Selling an old phone or laptop? Signing out is only the beginning

Your new phone is working and your pictures are in the cloud, so the old one is ready to sell. It is tempting to think that deleting a few files and signing out of email will do. A device remembers much more: conversations, saved accounts, browser history, Wi-Fi networks, documents, banking apps and the route back into your accounts.

Preparing it for somebody else does not have to become a technical project. It does need the right order: make sure you will not lose anything, detach the device from your accounts and only then use its built-in erase function.

Move what you still need first

Make a backup and test it on the new device. A “backup complete” message alone does not prove that you can recover your photographs, contacts or important notes. Open a few files, check the latest pictures and confirm that the conversations and documents you rely on are present.

Think about account access before wiping the old phone. If sign-in codes arrived there or came from an authenticator app, move that method to the new device. Store recovery codes wherever you normally keep important records. Move the SIM, remove any memory card and check whether a watch, headphones or car still depends on the old device.

Stop here if it belongs to your employer. A company laptop or phone should return to IT through the organisation’s process. Selling it yourself is not appropriate, even after a reset.

Remove the ties to your accounts

Sign out of the manufacturer’s main account and any service that binds the device to your identity. Remove it from trusted-device lists where the manufacturer’s instructions require that step. Disable activation lock or factory reset protection as well. Otherwise, the buyer may receive an unusable device and you may receive repeated requests for your password.

Never give the buyer a password or code so that they can “finish the reset”. If the erased device still asks for your account, take it back and complete the missing step yourself using the manufacturer’s official guidance.

Use the built-in erase function, not manual tidying

Deleting photographs, uninstalling apps or emptying the recycle bin does not prepare a device for a stranger. In settings, use the option the manufacturer calls “erase all content”, “erase all data” or “factory reset”. The wording varies, so use the current instructions for that exact model if you are unsure.

When it finishes, the device should start at the welcome screen, ready for first-time setup. Do not complete that setup for the buyer. Confirm it is no longer listed under your devices and contains no SIM or memory card. You may want to keep a record of the serial number and sale, but remove labels showing your name, employer or asset number.

What if the device will not start?

A broken display or dead battery does not make the data disappear. If you cannot complete the erase, do not sell the device as “broken, contents included”. Check the official account for a remote-erase option or use a trusted repair service and agree explicitly what will happen to its storage.

At work, hand this case to IT. The organisation may need evidence that data was erased or the storage was physically destroyed. Old hardware can still hold valuable information.

If you are buying second-hand

Ask the seller to remove their account and activation lock before the handover. Reset the device yourself according to the manufacturer’s instructions after you receive it. Check whether the model still receives security updates too. A low price cannot make up for a phone that is no longer suitable for banking or email.

What the source says and what Breachroad recommends

The UK’s NCSC guidance on buying and selling second-hand devices advises people to back up what they need, preserve access to accounts and verification codes, erase all data and disable locks that would prevent a new owner from setting up the device. It also points readers to manufacturer guidance because the exact steps vary by model.

Breachroad’s conclusion is to treat a sale as a short transfer process, not a quick “sign out and hand it over”. Organisations should give that process an owner, a small checklist and a separate route for damaged devices.

For more everyday guidance, read How to secure your smartphone. To turn situations like this into simple habits across a team, explore our cybersecurity training for organisations.