How to Erase Mobile Phones Before Disposal

A mobile phone can hold years of business activity in a device small enough to fit in a pocket. Email, authentication tokens, customer contacts, photos, messages, browser sessions, VPN profiles, and cloud access may remain exposed long after an employee stops using it. Knowing how to erase mobile phones correctly is therefore a security control, not a housekeeping task.

A factory reset is often part of the process, but it is not the entire process. A defensible mobile erasure workflow confirms the device is under organisational control, removes cloud and account locks, erases local data, validates the result, and records what happened. The right method depends on the operating system, device condition, encryption status, and final disposition.

How do I securely wipe company phones before recycling them?

Record each phone, remove accounts and activation locks (Apple Account with Find My, Google accounts), erase it with a method that destroys the encryption keys, confirm the result and keep a record. Phones that will not power on should be physically destroyed.

How to erase mobile phones securely

Start by identifying the device, its assigned user, serial number or IMEI, operating system, and intended disposition. A phone being redeployed internally has different requirements than one being resold, returned at lease end, donated, or physically destroyed. In every case, preserve the asset record before wiping it. Once the phone is erased, recovering those details can become difficult.

Next, confirm that business data has been retained according to policy. This does not mean copying everything from the phone. It means preserving records that are subject to retention, legal hold, or operational need through approved systems. Do not create an unmanaged backup simply to make wiping easier. That can transfer the same data risk to another location.

The device should then be removed from mobile device management (MDM) only when the selected workflow calls for it. In some environments, MDM is the best way to issue a managed erase command and document completion. Removing the device too early can eliminate that control and leave the IT team unable to confirm whether the reset succeeded.

Remove accounts and activation controls first

Account protection is designed to prevent unauthorised reuse of a phone. It also creates a problem when a legitimate organisation sells or transfers a device without removing the prior user’s account. Before erasure, remove corporate and personal account associations in accordance with policy.

For Apple devices, this commonly includes signing out of the Apple Account and disabling Find My. Failure to do so can leave Activation Lock in place, making the phone unusable for the next owner. Organisations should use supervised-device and MDM capabilities where available rather than relying on a former employee to complete these steps.

For Android devices, remove Google accounts and any manufacturer account associated with the device. This helps prevent Factory Reset Protection from locking the handset after it is reset. Also remove work profiles, enterprise certificates, managed VPN configurations, and device-specific authentication apps through the approved management process.

This step is not merely about resale value. Accounts can retain access to cloud storage, email, messaging services, and multifactor authentication. If a departing user has personal data on a company-owned phone, follow your privacy and HR policies before removing accounts or collecting the device.

Use the platform’s secure erase function

Current iOS and Android devices generally rely on hardware-backed encryption. When encryption is properly implemented, a secure reset can erase the encryption keys that protect local data. Without the keys, the encrypted information on the device storage should be inaccessible through normal recovery methods.

On iPhone, use the built-in option to erase all content and settings after account and activation-lock requirements are addressed. For managed fleets, a remote erase initiated through MDM can provide centralised control when the device is online. Confirm the command status, not just that it was sent.

On Android, use the operating system’s factory data reset function or a managed wipe command from the organisation’s UEM or MDM platform. Android behaviour can vary by manufacturer, OS version, device management state, and storage configuration. Older devices, modified operating systems, or devices with removable storage require additional review. A reset that is suitable for a modern encrypted phone may not provide the same assurance on unsupported legacy hardware.

Do not confuse deleting files, uninstalling applications, or removing a work profile with a complete device erase. Those actions can leave local files, cached credentials, application data, or personal information behind. A full reset or approved managed erase is the baseline for a device leaving its current user.

Address SIM cards, eSIMs, and removable media

A phone reset does not always resolve every data-bearing component. Physical SIM cards may contain contacts or carrier information and should be removed, inventoried, and either reassigned or securely destroyed according to policy. If the organisation manages eSIMs, coordinate with the carrier or management platform to deactivate the cellular plan and remove the eSIM profile when appropriate.

