Someone wiped their Android, handed it over, got home, and realised their two-factor authentication app had gone with it. Every account it protected — email, bank, work login — was now behind a code generator that no longer existed on any device they owned.
The phone was wiped correctly. That was the problem. Everything went, including the things they needed to take with them.
A reset is not one action. It’s the last step in a sequence, and the steps before it are the ones that cause pain when skipped.
What a factory reset actually does
Worth understanding, because it changes how much you need to worry.
Modern phones encrypt their storage by default. iPhones have done this for years; Android has used file-based encryption as standard since Android 10. Your data doesn’t sit on the chip in readable form — it sits there encrypted, and the keys live in a small protected area.
When you erase a modern phone, it destroys those keys. The data is still physically present on the storage, but without the keys it’s unreadable noise. That’s why the process takes seconds rather than the hours you’d expect for wiping a couple of hundred gigabytes.
Two practical consequences. First, on any reasonably current phone, a proper factory reset is genuinely sufficient — you don’t need to fill the storage with junk files and reset again, which is advice left over from the unencrypted era and is now just wear on the flash memory. Second, on very old devices that predate default encryption, that old advice still has some merit.
What a reset does not do: remove your account from the device’s ownership record. That’s a separate thing, it’s the cause of most post-sale disputes, and it’s covered in our guide to removing iCloud and Google accounts.
Before you erase anything: the migration checklist
Do these in order. The reset is step nine.
1. Move your two-factor authentication codes
This one first, because it’s the one that ruins weeks.
Authenticator apps generate codes locally. Wiping the phone destroys them, and unless you’ve enabled the app’s own cloud sync or exported your accounts, you lose access to every account they protect. Some authenticators offer an export-and-import flow via QR code; others sync to an account. Whichever yours uses, do it now, verify a code works on the new device, and only then continue.
While you’re there, print or save your backup codes for anything critical.
2. Back up properly, and verify it
On iPhone: iCloud backup, or a computer backup via Finder. Check the timestamp afterwards rather than assuming it ran.
On Android: the Google One backup covers apps, settings, call history, and messages, but coverage varies by manufacturer. Samsung Cloud handles some Samsung-specific data separately.
Verification matters more than the backup itself. Open the backup listing, confirm the date, confirm the size looks plausible.
3. Move your messaging history
WhatsApp, Signal, and similar apps store chats locally with their own backup and transfer flows. These don’t come along with a general phone backup reliably, and Signal in particular requires an explicit device transfer while both phones are working.
4. Deregister iMessage if you’re moving to Android
Skip this and your number stays associated with iMessage, which means texts from iPhone users get routed into a service your new phone can’t receive. Messages appear to send from their end and never arrive at yours.
Turn off iMessage in Settings > Messages before you wipe. If the phone’s already gone, Apple runs a self-service deregistration page for exactly this situation.
5. Unpair anything connected
An Apple Watch should be unpaired from the iPhone before the phone is erased — the unpair process creates a fresh backup of the watch, which you’ll want. The same logic applies to fitness trackers and earbuds tied to a manufacturer account.
6. Sort out the SIM and eSIM
Physical SIM: take it out. Obvious, and people still forget.
eSIM: the profile lives on the phone, not on a card. During the iPhone erase flow, iOS asks whether to keep or delete the eSIM — delete it only after your carrier has moved the number, or you’ll be making a support call. On Android, remove it under the network settings before resetting.
7. Deal with the SD card
Removing it is the safe option. Formatting it inside the phone is the second-best. If the card was encrypted by the phone, it becomes unreadable elsewhere anyway, but don’t rely on that as your only protection.
8. Note anything tied to the device rather than the account
Some purchases, licences, and app subscriptions bind to hardware. Rare now, but worth a scan through anything you paid for.
9. Now remove your accounts, then reset
Order matters enormously on Android and is handled for you on iPhone. Details below.
Wiping an iPhone
Settings > General > Transfer or Reset iPhone > Erase All Content and Settings.
This single flow does the whole job: it signs you out of your Apple Account, turns off Find My and Activation Lock, deletes the eSIM if you choose, and destroys the encryption keys. It will ask for your Apple Account password, which is the mechanism that stops a thief from doing the same thing.
