracker to find in the whole car. Note that some legitimate dongles may have been fitted by you, a previous owner, a dealer or an insurer.

Hard-wired fleet telematics

Company vehicles, rentals, financed cars and some used cars contain telematics boxes wired into the car's power, often behind the dashboard or in the trim. They can report frequently and indefinitely. Many newer cars also have a built-in cellular modem from the manufacturer for emergency calls, remote unlocking and a phone app. These transmit on the same bands as a hidden tracker. Before treating a strong, regular cellular signal as suspicious, find out whether the car has connected services, and who has access to the account that controls them.

Cellular audio bugs

A cellular bug contains a SIM and a microphone. Depending on the design, it may call a set number when it hears sound, answer when called, or stream audio over a data connection. They are sometimes hidden inside things that are normally plugged in, such as power adaptors, phone chargers or power strips, so they have a constant supply. While idle, one may barely transmit. While sending audio, it transmits continuously on a cellular uplink band, which is far easier to see than a tracker's short bursts.

Analog VHF and UHF bugs

The simplest bugs are tiny radio transmitters that broadcast audio continuously, somewhere in the VHF or UHF range. Some cheap ones transmit inside or near the FM broadcast band, 88–108 MHz, so an ordinary radio can pick them up. These are old technology, but they are cheap and still sold. Because they transmit all the time, they show as a steady carrier: a narrow line that stays on the display continuously. That makes them the easiest bug to see by radio, if you are looking in the right part of the spectrum.

Wi-Fi and IP cameras

Modern hidden cameras are usually Wi-Fi cameras built into clocks, smoke-alarm lookalikes, chargers, picture frames and similar objects. They join a Wi-Fi network, or create their own, and stream video to an app. Streaming video is a lot of data, so a camera sending live video makes busy Wi-Fi traffic at 2.4 GHz or 5 GHz. Some cheaper wireless cameras use analog video transmitters, commonly in the 2.4 GHz or 5.8 GHz bands, which appear as a wide, constant block of signal. A camera that only records to a memory card transmits nothing.

Bluetooth audio devices

Bluetooth can carry audio over short distances. A hidden device would need a receiver fairly close by, which limits how it can be used, but it is possible. Classic Bluetooth hops quickly across 79 channels, each 1 MHz wide, between 2402 and 2480 MHz. On a spectrum display this looks like scattered short bursts across the whole 2.4 GHz band, which is hard to tell apart from earbuds and speakers. Checking the Bluetooth device list on your phone, and looking physically, are often more useful.

The 2G sunset, LTE-M and NB-IoT

Older and cheaper trackers and "GSM bugs" used 2G GSM networks. In the US, the major carriers have shut down their 2G and 3G networks, so devices that rely only on 2G may no longer work here, even though some are still sold online. Current trackers use 4G LTE and two low-power versions of it designed for small battery devices:

• LTE-M (also called LTE Cat-M1) uses a narrow slice of an LTE channel, about 1.4 MHz wide. It supports moving devices and modest data rates.
• NB-IoT (narrowband IoT) uses an even narrower slice, about 180 kHz wide, and sends very small amounts of data.

Both run inside ordinary LTE bands, often the 700 MHz and 850 MHz bands because lower frequencies reach further and get into buildings better. Both also have power-saving features, called PSM (power saving mode) and eDRX (extended discontinuous reception), that let a device go silent for long periods between reports. For you, this means two things. First, the signal you are looking for is narrow and short, not a big block. Second, the device may be silent for most of the time you are recording. Patience matters more than sensitivity.

Reporting intervals and motion wake-up

How often a tracker transmits decides how long you need to record. Most trackers let the person who placed them choose the interval in an app. Common settings run from every few seconds, which drains the battery fast, to once every few hours, or once a day.

Many trackers also have an accelerometer that senses movement. A common pattern is:

• While moving: report often, for example every 10 seconds to every few minutes, so the route can be followed live.
• Shortly after stopping: send a final position, then go to sleep.
• While parked: report rarely, perhaps once an hour or once a day, or not at all until it feels movement again.