Removable microSD cards deserve separate treatment. They may contain downloads, camera media, offline files, or application data that is not fully addressed by a handset reset. If the card will be reused, erase it with a method appropriate to its technology and verify the result. If it is damaged, encrypted with unknown keys, or not worth reusing, physical destruction may be the more defensible option.

Accessories can also contain information. Review paired smartwatches, external storage, rugged-device expansion modules, and removable secure elements where applicable. Mobile retirement is often incomplete because the process focuses only on the handset.

Verify the device is actually ready to leave

A completed wipe should be validated before the phone is transferred, resold, or sent to a recycler. Power the device on and confirm it starts at the initial setup screen with no visible business profile, user files, or enrolled accounts. Check that activation or factory-reset locks have been cleared when the device is intended for reuse.

For managed environments, reconcile the physical device against the MDM console and asset inventory. The record should show the device identifier, wipe date, wipe method, technician or automated system responsible, verification status, and final disposition. If the device is being destroyed, record the destruction method and chain of custody as well.

This evidence matters when an auditor, customer, insurer, or regulator asks a direct question: what happened to the device and its data? A verbal assurance from a technician is not an audit trail. Repeatable records turn a one-time device action into a defensible control.

When factory reset is not enough

There are situations where a standard reset should not be treated as the final answer. A phone may be nonfunctional, locked by an unknown account, running an outdated operating system, rooted or jailbroken, or unable to complete the wipe process. Devices with suspected malware or compromised firmware also warrant a more cautious workflow.

If the handset cannot boot or cannot be reliably erased, do not resell it based on assumption. Escalate it for approved physical destruction or a specialised data-destruction process. The same applies to devices from highly regulated workflows where policy requires documented evidence of sanitisation or destruction.

Organisations handling HIPAA-regulated information, financial records, controlled data, or sensitive customer information should align mobile-device retirement with their broader media sanitisation policy. NIST-based procedures, documented chain of custody, and consistent validation create a stronger control than ad hoc resets performed at a desk drawer.

For teams that manage computers alongside mobile devices, our RedKey USB supports a repeatable approach to secure data erasure on supported disks without per-device wipe limits or recurring subscription costs, and the Ultimate edition adds erasure for supported iPhone, iPad and Android devices. The key is to apply the correct approved method for each device type rather than forcing every asset into the same workflow.

Build mobile erasure into the offboarding process

The safest erase is the one that happens consistently. Make device collection and secure wiping a formal part of employee offboarding, hardware refreshes, lease returns, and IT asset disposition. Assign ownership between IT, security, HR, and asset management so no phone sits untracked while accounts remain active.

A practical policy should define when a remote wipe is allowed, when a physical device must be collected, how account locks are removed, how exceptions are escalated, and what evidence must be retained. It should also distinguish corporate-owned devices from BYOD devices. Wiping a personal phone without authorisation can create legal and employee-relations issues, even when business data is at stake.

Mobile phones are easy to replace, easy to misplace, and easy to underestimate. Treat each retirement event as a controlled data-destruction task. When the wipe is verified and documented, the device can move to its next destination without carrying your organisation’s information with it.

Frequently asked questions

Does a factory reset on Android make data unrecoverable?

On modern encrypted Android devices, a factory reset that destroys the encryption keys makes the remaining data unreadable in practice. Remove Google accounts first so Factory Reset Protection does not lock out the next user.

Can I wipe a stolen phone or laptop?

Only if it was enrolled in MDM or a find-my-device service before it was stolen and it connects to the internet. Report the loss and assess it as a possible data breach either way.

RedKey USB Ultimate erases supported iPhone, iPad and Android devices and produces a PDF report for each. Related reading: Mobile Sanitisation Tools for Secure Device Retirement and How to Prepare Devices for Resale Securely.