How to Safely Sell or Dispose of an Old Phone

Old phones change hands quickly: sold to a shop, handed to a relative, or left in a drawer until forgotten. What gets overlooked is what's still inside. Not just photos and chats, but the home Wi-Fi password, app sessions still live on servers, access to cameras and smart locks, and the number used for OTP codes. The order below handles all of it, and the order matters: erasing first makes several steps impossible.

1. Back up once, first

Copy photos, contacts, and notes to the new phone or a computer. After the next steps, some data can't be retrieved. Check apps that store data only on the device: note apps without accounts, health apps, and authenticator apps.

2. Move authenticator apps before anything else

This is the most common way people lock themselves out of their own accounts. Google Authenticator, Authy, and other two-step code apps keep their keys on the device, not in an account. Move them to the new phone using the built-in transfer feature before the old phone is erased. If it's already gone, recovery means backup codes or a long account recovery process.

3. Sign out of accounts, don't just reset

A factory reset on a phone whose account is still linked triggers activation locking: Factory Reset Protection on Android, Activation Lock on iPhone. A buyer won't be able to use it without your account password, and the shop will hand it back. So:

• Android: Settings, Accounts, sign out of the Google account. If the phone uses a Samsung, Xiaomi, or Oppo account, sign out of the manufacturer account too.
• iPhone: Settings, tap your name, Sign Out. This also turns off Find My and Activation Lock.
• WhatsApp: migrate to the new phone first, or log out of the app.

4. Unlink devices that phone controls

The most overlooked part, and the riskiest for a home full of smart devices. An old phone is often still registered as a controller:

• CCTV cameras and doorbells. Remove that phone from the camera app's list, then add it again from the new phone. Why it matters is in Wi-Fi CCTV security.
• Smart locks, bulbs, plugs. Same: unlink from the account, don't just uninstall the app. See smart home device security.
• The router. If that phone was used to set up the router through the manufacturer's app, remove it from the app's user list and change the router admin password. Guide: securing a home router.
• Cars, TVs, and speakers ever paired by Bluetooth or account.

5. Think about the home Wi-Fi password

A phone stores the password of every network it has joined, and on both Android and iOS the owner can easily view them again. A factory reset clears them, but if the phone is handed over without a reset, or lost before it can be erased, change the home Wi-Fi password. How to in changing your Wi-Fi password, and what's stored in viewing saved Wi-Fi passwords.

6. Only then erase

Once every account is signed out, run the factory reset. On Android 6 and later and all iPhones, internal storage is already encrypted, so the reset discards the encryption key and leftover data can't be read. There's no need to "fill the memory with videos" as older advice suggested for pre-encryption phones.

Two things a reset doesn't touch: the SIM card and the memory card. Remove both physically. A memory card you'll reuse just needs formatting; one you won't is better destroyed. For the SIM, remember your number is the path OTP codes travel; if the number is no longer used, cancel the service with the operator rather than letting it lapse and be recycled to someone else. Context in SIM card registration.

If the phone is being thrown out, not sold

A broken phone that won't power on still holds its data. Since it can't be reset, handle it from the account side: change your Google or Apple ID password from another device, then remove that device from the account's device list. After that, don't put it in ordinary rubbish. Crushed lithium batteries can catch fire, and the components are hazardous waste. Many cities have electronic waste collection points, and some phone shops accept old devices for recycling.

Also worth thinking about: family hand-me-downs

A phone given to a child or parent isn't going to a stranger, but should still be reset so it doesn't carry the previous owner's accounts, sessions, and history. For elderly parents there are different and more important setup steps, covered in setting up safe internet for elderly parents.

The short order

Back up, move authenticator apps, sign out of every account, unlink cameras and smart devices that phone controls, consider changing the Wi-Fi password, then factory reset, and finally remove the SIM and memory card. Doing it in reverse makes several steps impossible.

Frequently asked questions