Here is a worked example of why this matters. Suppose a tracker reports every two minutes while moving and once every six hours while parked. You park, wait ten minutes, and record for fifteen minutes. The tracker sent its last report a minute after you stopped. Your recording catches nothing, and you might wrongly conclude the car is clean. Now suppose you then drive for ten minutes and record while driving and for a few minutes after. The tracker wakes when the car moves and sends five reports while you drive, plus one when you stop. That is why this guide asks you to record both parked and moving, and to repeat the check on another day.

Where to look on the spectrum

A tracker or bug that reports over the phone network transmits on the uplink bands, the frequencies phones use to talk to towers. Towers transmit on the matching downlink bands all the time, so the downlink is always busy and tells you nothing about a hidden device. Look at the uplink.

Some newer bands, such as band 41 around 2.5 GHz and the 3.5–4 GHz 5G bands, use time division: the phone and the tower take turns on the same frequencies. You can't separate uplink from downlink by frequency there, so those bands are less useful for a tracker search. Low-power trackers rarely depend on them anyway. For more on the bands, see 5G frequency bands explained, and for where the towers themselves are, see how to find cell towers near you.

Other ranges worth knowing:

• 2400–2483.5 MHz: Bluetooth trackers and audio devices, and 2.4 GHz Wi-Fi.
• About 5150–5850 MHz: 5 GHz Wi-Fi, including many cameras. The 5725–5850 MHz part is also popular for analog video transmitters.
• VHF and UHF, roughly 30 MHz–1 GHz: analog audio bugs and wireless microphones.
• 1575.42 MHz (GPS L1): receive-only. The signal comes from satellites. A tracker listens to it and uses a different radio to report. You will not find a tracker by looking here.

Your car is also full of legitimate low-power radios. In the US, tyre pressure sensors and key fobs commonly use around 315 MHz, and some use 433 MHz. These send short bursts, especially when the car moves or you press a button. They are normal.

What you need, and which range to use

For a radio sweep with Consentiva you need a HackRF One, a compatible Android phone running Chrome, and a cable to connect them. Setup is covered in HackRF One and Android setup. If you're new to the display itself, read what is a spectrum analyzer first.

Pick the range preset that covers the devices you're worried about:

The Free plan records from 30 MHz to 2.7 GHz, but its analysis is locked, so you won't get "unusual" flags, and recordings are kept for seven days. Standard covers up to 2.7 GHz; Full covers up to 6 GHz, which you need for 5 GHz Wi-Fi and 5.8 GHz video. Details are on the plans page.

A narrower range sweeps faster. A faster sweep revisits each frequency more often, which gives you a better chance of catching a short burst. If your main worry is a car tracker, the Common preset is a good balance.

Two receiver facts matter here. The HackRF has an 8-bit ADC, so very strong signals close to the antenna can overload it and create false signals elsewhere on the display. Keep the antenna away from your own phone and other transmitters. Its maximum safe input is low (the maker specifies −5 dBm), which ordinary signals in a car or room won't approach, but don't connect it directly to a transmitter. Levels are shown in uncalibrated dBFS unless you enter a calibration offset; for a search like this, what matters is how a signal compares with the background, not its exact level. RF units explained covers dBFS and dBm.

Reading what you see

Different devices leave different shapes on the display. Learning these saves a lot of false alarms.

Consentiva helps by learning a baseline for each block of about 150 metres, separately for night, morning, afternoon and evening, and flagging signals stronger than that baseline as "unusual". When you park in one place and record over time, the recording builds a picture of what is normal there, and a burst that rises above it is flagged. Unusual doesn't mean suspicious. It means "different from what this place usually looks like", which is where you should look first.

Checking a car, step by step

This method combines a parked recording, a moving recording and a close-in search. Allow about an hour.

