What Happens When a Stolen Work Phone Is Factory Reset?

It is a Tuesday afternoon. Your technician, Luis, finishes a job, walks back to the van and finds the passenger window smashed. His work phone was on the seat. It is gone.

The first question most owners ask is “can they get into it?” If the phone had a screen lock, probably not. The second question matters more, and fewer people think to ask it: what happens when the thief simply wipes the phone and starts again?

Without protection, the answer is simple. The phone resets to a fresh setup screen, the thief signs in with any Google account, and they now have a working phone to use or sell. Your data is gone with the reset, which is good. But the phone itself is now theirs.

With factory reset protection, the story ends differently. The reset phone restarts into setup, asks for one of your company’s Google accounts, and goes no further without it.

What factory reset protection actually does

Factory reset protection is an Android feature. Once it is on, a phone that is wiped outside your device management will not finish setup until an approved Google account signs in.

In NounDesk, the approved accounts are ones you choose. You add them to a security policy, and every phone on that policy is covered. You can add up to 10 Google accounts per security policy. Any one of them is enough to set a reset phone up again.

So when the thief resets Luis’s phone, three things happen:

1. The phone restarts into the setup screens.
2. Setup asks for one of the Google accounts listed in the policy.
3. Without one of those accounts, the phone can’t be set up or used.

The thief can still hold the hardware. They just can’t turn it back into a working phone without an account your company controls.

Why a screen lock is not enough

A screen lock stops someone opening the phone. It does not stop someone resetting it.

Most Android phones can be wiped from a recovery screen that you reach with the buttons, before the phone even starts. You don’t need the PIN for that. NounDesk policies can also block the factory reset option inside Settings. The Standard Business template does this by default. But that setting only hides the option in Settings. It does not stop a reset from the recovery screen.

That gap is why factory reset protection matters. The screen lock protects the data. Factory reset protection protects the phone.

The catch: it is off until you add accounts

This is the part that catches people out. Factory reset protection does nothing until you list at least one account. No NounDesk template turns it on for you, because NounDesk can’t know which Google accounts your business controls.

If Luis’s phone was on a policy with no accounts listed, the reset would work and the thief would have a clean phone. Setting this up after the theft is too late for that phone.

How to turn it on in NounDesk

You need to be an Owner or Admin to change the setting. It takes a few minutes.

1. Go to Security policies and open the policy your phones use.
2. In the Security card, find Factory reset protection.
3. Enter the Google accounts that should be able to unlock a reset phone, for example it@yourcompany.com. You can add up to 10, separated by commas, spaces or new lines.
4. Select Save draft, then Publish.

The publish preview shows how many phones the change affects before you confirm. If you have more than one policy, for example one per site, repeat this for each one. Different policies can have different accounts.

The accounts must be Google accounts, either Gmail or Google Workspace. The full walkthrough is in the factory reset protection docs.

Choosing the right accounts

The accounts you list are the only way back into a phone that was reset outside NounDesk. Pick them as if you will need them in three years, because you might.

• Use shared company accounts. An IT or office account that doesn’t depend on one person is better than someone’s own login.
• Add at least two. If you lose access to one, you are not locked out of your own phones.
• Never use an employee’s personal account. If they leave, you can’t unlock the phone.
• Keep the passwords where the business can reach them, such as the company password manager.
• Update the list when people leave, and publish the policy again.

What about erasing a phone from NounDesk?

Back to Luis. Before the thief gets to the reset, you have choices. You can put the phone in lost mode, which locks the screen with your message and phone number and reports its location while it stays in lost mode. If it doesn’t come back, you can erase it.

When you erase from NounDesk, factory reset protection stays on by default. The Erase device dialog has a box called Keep factory reset protection (recommended), and it is already ticked. You type ERASE to confirm, and the phone is wiped. It still asks for one of your accounts at setup.

Untick that box only when you are erasing a phone you have in your hand and plan to reuse or give away, so the next setup doesn’t need your accounts.

One important detail: the box has no effect if the phone’s policy lists no accounts. Add the accounts and publish before you ever need to erase anything. For the full sequence after a phone goes missing, see what to do in the first hour after an employee loses a work phone.

Honest limits

Factory reset protection is useful, but it is worth knowing what it does not do.

• It does not find the phone. NounDesk reports location only while a phone is in lost mode. Once a phone is reset, it is no longer managed and reports nothing.
• It does not bring your data back. A reset wipes the phone. That protects your data from the thief, but anything stored only on that phone is gone.
• It only works once accounts are set. A policy with an empty list gives no protection.
• It can lock you out too. If you lose access to every listed account, you can’t set the phone up yourself either. That is why two shared accounts beat one.

Reusing a protected phone

Say Luis’s old phone comes back, or you retire a phone and reset it to hand on. When setup asks for an account, sign in with one of the trusted accounts in the policy. After that, the phone sets up as normal. You can enroll it again with a QR code or pass it on. Our guide to wiping a company phone before giving it to a new employee covers the handover steps.

What to do this week

1. Open each security policy and check whether factory reset protection lists any accounts. If it is empty, the protection is off.
2. Pick two shared company Google accounts you will always control, such as an IT account and an office account.
3. Add them and publish. Check the publish preview shows the number of phones you expect.
4. Store the passwords in the company password manager, not in one person’s head.
5. Add a reminder to your offboarding checklist to update the list when someone with access leaves.

FAQ

Can a thief use a company phone after a factory reset?

Not if factory reset protection is on with accounts listed. Setup asks for one of your company’s Google accounts and goes no further without it.

How many accounts can I add?

Up to 10 Google accounts per security policy in NounDesk. Any one of them can set up a reset phone again.

Does erasing a phone from NounDesk remove the protection?

No, as long as you leave Keep factory reset protection (recommended) ticked, which is the default. The phone is wiped and still needs one of your accounts at setup.

Can NounDesk track a stolen phone after it is reset?

No. NounDesk reports location only while a phone is in lost mode, and a reset phone is no longer managed. The protection makes the phone useless to the thief, but it does not locate it.

Factory reset protection is one setting among many in a managed fleet. Our Android MDM guide for small businesses shows where it fits, and the factory reset protection feature page has the details.

If you want your company phones covered before the next van window gets broken, try NounDesk.