After shattering the screen of her iPhone, Natalie Hall thought the device was basically junk.
She never expected it to wind up 11,000 kilometres away, in the hands of a man who used it to add himself as her Facebook friend and to follow her private Instagram account.
But last week, a man messaged the 15-year-old on Facebook, saying he had bought her used phone in Dubai and the device still had all of her data on it. To prove it, he sent Hall a screengrab of her old phone’s camera roll, commenting on the “sweet” photos of the teen, her friends and her dog.
“I was overwhelmed,” said Hall, who is from Bowmanville, Ont. “It’s creepy having your pictures and your contacts and your social media, text messages — all of that kind of stuff — out there with just a random stranger.”
Hall said she could hardly type two characters on the badly damaged screen of her iPhone 5s before it would stop working. So she and her mom traded in the device last fall at a mall-based kiosk, getting $11 off a new phone from mobile retailer TBooth.
Hall said she assumed her old phone had been recycled.
“It was so broken — to the point where the guy I sold it to couldn’t even use it himself,” Hall said. “For people to say that it’s common sense to wipe your phone, I don’t know if your phone is that broken.”
The phone was instead refurbished and eventually ended up in the hands of the man who reached out to her on Facebook.
The man initially asked her multiple times to accept his friend request, Hall said. But when she didn’t, the man went into her Facebook account using her old phone and added himself.
The same thing happened with her Instagram account, Hall said.
“He had liked all my posts and I was like: I have a private account, I didn’t accept this,” she said. “I had to change my passwords for everything.”
Hall has since blocked the man from her social media accounts.
CBC Toronto reached out to the man who was contacting Hall on Facebook. In a series of messages, the man wrote he was sorry for disturbing Hall, and that he’s since wiped all her data from the phone and sold it.
The phone was part of a bulk purchase of used phones he made in Dubai for resale purposes, he said, although he’s since returned to Pakistan. The man told CBC Toronto the stock he buys normally comes from the U.K., Canada or the U.S.
Deleting data is a little more complicated than most people might think. A typical factory reset doesn’t necessarily mean the data is erased. It’s just saying the device is now cleared for other data to be written on top of it.
Even though one cannot see the data anymore after a reset, a stranger could still access it by downloading software to extract it from your device.
There is an exception though. On newer iPhones, it has become much harder to recover data after factory reset, because the data is encrypted.
If a phone is broken and the owner wants to sell it broken, the person should sell it to a company that will perform this extra step: a software-based data eraser.