1. Choose the place. Park somewhere safe, away from other cars and buildings if possible, where few other phones are nearby. A quiet spot makes your car's own signals stand out.
2. Silence your own devices. Put every phone, watch and tablet in the car in airplane mode, and turn off Bluetooth and Wi-Fi on them, or leave them indoors. They transmit on exactly the same bands and will drown out anything else. Switch off the car's own connected services if the car allows it, and note whether it has a built-in modem.
3. Deal with the phone running Consentiva. It is a transmitter too. Put it in airplane mode while recording if you can; on most Android phones GPS still works in airplane mode. If it needs to stay online, remember that its own bursts will be the strongest uplink signals in the recording, because it is right next to the antenna.
4. Start a parked recording. Connect the HackRF, choose the Common preset (or Cellular & Wi-Fi on the Full plan), start a walk, and leave the phone and receiver in the middle of the car with the doors closed. Record for at least 15 minutes, and longer if you can. Add a voice mark at the start: "car parked, all phones in airplane mode".
5. Drive and record. Without stopping the recording, drive for 10–15 minutes, then park and record for another 5–10 minutes. Add voice marks when you start moving and when you stop. Many trackers only wake up and report when they feel movement. If someone else can drive while you watch the display, that is better.
6. Review the recording. Look for bursts on the uplink bands that repeat, and note their frequency and how far apart they are. Check whether they became more frequent while moving. Use the "unusual" flags to find what rose above the background.
7. Search close in. If you found a repeating burst, keep recording and move the receiver slowly around the car: each wheel arch, under the front and rear bumpers, under each seat, near the OBD-II port, in the boot. Keep it at each spot for at least one or two of the repeat intervals you measured. A signal that becomes much stronger at one spot is close to that spot. Say where you are as a voice mark at each stop so the recording shows which position matched which level.
8. Inspect physically, using the checklist in the next section, whatever the radio showed. A torch and a mirror find more trackers than any radio, and they find loggers that a radio never will.
9. Repeat on another day if you found nothing but your concerns continue. Some trackers report only a few times a day.

For more on moving recordings and voice marks, see how to survey radio signals.

Physical inspection checklist for a car

Most hidden car trackers are small black or grey boxes, often in a magnetic case, sometimes wrapped in tape or inside a plastic bag. Some are wired in. Use a bright torch, a small inspection mirror, gloves and something to kneel on. Take photos as you go, so you can compare later and have a record. Don't pull at wiring you don't understand.

Not everything you find is a tracker. Cars contain many modules, sensors and wiring connectors. Factory parts usually match the car's other wiring, are fitted with clips or bolts and carry the maker's labels. An add-on device tends to look out of place: fresh tape, cable ties, a magnet, a different style of wire, or a brand name you can look up. If you're unsure, photograph it and ask a mechanic you trust, or include it when you talk to the police.

Checking a room, step by step

A room check follows the same idea: silence what you know, record what's left, then look.

1. Make a list of your own transmitters. Router, mesh points, smart speakers, cameras you own, baby monitors, cordless phones, smart TVs, plugs and bulbs, printers. Each one is a signal you will otherwise mistake for something else.
2. Record with everything on. Leave the receiver in the middle of the room for 15–30 minutes. This is your "normal" picture, and it also builds Consentiva's baseline for that block and time of day.
3. Turn your own devices off, including Wi-Fi on the router, if you can do so safely. Put phones in airplane mode. Record again for 15–30 minutes.
4. Compare the two recordings. Anything that stays when your own devices are off belongs to someone else: a neighbour, the building, or a device you don't know about. In flats and apartment blocks, a lot will remain, because neighbours' Wi-Fi and phones are close.
5. Walk the room slowly with the receiver, pausing for a minute or two near each wall, each power socket, each piece of furniture, and anything that is plugged in all the time. Add a voice mark at each stop. A signal that peaks at one spot is close to that spot.
6. Look for three things in particular: a steady carrier in VHF or UHF that doesn't belong to a known service; continuous or regular cellular uplink activity with all phones in airplane mode; and Wi-Fi or analog video activity at 2.4 or 5 GHz with your own Wi-Fi off.
7. Repeat at different times and on different days. A transmitter that appears in the same place each time deserves a closer look. One that comes and goes with a neighbour's schedule is probably theirs.
8. Inspect physically. Check objects that have appeared recently or been moved, anything permanently plugged in (chargers, adaptors, power strips, clocks, lamps), smoke alarms, air vents, picture frames, bookshelves and soft furnishings. Look for small holes, a lens, or a device that is heavier or warmer than it should be.

A note on cordless phones: in the US, DECT 6.0 cordless phones and many baby monitors use 1920–1930 MHz, just above the PCS uplink band. Their base stations transmit regularly even when nobody is using them. That is normal.

