Built-in monitoring on Chinese Android phones: what is proven, and how to protect yourself

Xiaomi's HyperOS developer platform publishes a service description called “device fraud-behavior detection” (updated 15 April 2026), offered to partner companies. A partner's app can query a phone's “fraud risk score” from 0 to 100; deeper partners can query specific behaviors in the past 72 hours: screenshots, screen recording or sharing, airplane mode, call forwarding, installing remote-control, finance, loan, “unidentifiable” or “suspicious” apps, overseas calls, visits to flagged URLs.

The document says detection still works even if the user deletes the call log or the app, and that an installed app still counts after it is uninstalled within the validity window. It applies to mainland China devices on HyperOS 3.1 or later, phones and tablets. It does not say the data goes to the police, and it does not say how a user can turn it off.

• Keyboards (Citizen Lab, April 2024): of nine vendors' pinyin keyboards (Baidu, Honor, Huawei, iFlytek, OPPO, Samsung, Tencent, Vivo, Xiaomi), eight had flaws that let a network eavesdropper read what you type, affecting close to a billion users. Most have been fixed; the researchers still advise a keyboard that predicts on the device only.
• Preinstalled apps (University of Edinburgh and Trinity College Dublin, 2023): on Xiaomi, OnePlus and OPPO/realme phones bought in China, preinstalled apps sent device identifiers, location, phone number and app usage to the vendor and third parties, even after opting out of usage data at setup, and kept doing so abroad.
• Keyword list (Lithuanian Ministry of Defence, 2021): the system apps on a Xiaomi Mi 10T held a list of 449 terms to block, switched off for the EU region but able to be turned on remotely. Xiaomi denied restricting users' communications.

A report published on GitHub analyzed one Xiaomi phone on HyperOS 3.0. China Unicom's preinstalled component SystemHelper (package com.mobiletools.systemhelper) collects location (to six decimal places), cell tower and nearby Wi-Fi every 30 minutes and, together with device and SIM identifiers and the list of installed apps and their usage, periodically sends it to Unicom's server over plain HTTP, encrypted with a key derived from the content itself. It has no icon, does not appear in the app list, and has no switch. Another teardown shows it still registering with Unicom when the SIM is from China Mobile.

It is not only Xiaomi. vivo's system properties name the package (a public GitHub issue), and on a mainland-China vivo X200S it is visible with “Uninstall” and “Force stop” greyed out; it is also in OPPO and realme preinstalled-app lists. The component's own code lists a set of brands — Samsung, Motorola, Nubia, OnePlus, ZTE and others — so mainland-China Samsung phones are within its scope, though no one has yet published it from Samsung firmware. Huawei and Honor are not on the list.

The report's author notes that only one device was tested and makes no claim about the developers' intent.

• “The security component records the screen every few seconds and uploads it”: one user's reverse-engineering post; the report above saw no such upload from that kind of component.
• “Mainland-China Samsung phones already ship it”: so far only the brand list in the component's code; no evidence from Samsung firmware yet.
• “People with X or Telegram installed got calls from the police telling them to uninstall”: secondhand accounts; there is no way to verify that the phone's reporting caused them.
• We do not present these as facts. That does not make them false; each is still missing a second independent source.

A VPN encrypts the traffic between your device and the server, so the carrier and the firewall cannot see what you visit. But the phone's system sits on your end of the tunnel: it knows which VPN app you installed, when you open it and for how long. In 2023 Xiaomi's security center flagged Telegram as “failed the security review” and blocked installing it.

So no route, however good, fixes what happens on the phone itself. What helps is letting the phone know less.

1. Keep what matters on a system not run by a mainland-China vendor: an iPhone, or an Android phone with the international firmware. A mainland-China Android phone is fine for everyday use, just not for anything you would mind being seen.
2. Turn off “cloud input” or “cloud suggestions” in your keyboard, or switch to a keyboard that works on the device only.
3. Go through app permissions in Settings and switch off location, contacts and app-list access for anything that does not need it; turn off “fraud detection” or “security scan” in the phone's security or phone-manager app where you can.
4. Do not root or reflash the phone to remove preinstalled components; for most people a mistake costs more than it saves, and the community blocking modules all need root, with no one to help if something breaks.
5. Keep the VPN app off the phone entirely: use a home router with a route set up, so the phone just joins Wi-Fi and is already through the firewall, and the system sees an ordinary Wi-Fi network.

What we can do: encrypt your network traffic and not log what you visit. Our clients are standard ones (Cisco, OpenVPN, Hiddify, Tailscale), unmodified. And with the router option there is no VPN app on the phone at all.

What we cannot do: stop the phone's own system from reporting. Only a different device, tighter permissions and keeping sensitive things off mainland-China firmware help with that.