Like most people nowadays, I have sensitive software on my phone. Banking apps, 2FA authenticators, password managers that sync to a server, access software to a cloud storage space; this sort of thing. For such use cases, is it risky to buy a used phone? I’d wipe it and re-install the OP from the server; but my worry is that somehow, a fraudulent previous owner could have hidden some spyware on the phone that persists after this re-install and gives them access to my sensitive data.
Google this: is there risk in buying a used smart phone
The list is daunting! 
I’d think that just physically, you don’t know what you’re getting, how many times it’s been dropped, how many screen replacements it’s had, and so forth.
I’d be more worried about that than any sort of residual sketchiness after a factory reset of the software and OS.
But why buy used? You’re almost certainly better off saving up and buying new, then using it into the ground than buying used.
That’s what I’ve been doing so far; I’ve used an iPhone 6, purchased brand new, for seven years and intend to do about the same for my current iPhone 12. But it’s stunning how low the second hand prices for even reasonably recent models are compared to new ones, so the idea has occurred to me.
I don’t think that the OP was thinking along these lines, but the thread title fits with a recent experience of mine. My stepdaughter bought a Samsung phone about two years ago and added it to our family plan under AT&T wireless. She wanted a nicer phone and found a good price. AT&T treats this as a BYOD (“bring your own device”) situation and they transferred her number to the new phone.
A month ago, she wanted to switch her phone to Mint. We had a terrible time doing this and could not get the transfer completed. She could not unlock the phone. Turns out that she had indeed found a good deal when she bought it..except that it was still being paid off over time by the seller. AT&T would not unlock the phone until I paid another $440 to complete the phone purchase. AT&T had no problem allowing the phone back on their wireless service even though it wasn’t paid off, but they wouldn’t unlock it so she could take it to another service.
Not such a good deal after all.
I think there are ways to check when buying used phones whether they are unlocked.
Yes, but stepdaughter wanted to do this on her own and she does not live with us. She is very tech-averse and didn’t even check with us before purchasing the phone and adding it to the plan as a replacement. She saw it, liked it, cash apped the seller, and it was done.
Again, she took it to an AT&T store and they were happy to port her number over. They never mentioned that there was a significant balance due on the phone. I guess they were just happy to get a check every month for the service.
I’ve never purchased a used smartphone but if I were doing so, I’d buy it from a retailer rather than a private seller. I assume that companies like that verify that the phones are unlocked and evaluate them to determine that they’re working properly and don’t have excessive cosmetic damage. As for the OP, I doubt that it’s possible to have spyware on the phone that survives a reset or reinstallation of the operating system but can not be sure.
Zactly. Buy from a retailer.
One of our Dopers had / (has?) a job at one of those refurb factories that take in old electronics and prep them for resale. They get fully reimaged back to new OS.
You should try swappa.com They reset the phones to factory setting and you can review the sellers to make sure other buyers rated them highly.
Probably they assume that the phone is unlocked and since it registered successfully, they didn’t notice any issues.
So here’s a question about that. If you do a factory reset yourself, at home (like following instructions you might have found on Youtube or some such whatever), are you doing the same thing they would be doing? Or do they, the refurb people, have a way of better ensuring it’s more thoroughly clean?
The biggest risk is getting ripped off. Not receiving the phone or receiving the wrong model (a cheaper one) or the same model with less storage etc. In the past buying a carrier-locked phone was a concern but now most unlock without
Using a reputable reseller (Swappa, Gazelle) that checks the IMEI, confirms locking, and enforces wiping policies is much less risky. Using a factory reset does not really wipe a phone - carrier-based software may remain, you may have leftover Verizon bloatware, or even Samsung’s software you don’t want. Other phones may be possible to wipe even further, e.g. GrapheneOS for Pixel phones means you don’t even have Google’s software left over.
I’ve had great luck buying unlocked phones from reputable sellers on eBay in “mint” or “excellent” condition. I can’t guarantee there isn’t spyware that could somehow survive a Factory Reset, but I’ve never heard of it. For that matter we can’t 100% guarantee the factory doesn’t get compromised either.
Yes. The refurb ppl are not doing anything different. Every modern phone has factory reset as an option in the setup menu somewhere. Once that’s done, the phone will want to update itself to the latest version of its OS as well. Once this process is complete, the phone will be clean. There’s no software out there that will survive a factory reset outside of something the NSA is capable of doing.
I typically buy a new phone every 5-7 years. When it is time to get a new phone I do not buy the latest model. I’ll buy a new phone from 2 or 3 years ago. It’s a bit more than a used phone but cheaper than ‘cutting edge’.
My big worry about a used phone would be provenance. Did the previous owner willingly relinquish it (such as when upgrading) or was it stolen?
One alternative is to get a deal where the phone is at a very reduced price but you have to subscribe to a particular carrier for 3 months, 6 months, or a year–and then you switch to your preferred carrier.
Here is a list of those deals (as well as specials on the usual sites):
My understanding is that when a phone is stolen, you should report the IMEI of the phone to the carrier so it can be blocked, preventing anyone from registering it. I think there are websites that let you look up the IMEI of a phone you’re considering purchasing so you will know in advance if it’s been blocked.
[Moderating]
We’ve long prohibited “just Google it” as a response to FQ questions. This is a Warning for threadshitting.