Checking for hidden cameras

Many cameras don't transmit continuously, and some never transmit. Combine the radio check with these three simple methods.

Look for a lens reflection

A camera lens reflects light straight back towards its source. Turn the room lights off, hold a bright torch next to your eye, and slowly scan the room, looking along the beam. A lens shows as a small, sharp point of reflected light that stays put as you move your head slightly. Check at different heights, especially at objects facing the bed, shower, sofa or desk. Some products sold as camera detectors use the same principle with a ring of red LEDs and a viewing filter.

Look for infrared LEDs with a phone camera

Cameras designed to see in the dark often have infrared LEDs, which are invisible to your eyes. Many phone cameras can see some infrared. In a dark room, point your phone camera around and watch the screen for small glowing points. On some phones the front camera shows infrared better than the rear one, because rear cameras often have stronger infrared filters. You can test your phone first by pointing a TV remote at it and pressing a button. If you can't see the remote's LED flash, that camera won't help. Not all hidden cameras have infrared LEDs, so seeing none doesn't prove there is no camera.

Check your own Wi-Fi network

If a camera is using your Wi-Fi, it appears in your router's list of connected devices, usually viewable in the router's app or web page. Go through the list and account for each device. Unknown entries are worth investigating, though many are just smart plugs, TVs or a visitor's phone with a random name. Also look at the list of Wi-Fi networks your phone can see. Some cameras create their own network with a name that includes a model number or the word "camera". A strong network you don't recognise, in a place where you don't expect one, is a clue. In rented accommodation, your own network check doesn't cover a camera on the owner's network.

Use your phone's tracker alerts

For Bluetooth item trackers, your phone is usually the quickest and most reliable detector, because it decodes the tracker's broadcasts instead of just seeing radio energy.

iPhone

iPhones warn you when an unknown AirTag or other Find My accessory appears to be travelling with you. The alert lets you play a sound on the tracker to help find it and shows how to disable it. You can also look for nearby items in the Find My app. For alerts to work, keep Bluetooth on and allow the relevant location and notification settings. An AirTag separated from its owner for a while will also play a sound by itself.

Android

Android phones running version 6.0 or later have unknown tracker alerts, which warn you when an unknown tracker seems to be moving with you. You can also run a manual scan: open Settings → Safety & emergency → Unknown tracker alerts and tap Scan now. The menu names can differ slightly between phone makers. A manual scan is useful in a car you've just got into, before the automatic alert has had time to trigger. Apple also offers an Android app called Tracker Detect for finding nearby AirTags.

The cross-platform standard

Apple and Google worked together on an industry specification for detecting unwanted location trackers, so that alerts work across iPhone and Android and for compatible trackers from other makers. Not every tracker on the market supports it, especially older or unbranded ones. Tile and Samsung also offer scanning in their own apps for their own tags.

Why alerts can be quiet

• Alerts are designed to trigger when a tracker moves with you over time, so they may not fire straight away.
• Alerts can be suppressed if the tracker's owner is near you, because the system assumes you are travelling together.
• Trackers without support for the standard, and cellular GPS trackers, don't trigger these alerts at all.

Three scenarios, worked through

A regular burst in the car

You park at a quiet spot, put every phone in airplane mode and record for 20 minutes. The recording shows a short burst near 710 MHz every five minutes, flagged as unusual. You drive for ten minutes; the burst now appears about once a minute. When you move the receiver around the car, it is clearly strongest by the rear left wheel. With a torch, you find a small magnetic box up inside the wheel arch. You photograph it in place without removing it, note the time and place with a voice mark, finish the recording, and call the hotline to talk through next steps before deciding what to do with it. The recording, with its times, positions and marks, goes into an evidence package.

An AirTag alert, but nothing on the display

Your iPhone shows an "AirTag found moving with you" alert after a drive. The spectrum display shows the usual crowded 2.4 GHz band and nothing that stands out. That is expected: an AirTag's broadcasts are tiny compared with everything else at 2.4 GHz. You use the alert to play a sound, follow it to the car, and find the AirTag under a floor mat. Here the phone did the job, and the radio was the wrong tool. You take a screenshot of the alert and photos of where you found it.

