Introduced in Android 5.0 Lollipop, Android"s Factory Reset Protection is supposed to prevent phones from being easily reactivated on a new Google Account immediately after a factory reset. This would, if implemented correctly, make it very difficult to resell stolen Android handsets. Apple and Microsoft have also introduced similar anti-theft features to their mobile devices after a pledge to support the feature. However, Samsung seems to have made a mess of Android"s security provisions, as demonstrated by this video.
The video shows how Android stops a potential thief from logging in with a new Google Account. On Samsung phones there is a huge hole in the process because they automatically launch their File Manager app when a USB storage device is plugged in, apparently even during the Android setup process.
The user, RootJunky, has developed a third party application that will allow you to bypass the Factory Protection on the phone by doing a second factory reset, this time appearing to the phone as a brand new install. There is no warning for Factory Reset Protection, allowing the thief to setup a brand new Google account on the phone, or sell it unprotected.
This hack only appears to work on Samsung devices due to their File Manager behavior during setup, and no one should view this as an endorsement to steal Samsung phones. But owners of susceptible devices should watch their phones a little closer, since bypassing this protection requires very little technical know-how.
Source: RootJunky via 9to5Google