Weird security issue

An app would have to be installed but unless you know Android well enough it may not be casually obvious that such an app is there.

First, back up photos and music if essential.

Next, visit your Gmail account from a PC and verify that your contacts are all in place.

Next, change your Gmail password and any other passwords that have been used with the phone. Yahoo mail, online banking, whatever.

Finally, go into the phone's main settings. Either under Storage or Security (covers most phones and could be different due to the version, no big deal), find the options to perform a factory data reset and format/erase the SD card.

That will take the phone to a like-new condition.

All used installed apps and all data will be erased.

In the reboot that follows the phone will present the original setup wizard.

Enter the Gmail password.

Do not sync apps and settings if such an option is presented.

Contacts will restore themselves from the Google web.

Hope this helps.