At least in theory, when buying a refurbished phone, is there a chance the phone has been modified, in the same vein as phishing, to look like a stock installation, down to the "factory reset" and maybe even appear rooted?
I.e., if a company bought 300 refurbished phones off eBay...
I suppose running Wireshark to see what's coming in or out might be a good start but I am hoping someone will say it's extremely unlikely (given that nothing's impossible).
Is it possible? Of course, see the examples above and probably below.
Is it likely? Depends where you buy them.
If you buy random, too cheap to be true, refurbished smart phones from a nonreputable chinese vendor on ebay your chances of running into a smart phone with malware increase exponentially.
Unlike some stories about hacked devices and such, this is something that could be worth the hackers while though as today a lot of people will have banking, facebook, authenticator, etc apps on their phone so the attack vector is very real I would say.
On the other hand, to add some realism, buying a refurbished phone from a reputable source like a big brand, well known web shop or similar (you know the brands for your own country / area best) I'd imagine the risk isn't that high.
Given that even official vendors sell their devices with adware or malware preinstalled I would not be surprised if somebody selling refurbished phones will use this business model too:
