Check that the transfer is allowed
Receiving a username and password does not necessarily mean you have reliable control of an account. Recovery email addresses and phone numbers can be used to verify identity, reset access, or receive security alerts. If those details still belong to the seller, the seller may remain involved in access and recovery, even after handing over the login.
Before accepting an account, read the platform’s current terms and account policies. Platforms such as Google, Meta, and TikTok can have different rules for account ownership and transfers, and policies may vary by account type or service. A transfer that is permitted in one situation may not be permitted in another. If the platform does not allow the transfer you have in mind, changing recovery details does not make it compliant.
Treat the account as a working tool, not just a set of credentials. Confirm what is being handed over, what access is included, and whether the seller will cooperate with platform-sanctioned changes. If anything is unclear, pause before using the account. Do not rely on a promise that a transfer is acceptable when the platform’s own terms say otherwise.
Agree on the handover before signing in
A smooth handover starts with clear communication. Arrange for the seller to be available while you sign in and update the account through the platform’s own settings. Security checks may require the existing recovery email or phone, or another confirmation from the current account holder. The seller’s cooperation can therefore be essential.
Agree on the sequence in advance: sign in through the platform’s official app or website, open the security or account settings area, add your own recovery contacts, confirm them, and then remove the seller’s contacts if the platform permits and the change is complete. The exact labels and order differ between services, so follow the platform’s instructions rather than a generic walkthrough.
Avoid asking the seller to send passwords, verification codes, or recovery links through channels that are not part of the platform’s normal process. Do not ask anyone to bypass a security prompt or conceal a transfer from the platform. If a verification step cannot be completed legitimately, stop and resolve the issue with the seller or the platform’s support process.
Sign in and find the security controls
Use the platform’s official sign-in page or app. Check that you are entering the correct account and that the session is not being opened through a link supplied by an unknown party. Once signed in, look for the account, security, login, or personal-information area. Settings can be organized differently across Google Accounts, Meta services, TikTok, and other platforms, so take time to read each screen.
Before making changes, review the existing recovery information and any other security methods shown. This helps you understand which contact belongs to the seller and whether another method could affect your ability to complete the handover. Do not assume that changing the visible email address also changes every recovery or notification setting.
If the account displays an unfamiliar device, contact, or security method, ask the seller to explain it before proceeding. Make changes only through settings provided by the platform. Do not use third-party tools or instructions that claim to transfer ownership by avoiding the platform’s checks.
Add and confirm your own recovery contacts
Enter an email address and phone number that you control and can continue to access. A recovery contact should be suitable for ongoing use, not a temporary address or number that may soon be unavailable. Keep access to these contacts separate from the account where practical, so losing access to one does not automatically block access to the other.
Follow the platform’s confirmation process. It may send a message or code to the contact you are adding. Check the details carefully before confirming, and make sure the platform shows the new contact as verified or available for recovery. A contact that has merely been entered but not confirmed may not provide the protection you expect.
If the platform requires confirmation through the seller’s existing contact, coordinate that step openly with the seller. The seller should provide assistance through the platform’s normal verification flow, not by disabling security or handing over unrelated personal information. If the platform refuses the change or asks for further verification, follow its instructions and do not try to work around the check.
Remove the seller’s details and review access
Once your own recovery contacts are confirmed, use the platform’s settings to remove the seller’s email address and phone number where removal is allowed. Check each recovery and security field rather than assuming there is only one. Some services separate recovery information from profile contact details, login methods, or notification preferences.
Review other access routes the platform exposes, such as signed-in devices, connected applications, or additional authentication methods. Remove only access that belongs to the seller and only through the platform’s normal controls. Do not remove a method until you understand whether doing so could lock you out or conflict with the platform’s requirements. If the seller has access that cannot be removed through ordinary settings, pause and seek guidance from the platform.
Then sign out and test your own access by signing in again through the official service, if doing so is safe and consistent with the platform’s instructions. Confirm that you can receive the expected security or recovery communication. Avoid repeated attempts if the platform presents a warning or verification challenge; use its stated support options instead.
Record the handover and keep the account in good order
Keep a concise record of the handover: when the changes were made, which recovery contacts were added and confirmed, which seller contacts were removed, and whether any platform prompt remains unresolved. Do not store passwords or verification codes in an informal record. A screenshot of a settings page may contain personal information, so keep documentation private and share it only when necessary.
A completed recovery change is not a guarantee that an account is transferable, permanently secure, or free of other access issues. It is one practical part of putting an account under your control, subject to the platform’s terms and security processes. Keep your recovery email and phone current, protect access to them, and respond to future security notices through the platform itself.
