Yes, it’s possible. A monitoring App can be pre-installed on the phone before it gets to you. And they usually run in stealth mode such that you can’t tell that you have something like that on your phone.
Examples of such apps are
- http://www.mobile-spy.com/cell-phone-monitoring.html etc
(Disclaimer: please, do not use this tool for illegal activities. You are fully responsible for any ‘side effects’)
So, you should not trust phones you get from someone else easily. Even if you trust the person who gave you the phone still do the following if you care about your privacy:
- Factory restore or flash the phone.
- After reinstalling the OS, update it and install anti-spyware or anti-malware tools on it.
On your phone app stores you can search for any good anti-spyware app to use such as the one here (https://play.google.com/store/apps/details?id=com.antispycell.free)