Selling or giving away an old phone feels simple: back it up, reset it, hand it over. But a factory reset alone is not always the end of the story. On older phones, or phones where storage was not encrypted, traces of photos, messages, logins and documents can sometimes still be recovered from the storage after a reset. On modern phones the risk is much lower, because storage encryption is standard — but only if you follow the steps in the right order, sign out properly, and check the things a reset does not touch, like the memory card and your accounts.
This guide gives you the full defensive checklist: back up first, sign out before you reset, handle encryption and the memory card, verify the reset, and know what to do if you already handed a phone over without doing all of this.
Step 1: Back up — and verify the backup
Before you erase anything, make a backup you have actually checked. Back up photos and videos, contacts, messages and chats, and any documents stored only on the phone. Most phones offer a built-in backup to your account's cloud storage, and many chat apps offer their own backup to the same account. Run the backup over Wi-Fi, wait for it to report completion, and then open the backup on another device — a computer, a tablet, or your new phone — and confirm that the photos and contacts you care about are really there.
Do not skip this verification step. A backup that failed silently is worse than no backup at all, because it gives you false confidence while you erase the only good copy. If anything important is missing, copy it manually to a computer or external drive before going any further. While you are at it, note down any two-factor authentication or authenticator apps on the old phone: move those accounts to your new phone first, or you may lock yourself out of your own accounts after the reset. Our Secure Your Google Account Guide covers moving account access safely.
Step 2: Sign out of everything — before the reset
This is the step most people get wrong, and it matters more than the reset itself. If you factory-reset a phone while still signed into your main account, the next owner can hit a lock screen asking for your account — the phone's factory reset protection, designed to deter theft. The buyer cannot use the phone, you get an awkward message, and fixing it remotely is a hassle for everyone.
- Remove your main account first: in Settings → Accounts (or Passwords & accounts), remove your Google account — and any other major account, like a manufacturer account — before you reset.
- Sign out of banking, payment and shopping apps individually, and remove saved cards from any wallet app on the phone.
- Sign out of email, social and messaging apps, especially any app that stays logged in automatically. If you use a messaging app with linked devices, remove the old phone from the linked-devices list.
- Turn off the find-my-device feature for this phone after signing out, so it no longer appears in your device list — and so a future remote-erase command cannot accidentally target a phone someone else now owns.
For the account side of this in full, see our Password Security Guide and Mobile Security Guide: strong, unique passwords and two-factor authentication are what protect you if any old session somehow survives.
Step 3: Encrypt the storage (important for older phones)
Modern Android phones encrypt their storage by default, which means a factory reset destroys the encryption key and the remaining data becomes unreadable scramble. That is why a reset is generally enough on a recent phone. Older phones, however, may not have encryption switched on, and on those a reset only removes the index of files, not the files themselves.
Check your phone's security settings: look for Encryption or "Encrypt phone" under Settings → Security. If encryption is already on, you can proceed. If it is off and your phone offers the option, turn it on and let it finish — this can take a while, so plug the phone in and leave it alone until it completes. Only then do the factory reset. On a phone too old to offer encryption at all, the extra overwrite step in the next section matters much more, and you should think twice about selling it at all — giving it to a trusted person, or recycling it through a reputable scheme, may be the safer choice.
Step 4: Factory reset — then overwrite on older devices
With accounts removed and encryption on, run the factory reset from Settings → System → Reset → Erase all data (the exact wording varies by brand). Let it complete fully, and do not interrupt it. When the phone restarts to its first-time setup screen, stop there — do not sign in again, do not restore a backup onto it, and do not connect it to Wi-Fi for setup.
For an older, unencrypted phone that you still intend to sell, add one defensive extra step before handing it over: after the first reset, set the phone up with a temporary account you do not care about (or skip sign-in if the phone allows it), fill the storage with large, meaningless files — long videos recorded with the camera work well — until the storage is nearly full, then factory-reset a second time. This overwrites much of the old data's hiding places with junk. It is not a guarantee — no overwrite trick is perfect — but it substantially raises the bar for anyone trying to recover what was there before. On a modern encrypted phone this step is unnecessary; the destroyed encryption key already does the job.
Step 5: Remove the SIM and memory card — and deal with them separately
A factory reset does not erase the memory card, and it does not remove your SIM. Both are easy to forget in the excitement of a sale, and both can hand a stranger your data directly.
- Take the SIM card out before handing the phone over. If you no longer need the number, ask your carrier to deactivate it; if you are moving it to a new phone, move it yourself, do not let it travel with the old one.
- Take the memory card out. Either keep it, move it to your new phone, or format it separately on a computer and then decide. Never sell a phone with your memory card still inside "as a bonus" — that card may hold years of photos and files that the reset never touched.
- Check the phone's other slots and trays: some phones have a second SIM slot or a hybrid tray, and cases sometimes hide a card. Check before you seal the box.
Step 6: Before you hand it over — the final check
- Backup verified on another device; authenticator accounts moved to the new phone
- Main account and manufacturer account removed; banking, payment and messaging apps signed out
- Find-my-device removed for this phone; linked devices list cleaned up
- Storage encrypted (or overwrite step done on an older phone)
- Factory reset completed; phone left at the first-time setup screen
- SIM and memory card removed
- Phone removed from your account's device list on the web, if it still appears there
Be honest with the buyer about the phone's condition, battery health and any faults. A truthful sale protects you as well: a buyer who discovers a hidden fault later is far more likely to come back with a complaint than one who knew exactly what they were buying.
What if you already sold or gave it away?
If you handed a phone over without doing all of this, do not panic — act in this order. First, change the passwords of your main email and any banking or payment accounts that were on the phone, and turn on two-factor authentication everywhere it is offered. Second, review your accounts' active sessions and signed-in devices from another device, and sign out of the old phone remotely wherever that option exists. Third, if the phone still appears in your find-my-device list and you genuinely cannot get it back, use the remote erase option — but only if you are certain the phone is still yours to erase and has not already been resold to an innocent buyer, in which case erasing it would harm someone else. Fourth, watch your accounts for unfamiliar activity for the next few weeks, and review the recovery steps in our Hacked Account Recovery Guide and Data Breach Recovery Guide if anything looks wrong. In most cases, a quick password change and session cleanup closes the gap completely.
Preparing a phone for a new owner takes about half an hour, most of it waiting for backups and encryption to finish. Spend that half hour. It is the difference between handing someone a clean, usable phone and handing them a copy of your digital life.