Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Hand over the device, not access to your digital life

    Back up what you need, remove accounts and cards, then use the built-in erase option before a device changes hands.

    Owners of phones, tablets and computersAbout 6 minutes of reading + 3 questions
    Start with the example Already handed over a device with your data?

    What you will learn

    • Prepare data and accounts before erasing a device.
    • Distinguish ordinary file deletion from a factory reset.
    • Handle second-hand purchases and repair handovers more safely.

    Practice example

    An old phone is going to a new owner

    Photos were deleted from the gallery, so the phone is ready for the buyer. Accounts and the eSIM are still active.

    1. 01Accounts remain connected
    2. 02Only visible files were deleted
    3. 03SIMs and payment cards were not checked
    Fictional example for practice.
    Show the example explanation
    Accounts remain connected
    The next owner may reach email, photos, backups or device-location features.
    Only visible files were deleted
    Use the manufacturer's official process for removing content and settings.
    SIMs and payment cards were not checked
    Physical SIMs, eSIMs, storage cards and digital wallets each need attention.

    Before you erase the device

    1. Back up the data you want to keep and confirm that you can open it.
    2. Confirm that you have passwords, access to the second factor and recovery codes.
    3. Transfer authenticator apps and test sign-in on the new device.
    4. Remove payment cards and passes from digital wallets.
    5. Sign out of accounts and disable the owner’s activation lock using the manufacturer’s instructions.
    6. Remove physical SIM and storage cards, and check the eSIM status.

    Erase the device correctly

    Find the controls for Android, iPhone, Windows or Mac. Read the preparation and limitations before confirming erasure.

    Use the built-in “Erase all content”, “Reset” or “Factory reset” option described in the manufacturer’s official guidance. Do not rely on manually deleting photos, messages or applications.

    When the process finishes, confirm that the device opens on its initial setup screen and does not show your account. Return a business device through your organisation’s process; erasing it yourself may remove evidence or conflict with device-management rules.

    If the device is going for repair

    • Make a backup before handover.
    • Ask whether the repair genuinely requires an unlocked device.
    • Enable maintenance or repair mode if the manufacturer supports it.
    • Remove SIMs, storage cards and data not needed for diagnosis.
    • Do not disclose an account password or confirmation code. If a device PIN is required, change it after return.

    When buying a used device

    Check that the model still receives security updates. It should be factory-reset and removed from the previous owner’s account. Update it before signing in to important accounts, and do not use a device that asks for somebody else’s activation password.

    If the device has already been handed over

    1. Review connected devices through the official account and end active sessions.
    2. Use the official lock or remote-erase feature if available.
    3. Change passwords for accessible accounts and review the second factor.
    4. Notify your bank if a banking app, card details or code messages were available.
    5. Report a business device to your organisation immediately.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    You deleted photos and messages from a phone. Is it ready to sell?

    Why does this matter? Deleting individual items may leave accounts, session tokens, apps and other data on the device.

    1. Yes, if the gallery looks empty.

      An empty gallery does not mean all personal and access data is gone.

    2. No; back up, remove accounts and use the manufacturer's factory-reset process.Correct answer

      This order preserves what you need and removes access before ownership changes.

    3. Yes, if the buyer receives it without the physical SIM.

      The device holds much more than the physical SIM.

    What should you confirm before a factory reset?

    Why does this matter? Erasure can remove the only copy of data and access to codes needed for your accounts.

    1. That the backup works and I can access my accounts and recovery codes.Correct answer

      A tested backup and recovery access prevent protection from becoming data loss.

    2. Only that the battery is full.

      Power is useful, but it is not the only necessary check.

    3. That the buyer knows my screen PIN.

      The buyer does not need your PIN; the device should be erased first.

    The device has already been handed over with an account signed in. What do you do first?

    Why does this matter? An active session may allow access to data and other connected services.

    1. Use a trusted device to end the session or the official remote-erase feature, then secure affected accounts.Correct answer

      Official remote controls and account protection can restrict access without revealing more secrets.

    2. Wait for the new owner to erase it.

      Waiting extends the period in which data may be available.

    3. Send them the account password so they can sign out.

      Sharing the password exposes other devices and services too.

    No registration. Your answers are not sent; the result is just for you.

    Back up, sign out, then erase

    Use the manufacturer's built-in option and confirm that the device starts as new, without your account.

    Build backups you can actually restore

    References

    Sources and further reading

    The preparation and erasure sequence is based on the UK National Cyber Security Centre guidance on buying, selling and donating second-hand devices (United Kingdom). Exact steps vary by manufacturer; use its current official instructions.

    Content last reviewed