Open the drawer. You know the one — the junk drawer's tech cousin, the one with the phone chargers that don't match anything you currently own and at least two devices that haven't turned on in years. 📱
Ask yourself honestly what's actually on them. Old photos you never migrated. Text threads with someone you don't talk to anymore. A banking app still logged in, from three security updates ago, on an operating system nobody patches anymore. That drawer isn't storage. It's an unlocked room you stopped thinking about.
A device that's off is not a device that's safe. It's just a device you've stopped paying attention to.
Here's the part that doesn't feel true until you say it out loud: none of that stopped being sensitive when the screen went dark. The banking app is still logged in. The old email account still has years of attachments — tax documents, ID scans, things you forwarded once and forgot. A phone in a drawer isn't a retired device. It's an active one that simply isn't watching itself anymore, and neither is anyone else.
Why "off" reads as "safe"
There's a real psychological trick happening in that drawer, and it's worth naming: a screen that's dark reads as a risk that's over. It isn't. The device went quiet. The accounts logged into it didn't. That gap between "looks inactive" and "is inactive" is exactly where this particular risk hides — not in plain sight, but in a very convincing disguise of plain sight.
I've opened enough client systems to know this drawer exists almost everywhere, in some form — a decommissioned laptop, an old tablet, a phone handed down and never wiped. It's rarely dramatic. It's just something nobody assigned an actual ending to, so it never got one, and it's still quietly logged into everything it was logged into the day it went in the drawer.
Why "I'll deal with it eventually" doesn't work here
Because the risk isn't that the drawer gets used tomorrow. It's that it sits there for years, quietly aging out of every security update, every patched vulnerability, every improvement made to the very apps still logged into it — while still holding exactly as much of your life as the day you put it in there. The device gets weaker every year. What's on it doesn't get any less sensitive.
And most people don't even remember what's on the oldest one anymore, which is its own kind of exposure — you can't protect what you've forgotten you're still carrying. If somebody asked you right now, off the top of your head, which of your accounts are still logged into a phone you haven't touched since 2022, could you actually answer?
There's a second, quieter version of this drawer too: the old devices that belonged to somebody else — a parent's tablet after they upgraded, a kid's first phone, a partner's laptop from a job that ended. Those get inherited into the same drawer with even less thought, because nobody feels responsible for cleaning out an account that was never theirs to begin with. It sits there anyway, still logged in, still holding somebody's actual life, simply because nobody decided whose job it was to deal with it.
None of this requires becoming the kind of person who reads every terms-of-service update or backs up obsessively. It just requires treating a retired device the way you'd treat a retired employee's badge — deactivated on purpose, on a specific day, instead of left active by default because nobody got around to the paperwork.
The twenty-minute pass
Pick one device from the drawer, just one, this week. Before you do anything else, check whether anything on it is unique — a photo, a document — that doesn't already exist somewhere else. If it does, get a copy off it. That's the only step that actually matters; everything after this is cleanup.
Then sign out of everything on it you can still access — email, banking, anything with your name attached — the same way you'd cancel a card instead of just putting it in a different drawer. If you can still log in remotely and wipe it, do that too. A factory reset takes minutes and turns "unlocked room" back into "empty box." 🔐
Repeat with one more device next week. You don't need a weekend project. You need one device, twenty minutes, on a schedule you'll actually keep — which is the only kind of plan that survives past the first attempt.
If you genuinely can't tell what's on a device anymore — no memory of the passcode, no idea what accounts were ever logged in — treat that uncertainty itself as the answer. A device you can't account for isn't a mystery to shrug off. It's the clearest sign in the whole drawer that it's overdue for a factory reset, passcode or not, because a device nobody can inventory is a device nobody's actually protecting.
And once the drawer's actually empty, resist refilling it the same way. The next phone you retire deserves the same twenty minutes on the same day you unbox its replacement — copy what's unique, sign out, wipe it — instead of joining the next generation of the same pile. The habit only holds if it applies at the moment of replacement, not just as a one-time cleanup of everything that's already accumulated.
The honest inventory
Here's a question worth sitting with instead of scrolling past: if you had to list, from memory, every account still active on a device you haven't touched in two years, could you actually do it? Most people can't, and that's the real exposure — not that something's logged in, but that nobody, including you, could currently say what.
That's not a reason to panic. It's a reason to stop treating "I'll get to it" as a plan. A device with an unknown inventory isn't dangerous because someone's definitely going to find it. It's dangerous because nobody, including its owner, currently knows what "found" would even mean.
There's a reason this particular task keeps losing to everything else on the list: it doesn't feel urgent, and it doesn't feel rewarding either. Cleaning a closet gives you a visibly tidier closet. Wiping an old phone gives you nothing you can see — just one less unmonitored risk sitting in a drawer, which is a real result that simply doesn't look like one.
That's worth naming plainly, because it's the actual reason this task keeps losing to louder ones, not because it doesn't matter. Twenty minutes now is a trade very few people regret making, and almost everyone who's put it off says the same thing afterward: that wasn't nearly as bad as they'd built it up to be.
The takeaway
The drawer isn't harmless just because it's quiet. Quiet is exactly what an unmonitored risk looks like right up until it isn't one anymore. Pick one device this week and close the loop on it. 🤍
Want a real look at what else in your setup is quietly exposed? Start here: Discover