> ## Content Index
> Fetch the complete content index at: https://genius-marketing.ghost.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# A Factory Reset Is Not the Last Step. It Is the Third.
- URL: https://genius-marketing.ghost.io/a-factory-reset-is-not-the-last-step-it-is-the-third/
- Published: 2026-10-13T09:30:00.000Z
- Updated: 2026-10-13T09:30:00.000Z
- Author: Genius Marketing

Researchers at the University of Maryland bought 228 phones at police auctions over two years. Sixty-one of them, better than one in four, still held the previous owner's data: Social Security numbers, banking details, passport images, text messages. Not one of those owners thought their phone was still readable.  
  
The trade-in box going out this month is the same device. The difference is entirely in what gets done before it leaves the house.  

## Look Behind the Curtain

The good news first, because it is real. On a modern encrypted phone, a proper erase is not an overwrite, it is a key destruction. Apple's own platform documentation describes erasing as obliterating the keys in effaceable storage, rendering all user data cryptographically inaccessible. There is nothing left to recover because there is no key.

The qualifications matter though. NIST updated its media sanitization standard last September, retiring the previous revision, and it names two limits on cryptographic erasure: it cannot be trusted where keys were backed up or escrowed somewhere else, and today's cryptography is not guaranteed against tomorrow's. For laptops the picture is weaker. Microsoft's own documentation says, in plain words, that the consumer data-erasure function in Windows does not meet government and industry data erasure standards. It makes recovery harder, not impossible.

NIST's three levels are worth holding. Clear defeats casual recovery. Purge defeats a forensics lab while leaving the drive usable. Destroy means the drive no longer exists as a drive.

The steps people skip are the account-level ones. On an iPhone, erasing all content and settings does turn off Find My and Activation Lock, and the erase flow will offer to remove the eSIM profile. On Android it is the reverse trap: Factory Reset Protection stays armed unless you remove the Google account first, and Google's own reset instructions do not tell you to.

Then the question of who wipes it. The three big trade-in programs give three different answers. Apple tells you to remove your data before sending the device. Samsung states that it assumes no responsibility for personal information left on a device sent in as a trade-in. Verizon promises every device it receives is professionally wiped as part of inspection. Read the one you are actually using.

### The Capability Multiplier

The practical leverage is that the whole job is twenty minutes and identical every time, so it becomes a routine rather than a decision.

Start before the new device arrives, because the useful order is move, then erase, then release. The things that need moving are not files, which sync. They are the credentials: your authenticator app and its codes, which have their own transfer flow and will otherwise lock you out of your own accounts; passkeys, which sync through the platform keychain but only if that is switched on; your eSIM, which usually transfers through the carrier; and anything stored only in the device's local notes.

The release step is the one that quietly matters. Remove the device from your trusted device list and your account's device list after the erase. A phone you sold that is still listed as a trusted device for account recovery is a hole no wipe closes, because the hole is in your account, not the handset.

For a laptop drive you are discarding rather than selling, encryption is the whole defense. If the drive was encrypted in use, destroying the key is sufficient. If it never was, physical destruction is the only honest answer, and CISA's own consumer guidance says as much: do not rely on deletion, and if you cannot verify destruction, keeping the old drive in a drawer is safer than letting it go. The stakes are not theoretical: a major financial firm paid a thirty-five-million-dollar penalty in 2022 after decommissioned devices holding customer data were resold without being wiped.

### The Sovereign Action

Twenty minutes, in this order.

- Move the credentials first: transfer your authenticator codes, confirm passkeys are syncing, and move the eSIM through your carrier. Files sync; these do not.
- On Android, remove your Google account before the factory reset, or Factory Reset Protection stays armed. On iPhone, erase all content and settings and accept the eSIM prompt.
- On a laptop, confirm the drive was encrypted, then reset with the clean-data option. Microsoft is explicit that this is not a government-grade erase.
- Remove the device from your account's trusted and device lists afterwards. The wipe does not do this for you.
- Read your trade-in program's terms. One major manufacturer disclaims all responsibility for data you leave on the device; one carrier promises to wipe it.

![](https://storage.ghost.io/c/e5/b8/e5b8348a-6320-40d1-aa0f-5986247da086/content/images/2026/10/retiring-a-phone-the-right-way-2-person.jpg)