Detecting Rogue Bluetooth Trackers (AirTags, Tiles, SmartTags) with the Flipper Zero

Bluetooth item trackers — Apple AirTags, Samsung SmartTags, Tile — are useful for finding lost keys and luggage, but the same small, cheap, long-battery-life BLE beacon that makes them convenient also makes them a documented tool for covert tracking of people and vehicles without consent. This guide covers the technical side of how these trackers actually broadcast, what a Flipper Zero can and can't do to help detect one, and what other tools fill the gaps — framed as a practical safety topic distinct from the general Bluetooth/WiFi security testing content already covered elsewhere on this site.

How Trackers Actually Broadcast

AirTags, Tiles, and SmartTags all work on the same basic principle: a small BLE radio broadcasts an advertisement packet at regular intervals, containing manufacturer-specific data that nearby phones (running Apple's Find My network, Samsung's SmartThings Find network, or Tile's own app network) pick up and relay back to the owner via the internet, without any direct connection to the tracker itself. Two details matter for detection:

• MAC address rotation: To prevent third parties from simply tracking the tracker by its Bluetooth MAC address, AirTags and most modern trackers rotate their BLE MAC address on a schedule (roughly every 15 minutes for AirTags). This is a genuine privacy feature against passive tracking, but it also means a naive "watch for one MAC address following me" detection approach doesn't work — you have to recognize the device by its advertisement payload pattern, not a fixed address.
• Manufacturer-specific advertisement data: Each tracker type has a recognizable structure in its BLE advertising packets — a specific manufacturer ID and data format that identifies it as an AirTag, a Tile, or a SmartTag even as the MAC address rotates underneath it. This is what dedicated detection tools and apps actually key off.

What Stock Flipper Zero Firmware Can and Can't Do

It's worth being direct about a limitation here: the Flipper Zero's onboard BLE radio and stock firmware are built primarily for BLE peripheral emulation (HID, spam apps) rather than deep packet scanning and filtering of arbitrary BLE advertisement traffic. Out of the box, it is not a purpose-built BLE tracker scanner the way a phone app is. Community-built FAP apps in the Flipper app catalog and on custom firmware builds (Momentum, Unleashed, Xtreme — all covered in depth elsewhere on this site) extend BLE scanning capability significantly, including apps aimed specifically at spotting suspicious BLE advertisement patterns. Check the current app catalog for BLE scanning/detection apps before relying on this workflow, since Flipper's community app ecosystem changes faster than any static guide can track — what exists and how well it works is worth verifying at the time you actually need it, not assumed from an article written months earlier.

A Practical Scanning Approach

Whatever BLE scanning app you're using on the Flipper, the general workflow for identifying an unwanted tracker follows the same pattern regardless of tool:

• Scan and log BLE advertisements over a period of time (ideally while moving between locations — home, car, a public place) rather than a single snapshot, since a tracker that's genuinely following you will show up persistently across different locations while background BLE noise from other people's legitimate devices will not.
• Filter by manufacturer data pattern matching known tracker types rather than trying to track individual MAC addresses, since rotation defeats address-based tracking as described above.
• Use signal strength (RSSI) to narrow location once you've identified a suspicious advertisement — walking around while watching RSSI increase as you approach the source is the same basic technique used for the Flipper's Sub-GHz signal-finding workflow covered elsewhere on this site, just applied to BLE instead.

Purpose-Built Alternatives Worth Knowing About

For most people, the fastest and most reliable path to detecting an unwanted tracker doesn't involve a Flipper Zero at all:

• Apple devices running a current iOS version have built-in "Item Safety Alerts" / unknown tracker notifications that proactively warn you if an unrecognized AirTag-type device appears to be traveling with you over time — this runs automatically in the background without any manual scanning.
• Google's "Unknown Tracker Alerts" provides similar functionality on Android for trackers compatible with the cross-platform detection standard both companies adopted.
• Tracker Detect (Apple's own app for Android users without native OS-level alerts) lets Android users manually scan for nearby AirTags specifically.

These built-in and official tools are purpose-built for exactly this problem and are generally more reliable for the average person than a general-purpose BLE scanning tool — the Flipper Zero angle in this guide is genuinely useful for makers who understand the BLE layer and want to build their own detection logic, or who want to understand the mechanism rather than just get an alert, not necessarily the fastest path for someone who just wants to know "is something tracking me" right now.

If You Find an Unwanted Tracker

This matters enough to say plainly: if you have genuine reason to believe you're being tracked by someone who intends you harm (not just an ambiguous or unexplained beacon), don't rely solely on a DIY detection workflow to resolve the situation. Note the tracker's location and any identifying information without necessarily disabling or destroying it immediately, since an intact tracker can be relevant evidence, and contact local law enforcement if you believe you're being stalked or tracked without consent. Removing the battery disables most trackers' active broadcasting without destroying potential evidence. Detection tools — Flipper-based or otherwise — are a technical aid for understanding what's happening around you, not a substitute for taking a genuine safety concern to people equipped to actually address it.

Understanding how these trackers broadcast is useful knowledge on its own even outside the safety angle — the same MAC rotation and manufacturer-data techniques show up throughout modern BLE device design, and this is one of the more approachable ways to see that design pattern in action with hardware already on your bench.