Do not reset via recovery mode as a shortcut. That erases the software without releasing Activation Lock, and the result is a phone that boots to a screen demanding your credentials — in the buyer’s hands, after money has changed hands.
Afterwards, check that the device has left your account: sign in at the Apple account devices page and confirm it’s no longer listed.
Wiping an Android phone
The order is the part people get wrong.
Remove the Google account first. Settings > Passwords & accounts > select your Google account > Remove account. Remove any Samsung, Xiaomi, or other manufacturer account the same way.
Then factory reset. Settings > System > Reset options > Erase all data (factory reset). Menu wording varies by manufacturer; on Samsung it’s Settings > General management > Reset.
Doing it in the other order triggers Factory Reset Protection, which locks the phone to the last account signed in before the reset. The buyer then needs your credentials to get past setup, and the only fix involves you signing back in on a phone you no longer own.
Two extra Android steps worth taking:
- Check Settings > Security or the top of Settings for any device management profile, especially on an ex-work phone. Enrollment survives a factory reset.
- If you’ve ever unlocked the bootloader or rooted the phone, disclose it. It affects banking apps and contactless payment for the buyer, and it’s the sort of thing that turns into a dispute.
After the wipe, before the handover
Boot the phone up and walk it to the first setup screen. You’re checking two things: that it starts cleanly, and that it doesn’t ask for anyone’s account credentials.
If it does ask, stop. The reset happened in the wrong order, and the fix is much easier while the phone is still in your hands.
Then leave it at that setup screen for the buyer. Handing over a phone that’s already been set up on a fresh account is unnecessary and slightly odd; handing over one sitting at the welcome screen is exactly right, and it lets the buyer complete setup themselves, which is what any careful buyer will insist on anyway.
Veelvoorkomende fouten om te vermijden
- Wiping before migrating your authenticator app. The most expensive mistake on this list, measured in hours of account recovery.
- Factory resetting an Android before removing the Google account. Creates a locked phone and a dispute.
- Using recovery mode to erase an iPhone. Leaves Activation Lock intact.
- Assuming a general backup covers WhatsApp and Signal. It doesn’t, reliably.
- Forgetting to deregister iMessage when moving to Android. Weeks of missing texts, and it’s not obvious what’s wrong.
- Leaving the eSIM on the device. Minor, fixable, still a phone call you didn’t need to make.
- Not checking the account devices list afterwards. Ten seconds of confirmation.
Veelgestelde vragen
Does a factory reset really delete everything?
On any phone from the last several years, effectively yes — the reset destroys the encryption keys, which makes the remaining data unreadable. Overwriting the storage afterwards adds nothing on an encrypted device.
What’s the correct order for an Android phone?
Back up, move your authenticator codes, remove the Google and manufacturer accounts, then factory reset. Removing accounts after the reset is what triggers Factory Reset Protection.
Do I need to remove the SD card?
Removing it is safest. If you leave it in, format it separately — a factory reset doesn’t necessarily wipe external storage.
What happens if I forget to sign out of my Apple Account?
The phone stays Activation Locked to you and won’t complete setup for the buyer. You can remove it remotely from your account’s device list, provided the device has been erased, which is why disputes over this are usually fixable if the buyer can reach you.
Should I reset the phone before or after listing it?
After. You’ll want it working for photographs and for any questions a buyer asks, and a phone sitting wiped in a drawer for three weeks helps nobody. Reset it the morning of the handover.
Do the authenticator step now, before you read anything else about selling. Everything else on this list is recoverable; that one costs a weekend.
Once the phone is clean, list it on ExploreFrag, and if you want the highest final number, our guide on pricing and timing a private sale covers what actually moves the price.
About the author
Emran Ahmed is the founder and CEO of ExploreFrag, a marketplace for buying and selling used phones and accessories across every brand. A significant share of ExploreFrag’s post-sale support messages come down to a reset done in the wrong order, which is why the Android sequence in this guide is spelled out so bluntly. He wipes every device he sells the morning of the handover, never the week before.