How to Sell Your Old Phone Without Leaking Your Data
Sell your old phone safely in 2026: sign out of accounts, back up data, remove SIM and SD cards, then factory reset and verify the wipe before you sell it.
Every few months someone sells a phone on a marketplace, does a factory reset, and then a week later gets a notification that somebody in another city has logged into their Instagram.
This happens for a specific reason. A factory reset removes your files from the device. It does not sign you out of anything, it does not necessarily remove the activation lock, and it does not touch an SD card at all. Those three gaps account for almost every "I wiped it and they still got in" story.
The order of operations matters enormously here, and the correct order is almost the reverse of what people intuitively do.
Step 1: Sign out of everything first
This is the step everyone skips, and it is the most important one.
Factory resetting a phone that is still signed in to your accounts does not necessarily sign those accounts out on the server side. Some apps and services keep a valid session token tied to the device for weeks or months. If that token survives the reset in any recoverable form, or if the new owner can restore from a backup that includes it, they have access.
So before you wipe:
- Sign out of your Google or Apple account. On iPhone: Settings, your name, Sign Out. On Android: Settings, Passwords and accounts, remove the Google account.
- Sign out of every social app individually. Instagram, WhatsApp, Telegram, Facebook, TikTok. Signing out of the device account does not always sign you out of these.
- Open WhatsApp and check Linked Devices. WhatsApp keeps sessions on up to four devices. If you are selling the phone, unlink it here. If you skip this, the new owner may still receive your messages for a period.
- Sign out of banking apps. Most of them will de-register the device when you sign out. Some require you to remove the device from the bank website as well, which is a separate step.
- Sign out of streaming apps, especially ones with saved payment methods. Netflix, Spotify and Amazon all keep device registrations.
Step 2: Back up anything you still want
Obvious, and still the step people regret. A full backup takes an hour and there is no way to undo the wipe.
- Photos and videos. Check the count against your phone storage before you trust the backup. Most "missing photos" disasters are a partial sync that nobody noticed.
- Message history. If you use iMessage or Google Messages, both can be backed up, but neither restores automatically to a different platform. Exporting to PDF is worth doing for anything you might need later.
- Two-factor authentication codes. This is the one people forget. If your authenticator app is on the phone you are selling, every account that used it becomes inaccessible the moment the phone is wiped. Export the codes or move them to a new device first.
- Saved WiFi passwords and notes. Usually synced, but worth checking.
- Anything in a local-only app. Offline games, downloaded media, voice memos that never synced.
Step 3: Encrypt before you wipe (or understand why it does not matter)
There is a lot of old advice about overwriting a phone multiple times with random data. It is obsolete, and following it wastes hours.
Modern phones encrypt their storage by default. On iOS this has been true since the iPhone 3GS, and on Android since version 6. When you factory reset an encrypted phone, the operating system throws away the encryption key. Every byte on the storage is now unreadable noise, even though the bytes are technically still there. Recovering anything is not a practical attack, it is a physics problem.
So the factory reset is sufficient, provided the phone was encrypted. Nearly all are. The only devices where this is not true are very old Android phones and cheap feature phones. If you are selling a phone from 2014, either accept the risk or physically destroy the storage.
Step 4: Factory reset
iPhone: Settings, General, Transfer or Reset iPhone, Erase All Content and Settings. You will be asked for your Apple ID password. That is the sign it is working correctly.
Android: Settings, System, Reset options, Erase all data. Some manufacturers bury this in a different menu (Samsung puts it under Settings, General Management, Reset). If the phone asks for your Google account password, the removal worked.
Let it complete fully. Do not pull the battery or force restart because it seems stuck. A wiped phone that failed halfway can leave the storage in an inconsistent state that a buyer might be able to partially recover.
Step 5: The hardware nobody remembers
A factory reset does not touch removable storage or the SIM. Both of these have caused real incidents.
- Remove the SIM card. This is your phone number and, in some countries, your carrier identity. Keep it or destroy it.
- Remove any microSD card. If you had photos set to save to the SD card, those photos are all still there, in full resolution, after the factory reset. This is the single most common data leak when selling an Android phone.
- Remove any case with a card holder. Sounds absurd, but people have left credit cards inside phone cases and sold them.
