A new phone as a personal business continuity test
Swapping apples
Autumn is here and the apples are nicely red. I decided to trade my own bitten fruit for a fresher, juicier one too. My previous model had served me for years, so I didn’t want to use the usual “copy everything from the old device” option. I set everything up from scratch.
A clean start has its charm. Over the years a phone collects plenty of apps you no longer use, and permissions you once granted to someone and then forgot about. Copying brings all of it along; starting from scratch doesn’t. The price, of course, is that every account, every MFA and every app has to be gone through one by one.
In fact, it’s a small business continuity test. At work we keep asking whether we can carry on after an incident. With a phone, the question is exactly the same: if it disappeared tomorrow, would I still have access to everything I need? A planned switch answers that under controlled conditions, not in the middle of a crisis.
Below are the notes I wrote down mainly for myself, for next time. Maybe they’ll help you too.
1. Backup first
Before you do anything else, make an offline copy of your passwords and other critical information, if you don’t have one already. If something goes wrong during the switch, this is your last way back in.
That includes your password manager’s recovery key, MFA backup codes and the passwords to your main accounts. Put the most important bits on paper as well. It’s old-school, but paper needs no battery, no network and no login. Keep it in the same place as your other important documents!
Don’t forget your personal data either. When you set up a phone from scratch, photos, documents and notes don’t come along by themselves. Check beforehand that cloud backup is actually switched on and that the latest backup really finished. If you don’t trust the cloud, copy your data to a computer or an external drive before the switch.
2. Keep the old phone within reach
Don’t reset or give away the old phone until everything you need works on the new one. A full setup can take several days.
The reason is simple: many services confirm a new device through the old one. A code arrives in the old app, MFA has to be re-registered there, or you need to log in with the old phone one last time. Some accounts only come to mind the next time you need them. If the old phone has been wiped by then, recovery starts from zero.
The same goes for messaging apps. Transferring your Signal and WhatsApp chat history usually requires the old phone to be at hand and working. That said, not every message and photo needs to be kept forever. Sometimes it’s good to start fresh here too.
Pay attention: every time you need the old phone to move something, you’ve found a weak spot. If the phone were really lost, that’s exactly the service you’d be locked out of. Note them down and make sure each has backup codes or another way to sign in. That’s what the test is for.
3. MFA apps and passkeys
MFA (multi-factor authentication) apps need the most attention. Most people have one, but there may be more: one for work, another for personal accounts, a third for some specific service. Each may come from a different vendor, with different registration dates, different accounts and different backup codes.
Go through all of them before the switch and check whether they can be moved from one device to another at all. Some apps support cloud backup or transfer. Some require you to re-register MFA for every account. And some of the more exotic solutions are tied to a specific physical device and won’t move anywhere.
Passkeys deserve a separate thought. In many places they’re already the default way to sign in, and they sync through iCloud, Google, 1Password and the like, or through your company’s password manager. If you stay on the same platform, they come along on their own. But if you switch from iPhone to Android or the other way round, they won’t transfer automatically. Check beforehand which accounts use a passkey and whether they have another sign-in method as a fallback.
A sensible order: move MFA to the new phone, try logging in to every account from the new phone, and only then remove the old one.
4. Map everything you log in to
Next, review the services you log in to with your phone. The more of them go through a single identity, such as a Microsoft or Google account, the easier it gets. Log in once and a big chunk of your digital life is back.
Exotic services are another story. I have a financial services app that doesn’t support any of the identity solutions common in Estonia. On the new phone, the only way to activate it was through the bank’s ATM. And that ATM wasn’t anywhere near me – not even in the same region. Only after that could I move the account to the new phone.
So before switching, make a list of your critical apps (banking, financial services, work systems) and check how each one gets activated on a new device.
5. Smart-ID, Mobile-ID and eSIM
In Estonia, your digital identity is the key to almost everything. Smart-ID and Mobile-ID are how most of us log in to our banks and public services, and how we sign documents digitally – with full legal effect. Lose them mid-switch, and you’re locked out of all of it at once.
Smart-ID has to be registered again on the new device, so think ahead about how you’ll do it. Registering with a biometric passport works, for example, but even that requires a valid Smart-ID on the old device. Plan B, which doesn’t depend on any phone, is your ID card, a card reader and a computer that already has the ID software installed – or where you can install it if needed.
Mobile-ID is tied to the SIM card. If you’re getting a new SIM or an eSIM, ask your operator how Mobile-ID carries over. eSIM transfers also go through the operator and may require identity verification.
6. A big clean-up
A new phone is a great chance for a big clean-up. Since every app has to be installed again anyway, ask yourself before each install whether you actually need it. If an app doesn’t come to mind in the first couple of weeks, you probably didn’t.
Review app permissions too. Location, camera, microphone, contacts and photos should only go to apps that genuinely need them. Close unused accounts manually, because deleting an app from your phone doesn’t delete your data from the service provider. And if an account still uses SMS for MFA, now is a good time to move to something stronger.
7. Wiping the old device
Once the new phone works, the old one needs to be wiped properly before it goes into a drawer, gets sold or is recycled. The order matters here.
First, remove the device from your services’ trusted devices and MFA lists. Then remove it from your Apple or Google account and from Find My. For a work phone, your IT department will take care of this. Only then do a factory reset.
Wrapping up
You can switch phones quickly and comfortably, or slowly and thoroughly. I chose the slow way, and it took several days in total, because one service could only be activated in person. Exotic services like that are rare, though, so don’t let them put you off. The good news: there are noticeably fewer apps on my phone now. And along the way I got to check access and recoverability across a whole range of services.
A checklist for next time
A clean setup gives you a clean device – but only if the groundwork is done before you reset the old phone. Here’s everything on one page.
- Passwords and backup codes have an offline copy, the most important ones on paper too
- Photos, documents and notes are backed up
- The old phone stays around and working until everything has been tested on the new one
- Every MFA app is listed with its accounts, vendor and backup codes
- For each MFA app, you know whether and how it moves to the new device
- You know which accounts use passkeys, and each has a fallback sign-in method
- Critical apps (banking, financial services, work) are mapped with how they get activated
- You know how you’ll renew Smart-ID, and your ID card and reader are at hand
- Only the apps you need are installed on the new phone, with permissions reviewed
- Unused accounts are closed
- You’ve logged in to every critical account from the new phone before resetting the old one
- The old device is removed from accounts and MFA, and its data is wiped
Related articles
Your Camera Is Rolling. But Do You Have the Right to Film?
A practical guide to surveillance cameras: legal basis, notification, recording security, retention periods, prohibited locations, and GDPR compliance.
The Surgical Approach to Cybersecurity
More tools do not equal more security. Four questions to ask before every purchase and why consolidation is a sign of cybersecurity maturity.