A steady signal in the bedroom

With your own Wi-Fi and devices off, a narrow, steady line remains in the UHF range. It is present every evening. Walking the room, you find it is strongest near the wall you share with a neighbour, and no stronger anywhere inside the room. Recording in the corridor shows it even stronger there. That pattern suggests a device in the neighbouring flat, such as a wireless headphone base or a baby monitor, rather than one hidden in your room. You note it, inspect the room physically anyway, and record again another evening. If it changed behaviour, or peaked inside your room, it would deserve a professional look.

Common mistakes

• Looking at the downlink bands. Tower signals are strong and constant. They will always be there, and they say nothing about a hidden device.
• Forgetting your own phone. One phone that isn't in airplane mode produces stronger cellular bursts than any tracker.
• Recording for two minutes. Trackers that report every few minutes, or only when moving, are easily missed by a short look.
• Only recording while parked. Motion wake-up means many trackers stay silent until the car moves.
• Treating every burst as a tracker. In a busy area, a burst on a cellular band is far more likely to be someone's phone. Look for repetition, timing and a location that peaks inside your car or room.
• Putting the antenna next to a strong transmitter. Overload can create false signals that appear on other frequencies.
• Trusting a clean sweep completely. Loggers, sleeping trackers and recording-only cameras are invisible to radio.
• Ignoring the car's own modem. Many newer cars report regularly by themselves. Check whether yours has connected services.
• Removing a device without a plan. It can alert the person who placed it and lose evidence. Document first.
• Overlooking phones and accounts. Location sharing, shared accounts and car-maker apps can reveal where you are without any hidden hardware.

What to do if you find a device

1. Stay safe. If you feel in immediate danger, call 911.
2. Don't necessarily remove it. Removing it, or moving it, can alert the person who placed it. Whether to remove it is a safety decision, and an advocate can help you make it.
3. Document it in place. Take clear photos and a short video from several angles, close up and showing where it is on the car or in the room. Note the date, time and location. If you have a Consentiva recording that shows its signal, keep it; on paid plans, a video clip records time, GPS position and the RF reading on the image.
4. Avoid handling it more than you need to. The police may want to examine it.
5. Talk to an advocate or the police. The National Domestic Violence Hotline (1-800-799-7233, or text START to 88788) can help with safety planning. The police can take a report and decide whether to collect the device. A lawyer can advise on your options, including protective orders.
6. Keep your records together. Your notes on why you were suspicious, the photos, the recordings and any phone alerts belong in one place.

Consentiva can produce a report and a tamper-evident evidence package for a recording. The package uses a SHA-256 hash chain, so anyone checking it can tell whether the recorded data has been altered since it was made. You can give it to the police or a lawyer. See reading a Consentiva report and the sample report.

What a radio sweep can't tell you

• It can't see a device that isn't transmitting at that moment, or one that only records.
• It shows that a transmitter is present, not who put it there or what it is sending.
• It can't read or decode the content of cellular, Bluetooth or Wi-Fi transmissions, and doesn't try.
• Busy areas are full of legitimate signals. A burst on a cellular band is far more likely to be someone's phone than a tracker.
• It can't see above 6 GHz, which is the HackRF One's upper limit.
• It doesn't check your phone or your online accounts for location sharing or tracking software.
• A display reading is not a measurement of exposure or safety. If that is your concern, see RF exposure limits explained.

A consumer RF meter has similar limits and shows less detail. The differences are explained in RF meter vs spectrum analyzer.

When to hire a TSCM professional

TSCM stands for technical surveillance counter-measures: professional searches for bugs, cameras and trackers. A qualified team brings equipment and methods beyond a consumer sweep, such as careful physical searches of walls and fittings, tools that find electronics whether or not they are switched on, and checks of phone lines and networks. Consider one when:

• The stakes are high, for example a legal case, a business with sensitive information, or a long-running pattern of being watched.
• Your own checks find nothing, but someone keeps knowing things they shouldn't.
• You found something and want an expert to examine it and the rest of the space.
• You need a written, professional report.

Quality varies, so ask what equipment and methods they use, what the search covers, what kind of report you will get, and whether they have experience working with domestic abuse cases if that is your situation. Be wary of anyone who promises certainty. Your own recordings and notes are still useful to give them, because they show what you found and when.

