Most advice about buying a second-hand phone stops at "check it turns on and the screen isn't cracked." That's how people end up with a device that's quietly tied to someone else's accounts, or one that can't be used at all. A used phone is really two purchases in one: the hardware, and a clean break from its previous life. The second one is where people get caught out.
Here's the order that actually protects you.
Before you hand over money
Check the IMEI. Every phone has a unique 15-digit IMEI, and you can see it by dialling *#06#. Run it through an IMEI check before you buy. This is the single most important step. It tells you whether the phone has been reported lost or stolen, whether it's blacklisted by carriers, and whether it's locked to a network. A blacklisted phone can't connect to mobile networks at all, and no amount of resetting fixes it. You'd be buying an expensive paperweight.
Confirm the activation locks are off. On iPhones, Find My has to be turned off by the previous owner before you take it. If it's still on, you'll hit a login wall after the reset and the phone is useless to you. Ask the seller to remove the device from their account while you watch. Android has the same thing with the Google account lock, sometimes called FRP, and it behaves the same way.
Watch a full factory reset happen. Don't accept a phone that's "already wiped and ready." Reset it yourself, in front of the seller, and set it up far enough to confirm there's no account lock waiting on the other side.
After it's yours
Now it's a clean device, but it's about to hold your entire digital life. Email, banking, messages, photos. Treat the setup as a privacy reset, not just a login.
- Update the operating system fully before you sign into anything. Second-hand phones are often months behind on security patches.
- Set a strong screen lock and turn on two-factor authentication for the accounts that matter.
- Review app permissions as you reinstall. A used phone is a good moment to be stingy about which apps get your location and your contacts.
- Add a layer for everything that leaves the phone. This is where a VPN fits. It encrypts your connection on any network, so the new-to-you device isn't leaking your activity on public Wi-Fi from day one.
The thread running through all of this
A phone is the most personal object most of us own. When it changes hands, the risk runs both ways: the previous owner's baggage coming along with it, and your own life flowing into a device whose history you never saw. The checks at the start handle the first problem. Good habits afterwards, like updates, strong locks and an encrypted connection, handle the second.
We built our device tools for the first half of that, and DeviceDecoded VPN for the second: private, no-logs protection on every device you own, including the one you just bought, for $10 a month. Check the phone's history before you trust it, then make sure it isn't quietly broadcasting yours.