What is Android Factory Reset Protection (RFP)? And how to handle FRP locked devices returned from customers?

What is FRP?

FRP (Factory Reset Prevention) is a security feature in Android designed to restrict people from using your Android device if they forcefully perform an untrusted factory reset on the device. Untrusted factory reset is performed via recovery mode. RFP is a way to prevent theft. If you are signed into your personal Google account and your device is locked, it is impossible to ordinarily remove the RFP lock unless with that Google account password or the screen lock PIN combined with that account. RFP comes enabled on all Datalogic devices (version higher than Android 5.1 when RFP was introduced by Google).

The RFP feature can cause trouble if you are sending a demo/loan Android device to a customer and they sign in with their own Google account and forget to sign out/remove it and the device is returned to you locked.

How can FRP affect Android devices I loan to customers?

Here are the various scenarios to be aware of and how to overcome them, assuming the device was locked when it was returned to you:

1)     User sets a PIN on the device

• In this case, you can perform a recovery mode factory reset. A recovery mode factory reset is performed by pressing the power key + volume up, and following the steps on the screen. This will remove the PIN and restore the device to its factory state.

2)     User signs in with a personal (unmanaged) Google account

• In this case, the FRP will prevent anyone from restoring the device without entering the Google account password (password of any Google account previously signed in with will be sufficient) or without entering the PIN in case set by the user as well. Even a recovery mode factory reset will not do the job. The device has to get sent to a Datalogic repair facility to be recovered. There is no utility available for users from the OEM to remove the FFP in this case.

How to prevent undesirable lock situations on my loan devices?

-        Inform the user of the demo unit to sign out of their Google account and/or perform a factory reset from the Android settings (System > Reset options > Erase all data) before returning the unit.

-        One option is to sign in with a Google account (that is known to you or your organization) before sending it out. Your Google account password will be sufficient to recover the device later if it’s locked with FRP. Alternatively you can enroll the device with your MDM before sending it. This way you have control of the device and can wipe it even if the user puts a lock (e.g. PIN, password) on the device.