Key Takeaways
Why a Factory Reset Isn't Always Enough
When most people hand over a phone at a carrier store or ship it to a trade-in program, they assume a factory reset has wiped the slate clean. In many cases, that assumption leaves a gap. Depending on the device's age, operating system version, and storage type, certain data remnants can persist in ways that basic reset procedures don't fully address.
Research from data-recovery firms has demonstrated that, on older devices using certain flash memory configurations, fragments of contacts, photos, and messages can sometimes be reconstructed using forensic tools — even after a standard reset. Newer devices with full-disk encryption enabled by default have significantly narrowed this risk, but habits around account sign-outs, cloud sync, and physical media are just as important as the reset itself.
Understanding what a reset actually does — and what it doesn't — is the first step toward protecting yourself. For readers thinking about a broader carrier transition, this guide on switching carriers covers device unlocking and account timing that affects this process as well.
eSIM Devices Require an Extra Step
If your phone uses an eSIM (an embedded digital SIM rather than a physical card), you cannot physically remove it. Instead, you must delete the eSIM profile from your device settings before trading in or selling. Look for an 'erase eSIM' or 'remove carrier plan' option under Settings > Cellular or Mobile Data. Failing to do this may leave your carrier account information associated with the device.
Core Practices Before You Hand Over the Device
The steps below should be completed in order. Skipping or reversing them can leave accounts accessible or data unprotected.
Sign out of every account before initiating a factory reset.
Apps and accounts that remain signed in can sync new data to the device even after a reset begins. Some accounts also retain device-level permissions that persist if not explicitly revoked through the account's security settings. Signing out first severs that connection.
Encrypt your device before performing the factory reset.
Encryption scrambles stored data using a key tied to your passcode. When you reset an encrypted device, even if data fragments remain on the storage chip, they are unreadable without the encryption key — which is destroyed in the reset process. Most modern smartphones encrypt by default, but older Android devices may require you to enable it manually.
Remove your SIM card and any external SD card before handing over the device.
SIM cards store carrier account information and sometimes contacts. SD cards can hold photos, documents, and app data entirely outside the phone's internal storage — meaning a factory reset does not touch them. Both are easy to overlook in the handoff moment.
Revoke third-party app permissions and deauthorize the device from streaming or media services.
Services like music platforms, cloud storage apps, and digital wallets maintain device-level authorizations that survive a reset in some configurations. Failing to revoke these can allow the next owner to access shared libraries or payment methods if they restore from your backup.
Transfer, then delete, any locally stored files you want to keep before wiping.
A factory reset is designed to erase — not preserve. Users who skip a backup step before resetting risk losing photos, contacts, and documents that were stored locally rather than synced to the cloud. Completing a backup first ensures nothing is lost in the process of protecting your data.
Quick Actions You Can Take Right Now
If you have a trade-in appointment scheduled or a device sitting unused, these actions can be completed in under an hour and meaningfully reduce your exposure.
Data security habits developed around device handoffs often extend into broader online behavior. For related context on how personal information moves through digital channels, see what happens to your data when you shop online.
Understanding Trade-In Channels and What They Do With Your Device
Not all trade-in programs handle returned devices the same way. Carrier store programs, manufacturer trade-ins, and third-party resale platforms each have different processes for device inspection, data wiping, and resale or recycling. Many reputable programs apply a certified wipe using industry-standard software before resale — but this is not universal, and documentation varies.
Before completing a trade-in, it is reasonable to ask the program operator what data-erasure standard they apply and whether you receive any confirmation. Programs aligned with standards such as NIST 800-88 (a U.S. government framework for media sanitization) generally offer stronger assurances than those with vague policies. When in doubt, completing your own thorough wipe before submission puts control back in your hands regardless of what the receiving party does.
~1 in 10
Used phones resold without a proper data wipe
An Avast analysis of secondhand phones purchased on eBay found a significant proportion still contained recoverable personal data from previous owners.
NIST 800-88
U.S. standard for media sanitization
The National Institute of Standards and Technology publishes guidelines that define clear, verified methods for sanitizing device storage before disposal or resale.
If you are also evaluating plan terms before your next device commitment, reviewing what to check before signing a carrier contract can help you ask the right questions upfront.