Only Formatting Your Phone Isn’t Enough! Before Selling It, Do This This Time…
Selling or giving away an old smartphone can feel as simple as backing up your photos, removing your SIM card, and performing a factory reset. However, formatting the phone should be treated as one part of the process, not the entire process.
Modern smartphones use strong storage security, and on many recent Android and Apple devices, a properly performed factory reset is designed to make the previous user’s data inaccessible. Apple says that Erase All Content and Settings renders user data cryptographically inaccessible, while modern Android devices use encryption to protect stored data.
The bigger problem is that people often confuse deleting files, resetting settings, removing an account, and performing a complete factory reset. They are not the same thing.
There is also a common piece of advice that says you should format a phone seven or eight times before selling it. That advice comes from older approaches to storage wiping and does not represent a universal requirement for modern smartphones. In fact, repeatedly overwriting flash storage is not the right sanitization strategy for every device. NIST’s current guidance emphasizes choosing a sanitization method appropriate to the storage technology rather than blindly repeating old overwrite procedures.
Here is what you should actually do before handing your phone to another person.
Why Only Formatting Your Phone Isn’t Enough?
The first thing to understand is what you mean by “formatting.”
If you simply delete photos, uninstall apps, remove some files, or use an option such as Reset All Settings, your personal information may still remain on the device. For example, Apple specifically states that Reset All Settings does not delete photos, messages, apps, or documents. For a phone being sold or given away, Apple recommends Erase All Content and Settings instead.
Even when you perform a proper factory reset, there are several other things to consider.
Your phone may still be connected to your Google Account or Apple Account, your eSIM may still be active, your device may remain associated with an account-based security system, and information may remain on removable storage or in cloud services.
Android’s factory-reset process is designed to erase data from the phone, and Google recommends clearing your data and returning the phone to factory settings before recycling, trading in, or giving it away.
So, the goal isn’t simply to “format the phone.” The goal is to properly prepare, erase, disconnect, verify, and then hand over the device.
How Can Someone Steal Your Data Even After You Have Formatted Your Phone?
The answer depends heavily on the phone’s age, operating system, storage technology, encryption implementation, and the exact reset method used.
Deleted Data Is Not Always the Same as Sanitized Data
On storage devices, deleting a file can mean that the operating system no longer shows the file to you while some underlying storage information may still exist.
NIST distinguishes between ordinary deletion or “clear” operations and stronger sanitization techniques. Its guidance notes that manufacturers and storage technologies can implement different approaches, including secure erase and cryptographic erase.
This is one reason simply deleting your gallery, messages, downloads, and apps individually is not the right way to prepare a phone for sale.
Older Phones Can Be a Different Story
The risk is not identical across every smartphone.
Older phones may have weaker security designs or different storage implementations. Modern Android devices launched with Android 10 or later are required to use file-based encryption, while earlier Android versions used different encryption models.
That means an old phone should not automatically be treated as if it has exactly the same security architecture as a current smartphone.
Cloud Accounts Are a Separate Issue
Another common mistake is thinking that a factory reset deletes everything associated with your online accounts.
It doesn’t.
Your Google Account or Apple Account can continue to contain backups, photos, contacts, documents, and other synchronized information. Google explains that data backed up to a Google Account can be restored after a factory reset. Apple similarly explains that erasing an iPhone does not delete your iCloud content.
Therefore, device erasure and cloud-account management are two separate things.
Account Locks Can Also Remain Relevant
Android devices can use device protection after a factory reset. Google explains that a protected device may require the previous Google Account or screen-lock information during setup. Removing your Google Account before handing over the phone helps turn off this protection.
On iPhone, Activation Lock is tied to Find My. Apple says that when an iPhone is properly erased, Find My and Activation Lock are turned off.
This is important not only for your privacy but also for the person buying the phone.
How Many Times Should You Format a Phone Before Selling It? Do This 7 to 8 Times?
You generally do not need to factory-reset a modern phone seven or eight times.
This is an important distinction.
Repeatedly performing a normal factory reset is not a magic formula for making a smartphone secure. There is no general Apple or Google recommendation saying that consumers should factory-reset their phone seven or eight times before selling it.
NIST’s current media-sanitization guidance specifically warns against blindly applying old overwrite practices to modern flash-based storage. Sanitization methods need to be matched to the storage technology and device implementation.
So instead of doing the same reset eight times, follow these eight preparation steps:
Step 1: Back Up Everything You Need
Before erasing anything, make sure your photos, videos, contacts, documents, messages, authenticator information, and other important data have been transferred or backed up.
Google provides Android backup and restore functionality through your Google Account, while Apple recommends creating a backup before erasing an iPhone.
Do not erase the old phone until you have confirmed that the important information is available on your new device or in your backup.
Step 2: Check Your Important Apps
Before resetting the phone, open important apps and make sure you know how you will access them on your new device.
Pay particular attention to password managers, banking apps, authentication apps, messaging services, cloud storage, and other applications that may require additional verification.
This step is especially important if an authentication app is currently generating security codes for your accounts.
Step 3: Remove Your Accounts
Remove your personal accounts from the phone before handing it over.
On Android, removing your Google Account is important because Google’s device-protection system can otherwise require account credentials after a reset.
On an iPhone, sign out of your Apple Account and ensure that Find My is no longer associated with the device as part of the proper selling process. Apple’s instructions explain that erasing the device turns off Find My and Activation Lock.
