Verizon sent customer a demo phone with remote management software

Verizon sent customer Tom Collery a Samsung Galaxy Z Flip7 that carried an active Mobile Device Management profile, giving the company remote administrative control over the device. Collery, a 22-year Verizon customer in San Francisco, had requested a replacement phone in February after experiencing network issues.

Instead of a new or properly prepared refurbished unit, he received a former store demonstration device that had not been wiped of its management software.

Data loss and remote reset Collery used the phone for roughly two weeks before it began repeated security updates and restarts. The device then performed a factory reset, displaying messages that it was managed by Verizon and protected by BricTECH software.

The reset erased contacts, messages, videos, documents, and patient information stored on the phone. Backups to his Google and Samsung accounts were incomplete, resulting in permanent loss of some files.

Company response Verizon provided Collery a $400 credit and a second refurbished phone without an MDM profile. The company allowed him to retain the original device for potential evidence. In an April 2 letter to the Federal Communications Commission, Verizon stated that Collery had been sent a demonstration unit by mistake and that the procedural lapse had been submitted for internal investigation.

The carrier told Ars Technica it was working directly with the customer but did not answer questions about how the error occurred or what steps it is taking to prevent recurrence.

Security concerns Security researcher Cooper Quintin of the Electronic Frontier Foundation said the incident raises questions about Verizon's definition of "refurbished" and its data-wiping procedures for returned devices. He noted that anyone returning a device should erase data first, but carriers must also maintain strict processes to ensure devices are fully reset before resale.