Before you sell or give away a phone or computer, back it up, sign out and reset it

Your phone holds more than photos. It holds messages, saved passwords, banking apps that are already signed in, and the codes that let you into other accounts. The UK’s National Cyber Security Centre (NCSC) puts it this way: our devices “contain more work, personal and financial data than ever before,” and if you are selling, donating or trading one in, “you should erase all of this personal data so it doesn’t fall into the wrong hands.”

Before you sell, trade in or give away a phone or computer, back it up, sign it out of your accounts, and then use the device’s own factory reset, which some makers call “erase all content and settings”.

This page is for a phone, tablet or computer you are selling, trading in, donating or handing to someone. It is not about a device that is lost or stolen, or one that belongs to your employer, where your IT department decides. It covers the US and the UK.

If someone you are afraid of shares these accounts, set up this device or can see it, signing it out or removing it from your accounts can show them that something has changed. The National Network to End Domestic Violence’s technology safety plan (2018) warns that “some abusive individuals may escalate their controlling and dangerous behavior if they feel they’ve lost access to the victim,” and suggests using a device the person has never had access to. Talk to a domestic abuse helpline before you change anything: in the US, the National Domestic Violence Hotline on 1-800-799-7233, at any hour, or text START to 88788; in England, the National Domestic Abuse Helpline, run by Refuge, on 0808 2000 247; in Wales, Live Fear Free on 0808 80 10 800; in Scotland, the Domestic Abuse and Forced Marriage Helpline on 0800 027 1234; in Northern Ireland, the Domestic and Sexual Abuse Helpline on 0808 802 1414. If you are in danger now, call 911 in the US or 999 in the UK.

Before you erase

The order matters, because a reset cannot be undone and it can lock you out of things you still use.

1. Back up what you want to keep. The US Federal Trade Commission (FTC) and the NCSC both start here. There is a page here called Back up what you can’t replace, then prove it opens.
2. Check your accounts. The NCSC says that if your device keeps you logged in to banking, shopping, email or social media, make sure you know those logins before you erase it. If you use it to confirm text-message codes, check that this works on another device before you erase the one you are giving away. If it controls smart-home devices such as cameras or a thermostat, make sure you can manage them from another device.
3. Unlink the device. The FTC says that if you use multi-factor authentication, remove the phone from the list of trusted devices for those accounts, and double-check that it is no longer connected to your online accounts. One person says a device left signed in to its owner’s cloud account can end up locked and unusable for the next owner, and then only fit for recycling.
4. Remove the SIM and any SD card. The FTC says a SIM card may hold personal information; you can ask whether it can move to your new phone, and if you will not reuse it, destroy it. Take out any SD storage card too.
5. Reset. The NCSC says “the best way to make sure that your data is completely erased” is the device’s “Erase all Content and Settings” or “Factory reset” feature, whose name depends on the device. It warns that you may be offered a choice to keep your personal files, and says to make sure you don’t choose that when selling, trading in or giving the device away. For a computer, the FTC says the operating system comes with a program that erases all your files and resets the drive to factory settings, and links to the steps for Windows, Chromebook and Mac. This page does not give model steps; your maker’s support page does.

Is a factory reset enough?

For a phone, the FTC says yes: restoring it to its factory settings erases all your personal information, such as account numbers, passwords, messages, videos and photos. For a computer, the NCSC’s guidance for organisations says the answer depends on encryption. On a device with encryption, a reset deletes the encryption keys, which makes the data unreadable, and “for most devices, a ‘factory reset’ will provide a satisfactory level of assurance.” For a device that does not use encryption, it describes overwriting the whole drive and then reading it back to check, and says commercial tools can do both. If you do not know whether your computer’s drive is encrypted (on Windows this is called BitLocker or device encryption, and on a Mac, FileVault), your maker’s support page says how to check.

The NCSC also says no reset can promise everything: “All devices operate differently, so using these reset procedures cannot guarantee that all user data has been rendered unreadable.” A footnote on the NCSC’s consumer page adds that “a determined expert - using specialist tools - may still be able to recover the data on a device.” NIST, the US standards agency, describes a factory reset as a “clear” method, which protects against “simple, non-invasive data recovery techniques.” It gives, as an example of a reset on a basic device that cannot rewrite its storage, “deleting the file pointers.”

Some people say a factory reset does not erase data at all, only the index to it. That is not what the FTC says about phones or the NCSC says about encrypted devices, but the NCSC and NIST wording shows where the worry is real: on a device without encryption, and on a basic device that cannot rewrite its storage. One person says modern phones encrypt their data, so a reset that deletes the keys leaves little to recover in practice. Another says recovering data is costly, so professionals go after high-value targets rather than ordinary people.

Three more things to know:

• Other devices. The NCSC says smart TVs, fitness trackers, speakers and games consoles also hold personal information, and that their makers’ sites explain how to factory reset them. Its sanitisation guidance says several gigabytes of sensitive documents have been retrieved from decommissioned photocopiers and printers. One person describes donated copiers whose drives were never wiped, and another says an old digital camera’s internal memory has to be wiped separately from its SD card.
• Cards and sticks. The NCSC lists USB drives and SD and microSD cards as storage media that can hold data. Its guidance says “Simply hitting the ‘Delete’ key isn’t enough.”
• Repeated overwriting. Many people recommend wiping software that overwrites a drive many times. NIST’s September 2025 revision, written for organisations, says for certain SSDs “such practices should be avoided as very little confidentiality protection is achieved.” This page does not teach that method.

If the device held data that must never be recovered, the NCSC’s secure sanitisation guidance, written for organisations, describes overwriting and verifying the whole drive, and for the highest risk destroying the media to particles of 6mm or less with commercial equipment. Many people describe destroying a drive at home; this page does not carry those methods. Breaking a device open at home can hurt you: one person warns that drilling into a sealed device can damage its battery and cause a fire, and the US Environmental Protection Agency says even used lithium-ion batteries “can have enough energy to injure or start fires”, and that a device with a battery put in the trash or the household recycling bin can be crushed and become a fire hazard. The FTC says most electronics contain hazardous materials that should not go into landfill, and points to the Environmental Protection Agency’s page on electronics donation and recycling.

If something goes wrong afterwards

If you think someone used personal information from a device you gave away, in the US you can report it at IdentityTheft.gov, which gives a recovery plan, and to the FTC at ReportFraud.ftc.gov. In the UK, Report Fraud covers England, Wales and Northern Ireland (0300 123 2040); in Scotland, its page says to report through Police Scotland on 101.

A drive you did not buy

The same question runs the other way: someone hands you a drive, or you find one. Many people say not to plug an unknown or found USB drive into your computer. The US Cybersecurity and Infrastructure Security Agency (CISA), in a page now archived and dated February 2021, says “Do not plug an unknown USB drive into your computer.” It says to give a found drive to the appropriate authorities, such as security staff or an IT department, and “Do not plug it into your computer to view the contents or to try to identify the owner.” It adds that some attackers have infected items such as electronic picture frames and USB drives during production, and advises disabling Autorun and keeping personal and work drives separate. Some people say a malicious device can be built to damage the computer it is plugged into. This page does not teach inspecting a found drive, and it found no UK consumer page on that topic.

Who this page is not for

If your phone is lost or stolen, this page does not cover tracking or locking it. If the device will not switch on, this page found no guidance for it, and your maker’s support page may. If the device belongs to your employer, return it to them. And outside the US and the UK, your own country’s rules apply.

A reset takes a few minutes. Most of the work is in the steps before it, which is where people lose access to their own accounts.