Google Wants To Make Stolen Android Phones Basically Unsellable
Nick Fernandez / Android Authority
TL;DR
- Google is enhancing Android’s Factory Reset Protection (FRP) to make stolen phones harder to use by forcing another factory reset if setup wizard bypasses are detected.
- This upcoming improvement, announced during The Android Show: I/O Edition, aims to block unauthorized use entirely until previous ownership is verified via Google account or screen lock.
- While Android 15 already strengthened FRP against common bypasses, this new measure will likely debut later this year, possibly in an Android 16 QPR.
Smartphones are common targets for thieves because they contain valuable personal data and fetch high prices on second-hand markets. To protect this data, Android includes theft protection features that lock down a stolen phone. While thieves might try wiping phones they intend to sell, Android already has robust protections against unauthorized factory resets. Google announced today that these factory reset protections will become even more powerful later this year.
You can factory reset an Android phone in several ways. However, triggering a reset through the Android recovery menu or Google’s Find My Device service activates Factory Reset Protection (FRP). During setup after such a reset, the wizard requires you to verify ownership by either signing into the previously associated Google account or entering the device’s former lock screen PIN, password, or pattern. Failing this verification step blocks setup completion, rendering the device unusable.
Mishaal Rahman / Android Authority
An example of a trusted factory reset is when a reset is performed through the menu in the Settings app.
Factory Reset Protection has been a part of Android for a long time. It works because Android stores a key in a protected area separate from user data files, ensuring it survives a factory reset. This key is generated when you first add a Google account to the device and is only removed during a factory reset initiated through the Settings app, as this method requires you to authenticate with your screen lock first. FRP activates after resets from the recovery menu (since anyone with physical access can trigger this) or via Find My Device (which usually signals a lost or stolen device), precisely because these methods bypass the standard screen lock authentication required in Settings.
Factory Reset Protection (FRP) is a valuable feature that discourages theft by rendering stolen Android phones useless to potential buyers if wiped improperly. However, FRP isn’t foolproof; thieves have discovered numerous methods over the years to circumvent it. These bypasses typically involve skipping the setup wizard, allowing someone to use the phone without entering the previous owner’s Google account details or screen lock.
In Android 15, Google introduced several improvements to Factory Reset Protection specifically designed to make these setup wizard bypasses less effective. For instance, even if someone bypasses the setup wizard, Android 15 blocks them from adding a new Google account, setting a new screen lock, or installing new apps. More importantly, neither bypassing the setup wizard nor enabling the ‘OEM unlocking’ developer setting will deactivate FRP anymore. The protection remains active, and its restrictions apply until someone successfully verifies device ownership.
During The Android Show: I/O Edition, Google announced plans to “further harden Factory Reset protections, which will restrict all functionalities on devices that are reset without the owner’s authorization.” While the company didn’t elaborate much, a screenshot it shared suggests that Android will likely detect if someone bypasses the setup wizard and then force another factory reset, preventing unauthorized use until the user proves ownership.
The screenshot displays a dialog prompting the user to “factory reset this device.” It explains, “this device was reset but authentication failed during setup. To use this device, reset again and enter the device’s previous screen lock or Google Account credentials.” Presumably, this dialog will appear whenever Android detects a setup wizard bypass, potentially repeating after each attempt until the user successfully verifies ownership. This forces proper authentication and ensures the device cannot be used at all—not even for basic functions like phone calls—without verification, a significant change from previous FRP behavior.
Google stated this FRP improvement is coming “later this year.” Since the stable Android 16 release is coming soon, this timeline suggests the feature won’t be part of the initial launch. It might arrive later in one of Android 16’s Quarterly Platform Releases (QPRs), but that remains to be seen.
Got a tip? Talk to us! Email our staff at [email protected]. You can stay anonymous or get credit for the info, it’s your choice.