The law in Florida

Under section 934.425 of the Florida Statutes, installing a tracking device or tracking application on someone else's property without their consent is a crime, with limited exceptions (for example a parent or legal guardian tracking a minor child, or law enforcement acting lawfully). Recording other people's conversations without everyone's consent, where they expect privacy, is also generally illegal in Florida under Chapter 934, which covers interception of communications. This guide isn't legal advice. If you find a device, photograph it in place, note when and where you found it, and report it to the police, who can tell you how the law applies to your situation, or talk to a lawyer.

Glossary

• Uplink: the frequencies a phone or tracker uses to transmit to a cell tower. This is where hidden cellular devices show up.
• Downlink: the frequencies a cell tower uses to transmit to phones. Always busy; not useful for finding trackers.
• Carrier: a steady, narrow radio signal. A continuous carrier can mean an analog bug.
• Burst: a short transmission that starts and stops, such as a tracker sending its position.
• LTE-M and NB-IoT: low-power versions of 4G LTE used by small battery devices, including many trackers.
• PSM and eDRX: power-saving features that let a cellular device stay silent for long periods.
• Bluetooth Low Energy (BLE): the low-power form of Bluetooth used by item trackers, watches and many gadgets.
• GPS L1: the 1575.42 MHz satellite navigation signal. Trackers receive it; they don't transmit on it.
• OBD-II port: the car's diagnostic socket, usually under the driver's side of the dashboard.
• Telematics: equipment that reports a vehicle's location and data over the cellular network.
• Baseline: the normal radio picture for a place and time of day, used to spot what is new.
• dBFS: decibels relative to the receiver's full scale. An uncalibrated level, useful for comparisons.
• Overload: when a very strong signal saturates the receiver and creates false signals.
• TSCM: technical surveillance counter-measures, the professional field of searching for surveillance devices.
• Hash chain: a way of linking records with SHA-256 fingerprints so that any later change can be detected.

Common questions

Can an RF scanner find every GPS tracker?

No. A tracker that only records its route and is read later (a GPS logger) doesn't transmit, so no radio scan can find it. A scan finds devices that transmit, such as real-time cellular trackers, Bluetooth item trackers and wireless bugs, and only while they are transmitting.

What frequency do GPS trackers transmit on?

Real-time trackers report over the cellular network, so in the US they transmit on phone uplink bands such as 663-698, 699-716, 777-787, 824-849, 1710-1780 and 1850-1915 MHz. Bluetooth trackers such as AirTags use 2400-2483.5 MHz. GPS itself is receive-only: the 1575.42 MHz signal comes from satellites, not from the tracker.

How long should I record to catch a tracker?

At least 15 minutes parked, then again after a short drive, because many trackers report only every few minutes and some sleep until they feel movement. Longer recordings, or recordings on several days, catch more.

Should I remove a tracker if I find one?

Not necessarily straight away. Removing it can alert the person who placed it, so photograph it in place and talk to an advocate or the police first, unless you are in immediate danger, in which case call 911.

Will my phone warn me about an AirTag?

Usually. iPhones alert you to an unknown AirTag or Find My accessory travelling with you, and Android phones from version 6.0 have unknown tracker alerts with a manual scan under Settings, Safety & emergency. Apple and Google also back a shared standard so compatible trackers from other makers trigger these alerts.

Can I find a hidden camera with a spectrum analyzer?

Only if it transmits, for example over Wi-Fi or an analog video link, and only while it is transmitting. A camera that records to a memory card sends nothing, so also check for lens reflections with a torch and look for unknown devices on your own Wi-Fi network.

Is it legal to put a tracker on someone's car in Florida?

Section 934.425 of the Florida Statutes makes it a crime to install a tracking device or tracking application on another person's property without their consent, with limited exceptions such as a parent tracking a minor child or law enforcement acting lawfully. For advice about your own situation, talk to the police or a lawyer.

When should I hire a TSCM professional?

When the stakes are high, when your own checks find nothing but the evidence of being watched continues, or when you need a search that will stand up to scrutiny. TSCM specialists use equipment and inspection methods that go well beyond a consumer radio sweep.