What to Delete from Your Phone Before Selling It: A Comprehensive Security Guide
A modern smartphone is not just a communication device – it is part of our digital life, where banking information, private conversations, health metrics, and location history are stored. When planning to sell the device, it is not enough to just delete the photo gallery or press “delete all.” If the phone is not properly prepared, sensitive information can fall into the wrong hands, or the buyer may encounter software locks.
In this article, we will review the key steps to take before handing over the phone to a new owner, based on cybersecurity practices and digital forensics research.
1. Data Backup
Before deleting any information, first ensure you have a copy of it. Modern operating systems offer convenient Cloud solutions:
- iOS: Use iCloud Backup. Check that all important categories (Contacts, Photos, Keychain) are enabled in the settings.
- Android: Use Google One or specific manufacturer tools (e.g., Samsung Cloud).
- Physical Backup: Security experts recommend making a physical copy on your computer (using iTunes/Finder or Android File Transfer), especially if you have many media files.
2. Unlinking Accounts and “Blind” Locks
This is a step that users often forget. Modern phones have security mechanisms designed to protect the device in case of theft: FRP (Factory Reset Protection) on Android devices and Activation Lock on iPhones.
If you simply perform a Factory Reset without logging out of your accounts, the phone will ask for the old password after rebooting. For the buyer, this means the device is a worthless “brick.”
- iOS: Go to Settings -> [Your Name] -> Find My and turn off Find My iPhone. Then log out of your Apple ID.
- Android: Go to Settings -> Accounts (or Users & Accounts) and manually remove all Google accounts.
3. Banking, 2FA, and Authorization Keys
Your phone serves as a key to other services. Before selling, you must sever this connection:
- 2FA (Two-Factor Authentication): If you use apps like Google Authenticator or Microsoft Authenticator, transfer your accounts to the new device. Remember that a Factory Reset does not delete your account from the server but removes the ability to receive codes on this device.
- Smart-ID / Mobile Signature: Be sure to unregister the device in your bank account or app settings.
- Banking apps: Most banking apps link the device ID to your account. Disconnect the device through your bank’s online self-service.
4. Messaging App Specifics
Apps that use End-to-End Encryption (E2EE), such as Signal or WhatsApp, store messages on the device itself, not in the cloud (unless additional Cloud Backup is enabled).
- WhatsApp: Perform a Chat Backup to Google Drive or iCloud.
- Viber / Telegram: Make sure to clear the Cache and log out of the account on this device.
5. Removal of Physical Media (SIM and MicroSD)
While this may seem obvious, many phones in the secondary market reach buyers with cards left inside.
- SIM card: It may contain contacts and message fragments. Also, do not forget to delete the eSIM profile in the settings.
- MicroSD card: If you are selling the phone with the card, it must be formatted separately. However, the safest option is to simply keep the card for yourself.
6. The Science of Data Deletion: Why is Factory Reset Enough (or Not)?
Many wonder: can the buyer recover my photos using special software?
Scientific studies in the field of digital forensics (e.g., Reardon et al., 2012) have previously shown that data deletion was not complete in early Android versions. However, in modern devices, the situation has changed due to Full-Disk Encryption (FDE) or File-Based Encryption (FBE).
“When you perform a Factory Reset on a modern phone, the system destroys the encryption keys (cryptographic erasure). Even if data bits remain physically in the NAND Flash memory, without the key, they are unreadable noise.”
IMPORTANT: If you are using a very old device (older than Android 6.0), it is recommended to manually enable device encryption in the settings before performing a reset.
7. Final Step: Factory Reset and External Cleaning
System Cleaning Commands
- iOS: Settings -> General -> Transfer or Reset iPhone -> Erase All Content and Settings.
- Android: Settings -> System -> Reset options -> Erase all data (factory reset).
Physical Hygiene
Wipe the device with isopropyl alcohol, clean the charging port and speaker grills. This is not only part of security but also good preparation for sale.
Quick Checklist
| Action | Why is it important? | Status |
|---|---|---|
| Log out of iCloud/Google | Disables device lock (FRP/Activation Lock). | Necessary |
| Unregister Smart-ID | Ensures the security of banking operations. | Necessary |
| Remove SIM/SD cards | Protects physical personal data storage. | Necessary |
| Factory Reset | Destroys encryption keys and all content. | Necessary |
Conclusions
Safely preparing your phone for sale is a process that requires attention not only to the device itself but also to the accounts associated with it. By following this guide, you will not only protect your privacy but also ensure that the buyer receives a clean, fully functioning device without any software restrictions.
Sources
- Reardon, J., et al. (2012). Data Sanitization on Flash Memory. A study on how data deletion works on flash memory.
- Biedermann, S., & Katzenbeisser, S. (2016). Secure Deletion of Data in Flash-Based Storage Devices.
- Apple Support (2025). What to do before you sell, give away, or trade in your iPhone or iPad.
- Google Android Help. Reset your Android device to factory settings.
- National Institute of Standards and Technology (NIST) Special Publication 800-88. Guidelines for Media Sanitization.