The secondhand mobile device market is huge. According to Deloitte, used smartphones bring in more than $17 billion per year as they’re sold, traded and repurposed by new users.

But there’s a mobile device security problem flying under the radar: CSO Online said more than 40 percent of resold devices still contained the personally identifiable information (PII) of their previous owners, despite being wiped by for-hire data deletion companies. How do users ensure data actually disappears before they cash in on the secondhand market?

Creating a Disappearing Act

Growth of the secondhand market makes sense given the steep price of new smartphones and tablets. Rather than simply recycling their devices, consumers prefer to upcycle technology and recoup some of the cost in the process. But commercial erasure offerings aren’t up to snuff: A recent study by the National Association for Information Destruction (NAID) found that no specialized tools or software were used to delete the data from any of the 250 devices analyzed.

John Benkert, CEO of CPR Tools, which provides data recovery solutions, put it simply to CSO Online: “A 5-year-old with some free software off the web could have done it.”

With this in mind, it’s no surprise that 13 percent of smartphones, 44 percent of hard drives and 50 percent of tablets all contained recoverable PII, according to the NAID study. This information ran the gamut, from credit card data to names, addresses, emails, usernames, passwords and social media credentials.

And this is just the tip of the iceberg. The NAID researchers used very basic methods to grab a host of data. If interested parties choose to dig deeper, the resulting mobile device security impacts are staggering — users could find their entire lives compromised after a seemingly straightforward mobile device sale.

Potential Future Failures?

The availability of PII on secondhand mobile devices is worrisome, but it’s only the beginning. What happens when always-connected IoT devices enter the mix?

As noted by Charles Henderson of IBM’s X-Force, there’s real risk here. After selling a connected car and purchasing another model from the same manufacturer, Henderson discovered that he could still access the original vehicle’s digital information and even exert ownership control.

Now extend this to smart home devices — everything from thermostats and alarm panels to wireless fridges and dishwashers — and new avenue for compromise appears: If malicious actors get their hands on secondhand devices, former owners could be in significant jeopardy.

Increasing Mobile Device Security

So how do users ensure their mobile device data is actually gone before putting their smartphone or tablet up for sale? Start by reading the fine print from any commercial deletion service, since many opt out of any legal responsibility and instead put the onus on users.

It’s also worth asking about exactly how data will be deleted. Why? Because simply deleting data isn’t a viable form of mobile device security, since the information is hidden from view but it’s not really gone. The better alternative is overwriting data with something else to effectively prevent reconstitution.

Encryption is also critical. While factory resets can help reduce the chance of data recovery, encryption offers a better way to protect against accidental oversights and frustrate second-rate, secondhand cybercriminals.

The bottom line? Secondhand mobile devices often contain large amounts of first-party data. Deletion alone isn’t enough to fully wipe smartphones and tablets; instead, opt for a combination of encrypted and overwritten information to limit total risk.