Many people sell or trade in old smartphones when upgrading. But if accounts, private photos, work messages, and saved logins are not properly removed, the device can become a source of personal data leakage and even enable fraud.
A police officer from the publicity unit of the Panshi Public Security Bureau in Jilin province was cited as saying that users often rely on formatting or a factory reset before disposing of a phone. However, these actions may not completely erase information in some cases—and with sufficient technical capability, someone could potentially recover previously stored data.
Why "wiping" may differ by device generation
An additional step is sometimes recommended for older devices: after a factory reset, users can fill the phone with large files (such as movies or TV episodes) to overwrite the storage, then perform a second factory reset. The idea is that even if someone attempts recovery, they would retrieve mostly meaningless media files rather than the original personal data.
A key caveat, however, is that this "double overwrite" approach mainly applies to older, unencrypted Android phones (commonly cited as Android 5.0 and earlier) or memory cards. Modern smartphones—including iPhones and Android 6.0 and above—typically use full-disk or file-based hardware encryption by default. In those cases, a factory reset usually triggers cryptographic erase, destroying encryption keys so that leftover storage fragments become unreadable gibberish for most attackers. For ordinary users, manually filling storage with large files is generally unnecessary on newer devices.
What police say criminals can do with leaked phone data
Once personal data is exposed, criminals may exploit phone numbers and identity-related details to run scams such as fake "customer service" refund calls, fraudulent loans, impersonation of friends asking to borrow money, or even pretending to be law enforcement or judicial officials.
Daily habits to reduce data-leak risks
The piece also lists common precautions, including
- Be cautious with public services (such as unsecured Wi‑Fi networks and public charging stations).
- Watch for phishing (unknown QR codes, suspicious links in SMS messages, and "online quizzes" requesting personal data).
- Adjust privacy settings in frequently used messaging and social apps, and be mindful when posting updates.
- Reject excessive data collection by installing apps from official channels and carefully limiting permissions; revoke authorizations for platforms you no longer use.
If you suspect your information has leaked, follow these five response steps.
It suggests a five-step response plan:
- Cut off the risk source (log out suspicious devices; freeze affected accounts where possible).
- Change passwords across linked accounts, using strong new passwords rather than reusing old ones.
- Preserve evidence (screenshots, messages, emails; note time and suspected channel).
- File complaints/report to relevant platforms or authorities (examples listed include HKCERT, PCPD, and Hong Kong's Anti-Scam Helpline 18222).
- Seek legal recourse if losses occur: keep evidence, report to police, and consider civil action if needed.
Comment