I'm thinking of buying my next phone refurbished rather than new, since I can easily get something that meets my needs for a lot cheaper. But one concern is whether something might get surreptitiously installed on the phone before it gets to me.
The phone will be an Android of some description (haven't picked a model yet, but leaning towards a refurbished Samsung S8).
Once I get the phone, what's the ideal way to ensure that it's completely clean. I'm planning to at least do a factory reset, but I'm looking for other things I can do to ensure that the image being used is clean (e.g. getting an image direct from the Manufacturer and use it as the recovery image).
I'd like to be able to get this down to a reasonably solid checklist of precautions and checks to perform.
Threat-model wise, I'm more concerned about malware here than nation-state actors, so I can live with being unable to protect against possibilities that require a highly sophisticated and well resourced adversary (e.g. hardware implants).