A UK study found that more than half of second-hand mobile phones still contain personally identifiable information from the previous owner. When people upgrade phones, many resell the old one without realizing exactly what's still on it.
Why manual deletion doesn't work
81% of people in the study said they'd deleted all personal and sensitive information before selling their phone — but manually deleting files leaves traces behind on the device. Researchers recovered social network login credentials, credit and debit card PINs, bank account details, and company information from phones their owners believed were clean.
Smartphones make this worse, not better: they store more data than older phones, and that data is easier to recover once it's there.
What actually works
For the phone itself: a full factory reset before selling, donating, or discarding it clears sensitive information properly, unlike deleting files one at a time.
For the SIM card: the situation is worse. A white-hat hacker examined 50 used SIM cards bought online and found 27 still contained the previous owner's personal information. Unlike phones, SIM cards can't be securely wiped — they have to be physically destroyed before disposal or resale.
When upgrading, transferring your SIM to the new device is convenient for keeping your contacts — but the old SIM should always be destroyed, never sold or given away intact.