Step 4: Remove the SIM and Check the eSIM
A physical SIM card should be removed before you hand over the phone.
If your phone uses an eSIM, pay attention during the erase process. Apple, for example, gives users the choice of whether to keep or erase an eSIM when erasing an iPhone. If you are transferring the phone to another person, you should make sure your mobile plan is no longer associated with the device.
Step 5: Remove a microSD Card
If the phone has a removable microSD card, don’t forget about it.
The factory-reset process may not handle an external storage card in exactly the same way as internal storage. If you’re keeping the card, remove it before selling the phone. If you’re selling it with the phone, handle the card according to its own security and storage requirements.
Step 6: Perform the Correct Factory Reset
Now perform the manufacturer’s recommended full factory reset.
On a recent Android phone, use the Factory Reset or equivalent option in Settings. Google states that a factory reset erases the data from the phone.
On an iPhone, go to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. Apple identifies this as the appropriate process for completely erasing the device.
Do not confuse this with an option that merely resets settings.
Step 7: Let the Phone Return to the Setup Screen
After the reset finishes, don’t immediately start setting it up again with your own account.
Instead, check that it has reached the initial setup screen.
For an iPhone, Apple says the Hello screen appears when the reset has completed.
At this point, don’t enter your Google or Apple credentials again. You are preparing the phone for its next owner.
Step 8: Verify Before Handing It Over
Finally, inspect the phone.
Check that your photos, messages, contacts, accounts, applications, and personal files are no longer visible. NIST recommends verifying multiple areas of a mobile device after a sanitization operation rather than simply assuming that the process worked.
For an ordinary consumer smartphone with a properly implemented modern factory reset and encryption, this verification is much more meaningful than performing the same reset seven or eight times.
Additional Tips Before Selling Your Phone to Anyone
Do not manually delete everything before performing the factory reset. If your information is already safely backed up, the complete manufacturer reset is generally the more appropriate final step.
Do not restore your backup after resetting the phone. Restoring the backup would put your personal information back onto the device you are trying to sell.
Check your cloud account separately. Your Google Account or iCloud account may still contain your photos, backups, contacts, and other information even after the physical phone has been erased.
Remove the device from your account where appropriate. This is particularly important for services that track trusted devices or use device-based security.
Turn off Find My before selling an iPhone when required. Apple notes that proper erasure disables Find My and Activation Lock.
Do not give the buyer your password. If the buyer needs the phone activated, they should create or use their own account.
Don’t hand over authentication information. Remove your authenticator setup or transfer it to your new device before resetting the old one.
Check browser and password-manager access. A properly reset phone should not retain your logged-in browser sessions, but verifying your accounts before the reset is still a useful precaution.
Keep proof of the sale or trade-in. Record the device’s serial number or IMEI for your own records before handing it over, where appropriate.
If the phone is extremely old or has unusual storage/security characteristics, check the manufacturer’s sanitization instructions. NIST notes that sanitization capabilities vary by device and storage technology.
FAQs
Is one factory reset enough before selling a phone?
For a modern smartphone that supports encryption and whose manufacturer provides a proper factory-reset process, the appropriate factory reset is generally the intended consumer method for removing personal data. Google and Apple both provide dedicated factory-reset procedures for preparing devices for reuse.
Should I format my phone 7 or 8 times?
No general rule requires seven or eight factory resets. Repeating the process does not automatically provide eight times the protection. Modern flash storage and device encryption make the correct sanitization procedure more important than simply repeating a reset.
Can deleted photos be recovered after a factory reset?
Recovery depends on the device, operating system, encryption, storage technology, and the exact erasure procedure. Modern phones are designed with substantially stronger storage protection than many older devices, but users should still follow the manufacturer’s complete erase procedure rather than relying on manual deletion.
Does factory resetting delete my Google or iCloud backup?
No. A factory reset removes information from the physical device. Data stored separately in your Google Account or iCloud can remain available online.
Should I remove my SIM card before selling my phone?
Yes. Remove a physical SIM card before handing over the phone. If the phone uses an eSIM, make sure your mobile plan is properly transferred or removed according to your carrier’s instructions.
What happens if I forget to remove my account?
You could create problems for both yourself and the next owner. Android’s device protection and Apple’s Activation Lock are specifically designed to prevent unauthorized use after a reset.
Should I encrypt my phone before resetting it?
Modern smartphones commonly use encryption as part of their security architecture, but the exact implementation depends on the device and operating system. Android’s security documentation describes encryption protections for user data, including file-based encryption on modern Android releases.
What is more important than formatting the phone multiple times?
Using the correct full erase procedure, removing your accounts, handling SIM/eSIM and removable storage, checking your backups, and verifying the final setup screen are more important than repeatedly resetting the device.
Final Words
Before selling a smartphone, don’t think of the process as “format it and sell it.” Think of it as “back it up, disconnect it, erase it, verify it, and then sell it.”
The idea that you must format a phone seven or eight times is not a universal security requirement for modern smartphones. Current guidance focuses on using a sanitization method appropriate to the device and its storage technology.
For most people, the safest practical approach is therefore straightforward: back up your data, transfer important accounts and authentication methods, remove your accounts and SIM/eSIM as appropriate, perform the manufacturer’s complete factory erase, and confirm that the phone has returned to its initial setup screen.