There are really two common scenarios that could account for the explanation:
1) a Man in the Middle attack. This is when you go to a public location to user their free WIFI and another person sets a fake WIFI network. Your phone would not be able to tell the difference from the fake and a real one. They essentially "inspect" all your traffic as it goes thru their machine and they will scrape username, passwords etc. There is very little you can do to prevent this as it is almost impossible to know when someone is in the middle of your connection. The best way to prevent this type of attack is to not connect to a free WIFI in an unusual location IE McDonald WIFI at a Burgerking would be a big red flag. Also after you connect to a free WIFI, it is a good idea to go back into your network settings and delete any free WIFI because once you connect to a WIFI called McDonalds, your phone will always check in the background for a WIFI called McDonalds and if your neighbors kid who is a hacker sets up a Man in the Middle attack using a network called McDonalds, your phone will automatically connect without you knowing.
2) the phone could be hacked. Android are about the most susceptible platform on the market to hacking, especially the cheap $0 phones. If you have a phone update its firmware and apps frequently as they often have bug fixes to prevent hacking. If your phone has never had updates to the firmware be afraid, there is a good chance it is a cheap one and the manufacturer will never do updates to plug the security holes. Also do not root the phone or download apps directly from the net, always use the Play Store or Amazon store you are far less likely to run into an bad app. Apple are also popular for hacking so update the apps and the firmware whenever possible as well. If it was hacked, best option is copy off all important stuff like photos and wipe the device and reinstall everything.