Buying a Used Phone or Laptop: The Security Checks Before You Trust It

Buying second-hand hardware is one of the smartest financial decisions you can make. A two-year-old flagship phone costs a third of its launch price and does everything you need. But a used device is not like a used sofa: it can arrive still carrying the previous owner's account locks, an unpatched operating system that will never receive another security update, or software deliberately installed to watch you.

This is a checklist for the security side of that purchase — what to verify before you hand over money, and what to do in the first hour after you get the device home.

The Three Real Risks

Most guides to buying used devices worry about scratches and battery health. Those matter, but they are not what will hurt you.

The device is stolen or account-locked

Modern phones and laptops tie themselves to an account. An iPhone still linked to someone's Apple Account is unusable to you. Android devices have Factory Reset Protection. Windows laptops can carry a BIOS or firmware password. If the seller has not properly signed out, you have bought a paperweight, and no amount of resetting will fix it.

The device will never be patched again

A phone past its support window stops receiving security updates. Known vulnerabilities in the browser, the messaging stack, and the operating system stay open permanently. A cheap phone with two years of support left is a better buy than a better phone with none.

The device has been deliberately tampered with

This is rarer but real, particularly with devices bought from individuals rather than refurbishers. Stalkerware, a hidden device administrator profile, a modified operating system image, or a configuration profile that routes your traffic through someone else's server. The risk is highest when the device is given to you by someone you know rather than bought from a stranger.

Before You Pay: Checks to Run in Front of the Seller

Insist on powering the device on and spending five minutes with it. A seller who refuses this is telling you something.

1. Confirm it is fully reset and signed out. The device should boot to the initial setup screen — choose your language, connect to Wi-Fi — not to someone's home screen. If it boots to a home screen, it has not been reset.
2. Walk through setup far enough to hit any activation lock. On an iPhone, if it asks for an Apple Account password that is not yours, stop; the device is locked to the previous owner. On Android, the same applies to a Google account prompt after reset.
3. Check the IMEI or serial number. Dial *#06# on a phone to display the IMEI. Run it through your country's stolen-device checker and your carrier's blacklist lookup. A blacklisted IMEI cannot be used on any network in that country.
4. Verify the serial matches the box, the receipt, and the label under Settings > About. Mismatches suggest replaced parts or a swapped device.
5. Check the support status. Look up the exact model and find the manufacturer's end-of-support date. Ask yourself how many more years of security updates you are actually buying.
6. On a laptop, boot into the firmware settings (usually F2, F10, or Delete at power-on). If a BIOS or UEFI password is set and the seller does not know it, walk away — on many machines this cannot be cleared without a service centre.
7. On a Mac, check for Activation Lock and firmware password and confirm the seller has signed out of iCloud and removed the device from Find My.
8. Ask for proof of purchase. Not required, but a seller with the original receipt and box is a much lower risk profile.

Warning Signs From the Seller

• Refusal to meet in person, or a device shipped without a chance to inspect on collection.
• The device is "locked because I forgot the password" — that is the account lock, and it is not fixable by you.
• Several identical devices listed by the same private seller.
• A price far below every comparable listing.
• Pressure to pay by an irreversible method — cash in hand with no receipt, cryptocurrency, or a bank transfer with no paper trail.
• The device is already logged into accounts and the seller offers to "leave it set up for you". This is not a favour. It is either laziness or intent.

The First Hour After You Get It Home

Do this before you sign into a single account of your own. The order matters.

1. Wipe it yourself, regardless of what the seller did

Never trust someone else's reset. On Android, perform a factory reset from Settings > System > Reset options. On iPhone, use Erase All Content and Settings. On Windows, use Reset this PC with the "Remove everything" and "Clean data" options, or better, reinstall from a fresh installation image you downloaded from Microsoft yourself. On a Mac, use Erase All Content and Settings on Apple silicon, or reinstall macOS via Recovery.

For a Windows laptop bought from an individual, a clean install from your own installation media is the only way to be confident about what is on the disk. A reset preserves a manufacturer recovery partition that you did not create and cannot audit.

2. Update everything before signing in

Connect to Wi-Fi and install every pending operating system and firmware update. Reboot and check again — updates often arrive in chains. Only then sign into your accounts, on a device that is fully patched.

3. Audit what is installed

Even after a reset, check the app list for anything unfamiliar. On Android, open Settings > Apps > See all apps and switch on "Show system apps" to spot anything odd. Check Settings > Accessibility > Downloaded apps, Settings > Security > Device admin apps, and Settings > Apps > Special app access. Anything with accessibility or device admin rights that you did not grant should be removed.

4. Check for profiles and management

On iOS, go to Settings > General > VPN & Device Management and remove any configuration profile. On Android, check for a work profile or an enrolled device management policy. On a Mac, check System Settings > General > Device Management. A device enrolled in someone else's management system can be tracked, locked, or wiped remotely by them.

5. Look at network settings

Check for a configured VPN or proxy you did not set up, and for custom DNS servers. Under Wi-Fi settings, remove all saved networks from the previous owner. Then check whether a custom certificate authority has been installed — on Android under Settings > Security > Encryption & credentials > Trusted credentials > User. That tab should be empty unless your workplace put something there.

6. Turn on your own protections

Set a strong screen lock, enable full-disk encryption if it is not on by default, sign into your own account, and turn on device-finding so the phone is now tied to you. Set up automatic updates.

If Something Looks Wrong

1. Do not sign into your accounts on it. Stop before you give the device anything of yours.
2. If it is account-locked, contact the seller and demand a refund. Only the original owner can remove the lock, and manufacturers will not do it without proof of purchase in the original owner's name.
3. If the IMEI is blacklisted, report it to the platform you bought from and to the police. Handling a stolen device knowingly is a legal problem as well as a financial one.
4. If you find management profiles, unknown certificates, or accessibility apps you cannot explain, do a full clean install from installation media you created yourself, not a reset.
5. If you already signed in, change those passwords from a different device, check active sessions on each account, and sign out everywhere.
6. Pay in a way you can dispute — a card or a platform with buyer protection — precisely so that this step is possible.

The Bottom Line

A used device is a good deal right up until it is someone else's device with your accounts on it. Three checks cover almost all of the risk: confirm it boots to a clean setup screen with no activation lock, verify the IMEI or serial is not blacklisted, and check how long the manufacturer will still ship security updates for that exact model. Then wipe it yourself anyway, patch it fully, and only sign in once the device is genuinely yours.