Key facts
- Verizon sent a customer a refurbished phone with an active Mobile Device Management (MDM) profile.
- The device was a former store demo unit that had not been properly wiped.
- The MDM profile allowed Verizon to remotely control and eventually wipe the customer's data.
- The customer lost personal data including contacts, messages, videos, and documents.
- Verizon acknowledged the error to the FCC, stating the customer received a demo unit by mistake.
- Verizon provided the customer with a credit and a different, properly configured phone.
Verizon sent a customer, Tom Collery, a refurbished phone that was equipped with a Mobile Device Management (MDM) profile, effectively giving the company remote control over the device. The incident, which occurred after Collery contacted Verizon about network problems, raises significant concerns about the carrier's procedures for preparing refurbished phones for new users.
Collery received a Samsung Galaxy Z Flip7 as a replacement. He used the device for approximately two weeks before all his data was remotely erased. The phone displayed messages indicating it was managed by Verizon and protected by BricTECH, a device management system. This unexpected factory reset resulted in the loss of personal data, including contacts, messages, videos, and documents.
In a letter to the Federal Communications Commission (FCC), Verizon acknowledged that Collery had mistakenly been sent a store demonstration unit instead of a device suitable for a paying customer. The company stated it was aware of the issue and actively working with Collery to address it.
As a resolution, Verizon provided Collery with a $400 credit and a different refurbished phone that did not have an MDM profile. He was also allowed to keep the MDM-equipped phone for evidence. Collery, a long-time Verizon customer, expressed dissatisfaction with the company's response and is considering legal action.
Security experts, like Cooper Quintin from the Electronic Frontier Foundation, have voiced concerns about Verizon's refurbishment process, questioning how many used devices might still contain previous owners' data or improperly configured management software. Quintin suggested that an external investigation might be warranted, beyond Verizon's internal review.