If the seller cannot cooperate, the platform blocks the change, or the account’s status is uncertain, do not treat the handover as complete. Resolve the matter before using the account for work. The safest standard is straightforward: permitted transfer, clear seller cooperation, confirmed recovery contacts that you control, and a record of what the platform’s settings show.
Why recovery access matters
A mailbox can be more than a place to read messages. It may be used to register for platforms, receive account notices, confirm changes and reset passwords. If you lose access, other services connected to that address may become harder to manage too. Recovery options give the provider ways to check that you are the rightful account holder and help you regain access.
For a media buyer, this makes mailbox access part of account preparation, not an afterthought. When setting up a mailbox for work, check which recovery methods the provider offers and make sure they are under your control. Features and steps differ between services such as Gmail, Outlook and Yahoo Mail, so use the instructions shown in the account’s own security settings.
Recovery options are not a guarantee that access can always be restored. Providers may ask for information to verify ownership, and the available process can change. The practical goal is to keep your details accurate, maintain access to recovery channels and know where to start if a problem occurs.
Set up more than one route
A secondary email address can provide a route for recovery messages or account notices. Choose an address you can access independently and intend to keep. Before adding it, sign in to that mailbox and confirm that its password and recovery details are current. An address that you cannot open is not a useful recovery option.
A phone number may also be available. Add a number that you control and can continue to access, then follow the provider’s verification steps. If your number changes, update it in the mailbox settings rather than assuming that the old number will remain usable. Avoid relying on a number belonging to a seller, colleague or temporary service: recovery should lead back to you.
Some providers offer backup codes. These are intended for situations where the usual sign-in or verification method is unavailable. If the provider gives you codes, follow its instructions for storing them securely and check whether using or regenerating them affects the previous set. Keep them somewhere separate from the mailbox itself; storing the only copy inside the account they are meant to recover defeats their purpose.
Security questions are still used in some recovery systems. Where they appear, answer accurately and store the answers securely if you may not remember them later. Do not assume that every provider offers this option, or that questions replace other recovery methods.
Keep the recovery chain independent
Recovery options can fail together if they depend on one another. For example, if mailbox A can be recovered only through mailbox B, but mailbox B can be recovered only through mailbox A, losing access to both leaves no independent route. This circular setup is easy to overlook when preparing several accounts.
Instead, make sure each important mailbox has at least one recovery route that does not depend on that mailbox. This might be a phone number you control or a separate address whose own recovery method is independent. Consider the full chain: a recovery address is useful only if you can also recover that address.
For accounts used as work tools, make a simple record of which recovery options are attached to each mailbox and where the credentials or backup codes are stored. Keep that record private and protected. Do not put passwords or recovery codes in an unprotected note, and do not share them with a seller who has already delivered an account.
Review details and secure access
Recovery details can become outdated when you change phones, stop using an address or lose access to a device. Review the security and recovery settings periodically, especially after a change in your contact details or the transfer of an account into your control. Remove recovery methods that no longer belong to you, and add current ones through the provider’s official settings.
If you accept a mailbox as part of a legitimate account handover, follow the provider’s terms and make sure you have permission to manage it. Change credentials and recovery details only through the official account controls available to you. Confirm that the recovery routes lead to channels you control, and check whether any old contact method remains attached. If the provider does not allow the transfer or use you intend, do not try to bypass its checks.
Keep access information distinct from recovery information. A password manager or another secure storage method can help organize credentials, while backup codes should be stored as the provider recommends. Protect the devices and accounts that hold these details as carefully as the mailbox itself.
If access is already lost
Start with the mailbox provider’s official recovery process. Use the provider’s own website or app and follow the prompts for the account you are trying to recover. Avoid links in unsolicited messages that claim to restore access; navigate to the provider directly rather than handing credentials to an unknown page.
Answer the questions honestly and provide the information requested. Depending on the provider and situation, the process may ask you to confirm a recovery address or phone, use a backup code, or supply other details associated with the account. Gather what you can before starting, such as access to the recovery channels you previously added and any account information the official process requests. Do not guess repeatedly or submit inconsistent details simply to get through the form.
Be cautious of third parties that promise to restore a mailbox, including people who ask for your password, verification codes, backup codes or remote access to your device. They cannot substitute for the provider’s ownership checks, and sharing sensitive details can create further risk. If recovery does not work, use the provider’s published support options and continue to follow its process. Once access is restored, review the recovery settings, remove details you do not control and update your records so the same problem is less likely to recur.