- If the SD card is going with the phone, wipe it separately on a computer. Deleting files on an SD card does not remove them; you need a proper format or overwrite.
Step 6: Verify the wipe actually worked
Restart the phone. It should boot to the setup screen, the same welcome screen you saw when you took it out of the box. If it boots to your home screen or asks for your Apple ID or Google account, the wipe did not complete. Start again.
Then check one more thing: sign out of the device on any account that has a "devices" list. Google has one at myaccount.google.com/device-activity. Apple has one at appleid.apple.com. Look for the phone you just sold and remove it. This catches any session that survived the reset.
Is it worth selling, or should you just recycle?
A four-year-old mid-range Android phone is worth $40 to $80 on a marketplace. After the fees, the shipping, the haggling, and the risk of a fraudulent buyer, the effective hourly rate is terrible.
A two-year-old iPhone is worth $250 to $450. That is worth the effort.
For anything in the middle, there are better options than selling: trade it in with the carrier or manufacturer (lower value, zero hassle, no risk), give it to a family member (real value, no transaction), or donate it to a charity that refurbishes devices.
And if the phone is genuinely dead, recycle it. Every carrier store accepts old phones, and most manufacturers run take-back programs. Do not put it in household waste. The battery is a fire risk, and the metals are recoverable.
The bottom line
The order is sign out, back up, remove the SIM and SD card, factory reset, then verify. Get that order wrong and you leave session tokens, activation locks or memory cards behind. Get it right and it takes about twenty minutes.
The two things people most often forget are the authenticator app and the microSD card. Both are painful, both are entirely avoidable.
Tools mentioned in this article
Frequently asked
Is factory reset enough before selling a phone?
For the data on the internal storage, yes, because modern phones are encrypted and a reset destroys the key. But a factory reset alone is not enough overall: you also need to sign out of accounts, remove the SIM and any microSD card, and turn off activation lock. Skipping any of those creates a real problem for you or the buyer.
What happens if I sell my phone without signing out of Google?
The buyer will hit Factory Reset Protection and be unable to set up the phone, because it will ask for the last Google account that was signed in. They will contact you, or file a dispute with the marketplace. On iPhones the equivalent is Activation Lock, which makes the device essentially worthless until it is removed remotely through iCloud.
Do I need to remove my SD card before selling?
Yes, always. A factory reset does not touch removable storage. If your camera was set to save photos to the SD card, every photo is still there in full resolution after the reset. This is one of the most common ways people leak personal data when selling an Android phone.
How do I check if an iPhone is properly wiped before selling?
Restart it. It should boot to the Hello screen, as if it were brand new. If it boots to a home screen, or asks for an Apple ID that is not yours, the wipe did not complete or Find My was not disabled. Reset it again.
What happens to my WhatsApp messages when I sell the phone?
If you do not unlink the device in WhatsApp settings, the new owner may still receive messages on that phone for a period. Open WhatsApp, go to Linked Devices, and remove the phone before you reset it. Your message history does not transfer to the new owner, but incoming messages can arrive on a linked device.
Should I overwrite my phone storage multiple times before selling?
No, that advice is outdated. Modern phones encrypt internal storage by default, and a factory reset destroys the encryption key, rendering all data unrecoverable. Overwriting multiple times is a waste of hours. The exception is very old Android phones and external SD cards, which may not be encrypted.
How do I sell a phone that will not turn on?
You can still sell it for parts, but the value drops sharply. Before you give up, try a different charger and cable, and hold the power button for 30 seconds. If it is genuinely dead, you cannot wipe it, so treat the storage as compromised: never sell a non-functional phone to a stranger if it contains sensitive data. Recycle it through a manufacturer take-back program instead.
What should I do with an old phone that is not worth selling?
Options in order of preference: give it to a family member who needs it, trade it in with the manufacturer or carrier for credit, donate it to a charity that refurbishes devices, or recycle it through a carrier store or manufacturer take-back program. Do not put it in household waste, because the battery is a fire risk.
Do I need to remove the SIM card before selling?
Yes. The SIM carries your phone number and, in some countries, is tied to your identity with the carrier. Removing it and either keeping it or destroying it prevents the buyer from receiving your calls and SMS, including the two-factor authentication codes that are sent by text.