Are Refurbished Phones Dangerous?

I love a bargain and hate waste, so I’m an easy sell on secondhand tech. And with prices on the rise because of the memory-chip crisis, I don’t even need to convince people to look to the used market.

Preowned phones typically lose 1% of their value every week—essentially half their value in a year—but prices are actually going up this year, according to Sean Cleland. He’s a vice president at B-Stock, which sells preowned goods to businesses. Case in point: The average price of the company’s top seller, the iPhone 15 Pro Max, rose from $530 in January to $560 in May.

Being a second owner comes with risks, however. My colleague Joe Barrett reported on a jury-duty scam where attackers spied on the victim’s texts, web searches and location. The victim bought a refurbished Samsung Galaxy S24 Ultra online, and security experts say it was likely laden with spyware.

The experts reassured me that preinstalled malware is rare, but there are other, more common dangers: activation-locked devices, shoddy replacement parts, outdated models—or even counterfeits. You might save a few hundred dollars today but pay much more later in repairs or replacements.

Here’s how to avoid those hazards and still score a deal.

All phones eventually expire, and if it’s too old to get a security patch, it belongs in the recycling bin. Recent flagship models from Samsung, Alphabet’s Google and Apple get up to seven years of software updates.

“The more modern the device, the better the overall security and support for updates,” says William Enright, a consultant at security firm NCC Group.

While a cheaper, older device is tempting, springing for a more recent generation will give you more years of life. Verify lifespans for specific models at endoflife.date.

Relatedly, new iPhones are just around the corner, so you may want to hold off a few more weeks on any upgrade, even if it’s a refurbished one.

Sellers might offer a bargain price for a phone with Frankenstein “repairs.” You end up with a faulty port, malfunctioning screen or a bad battery.

“There is a good chance that the device has non-genuine parts, which raises a safety question as much as a security one,” says Tzvika Shahaf, chief product officer at Blancco, which specializes in data erasure. You don’t want a low-quality battery that might catch fire, or a compromised or modified circuit board that bypasses normal security guards.

A good reseller should offer a return policy and a warranty that covers defects for at least 90 days. One year is even better.

A lost or stolen phone, or one that hasn’t been fully paid off, can be blocked from accessing cellular networks. A phone can also be locked if it’s still connected to a Find My network through the previous owner’s Apple or Google account.

A high-quality seller verifies that the device’s IMEI serial number, a 15-digit code unique to every phone, matches the manufacturer details and isn’t restricted. If the seller shares the code, you can look up the status of an IMEI yourself on Swappa.

Buying directly from manufacturers is your best bet for avoiding these critical issues, says Ben Bernstein, who leads a team of advisers at cybersecurity firm Huntress. Apple, Samsung and Google have certified refurbished programs where used phones get genuine replacement parts, the latest software and a one-year warranty.

Bernstein says preowned devices from your wireless carrier are the next best option. These phones tend to go through extensive processing, including cleaning and data wiping.

He’s more wary of buying from independent sellers in online marketplaces: Amazon.com may set the rules, but they aren’t the ones wiping the drive, he says.

An Amazon spokesman said, “Amazon Renewed sellers must meet rigorous quality standards,” adding that smartphones require “a full factory reset that removes any spyware, and forensic destruction of all personal data.”

At first glance, it’s an iPhone running Apple software. But look a little more closely, and the app font is off. The icon spacing is, too. The dead giveaway that it’s a fake: the Google Play app store, for Android phones.

Enright says counterfeit devices are a bigger problem outside of the U.S., and that the scheme is typically to make a quick buck off the initial sale, not to hack the buyer.

Avoid buying devices from unknown individuals, and look closely at the device and packaging, he says. The biggest tipoffs are poor build quality, missing features such as Find My and typos on the box.

Security researchers and secondhand-market experts say compromised phones are uncommon, but determining how many are out there is difficult.

“A substantial share of devices reach the next owner without an expert having examined what’s left on them, leaving the door open to cyberattacks,” says Shahaf.

About a third of refurbished phones contain data from a previous owner, he adds. This can include sideloaded apps that bypass the official app store’s security checks.

Buying from the manufacturer or a carrier should cover you, but you can perform a factory reset on the iPhone or Android device if you want to purge lingering apps and data.

There’s a big industry built around the secondhand market, and if you look in the right places, you can find a good deal without getting fleeced. But nothing decent is cheap at the moment. If a price seems too good to be true, it probably is.