Who should control the authenticator after handover?
The person or business responsible for operating the account should control its second-factor sign-in method after the handover is complete. That usually means the buyer, or an authorised operator acting for the buyer, can receive verification prompts and manage recovery options without relying on the seller.
Two-factor authentication adds a check beyond the password. Depending on the platform and account settings, that check may use an authenticator app, a text message, a security key, a device prompt, or another method offered by the platform. The exact options differ, so check the account’s own security settings rather than assuming a method is available.
Before proceeding, confirm that the account can be transferred or used in the way intended under the platform’s terms. A handover should not involve concealing a change of control or trying to bypass platform checks. If the platform does not permit the proposed transfer, pause and resolve that issue before accepting access.
During the handover, agree who will complete each step and how the seller will remain available while the buyer verifies access. The goal is a clear transfer through the platform’s normal security flow, not a situation where both parties are unsure who can approve a sign-in.
What are backup codes, and why replace the old set?
Backup codes are recovery credentials that a platform may provide for use when the usual second-factor method is unavailable. They are different from the account password and should be treated as sensitive access information. Anyone who can use a valid code may be able to pass a sign-in challenge, subject to the platform’s verification process.
If the seller generated the existing codes, the buyer should not assume they are private to the buyer. The seller may have saved them, copied them, or stored them with other account information. Ask whether codes were issued and whether any were used, but do not treat the seller’s assurance as a substitute for replacing credentials the buyer cannot control.
Once the buyer has access to the platform’s security settings and has established a working second factor, use the platform’s official process to generate a fresh set of backup codes if that option is provided. This generally invalidates the previous set, but follow the platform’s on-screen instructions and confirm the change before relying on it. Store the new codes somewhere secure and accessible to the account’s authorised operator, not in a shared chat or an unprotected note.
If the platform does not offer backup codes, do not look for unofficial substitutes. Use only the recovery methods shown in the account’s settings and help flow.
What if the seller’s second factor is a device I cannot access?
A seller’s phone, tablet, computer, or security key is not a practical long-term second factor for the buyer. It can leave the buyer dependent on the seller for sign-ins, security changes, or recovery. It may also create confusion about who is approving an important prompt.
Do not attempt to work around the device check, ask the seller to disclose unrelated device credentials, or use a method that conceals who is accessing the account. Instead, coordinate a handover while the seller can complete the required prompt through the platform’s own verification flow. Then, where the platform allows it, add and test a second-factor method that the buyer controls, and remove the seller’s method through the account’s security settings.
Some platforms may require confirmation before a device or method can be added or removed. If the seller cannot complete the requested check, or the platform will not allow the change, pause the handover. Contact the platform through its official support or recovery route and follow its instructions. Do not treat continued dependence on the seller’s device as an accepted handover.
What if the second factor is a phone number I cannot reach?
A phone number that belongs to the seller, is no longer active, or cannot receive the buyer’s messages should not remain the buyer’s only route through sign-in. First establish whether the platform offers another approved verification method for this account. The available choices depend on the platform and its settings.
If the seller can still receive a prompt or code, arrange for them to complete the verification step while the buyer is present and ready to update the account. Then add a method the buyer can access and test it using the platform’s normal process. Only after the buyer has confirmed access should the old number be removed, if the platform permits removal.
If the seller cannot receive the code, do not try to redirect messages, obtain a replacement SIM in someone else’s name, or use an unofficial service to receive the code. Those approaches can compromise the account and may conflict with platform requirements. Use the platform’s own recovery flow, provide the requested information accurately, and wait for its decision.
If the number cannot be changed through the normal flow, the account is not yet fully under the buyer’s control. Record the limitation in the handover discussion and resolve it before treating the security setup as complete.
Why is setting up the buyer’s own method part of acceptance?
A password alone does not establish that the buyer can manage the account securely. If the seller still controls the authenticator, phone number, security key, or recovery route, the seller may remain necessary for ordinary access or future account changes. That is an unfinished handover, even if the buyer can sign in once.
Acceptance should include a successful sign-in using a method the buyer controls, as well as a check that the relevant security settings are visible and manageable. Where the platform allows it, confirm that the buyer can update the second factor and review recovery options without asking the seller to approve each step.
This does not mean changing every setting immediately or removing a method before a replacement is ready. Follow the order presented by the platform, keep a working verification route throughout, and avoid making multiple security changes at once if doing so would make it difficult to identify a problem. The buyer should not claim control until the new method has been tested in the platform’s own flow.
For an account type intended for a business or advertising work, also check that the person completing the change is authorised to manage that account under the platform’s requirements. Account security and account eligibility are related but separate questions; a successful two-factor handover does not itself confirm that a transfer is permitted.
What if the platform asks for extra confirmation?
An additional prompt can be part of the platform’s normal security process, especially when changing sign-in or recovery settings. It may ask the current account holder to confirm an action, request a code through an existing method, or ask for information through an official verification screen. The precise prompt varies by platform and account.
Read the request carefully and complete it only through the platform’s official app, website, or support channel. Make sure the page or app is genuinely associated with the service before entering a password or code. Never send a one-time code to someone who contacts you claiming they need it to “approve” the handover.
If the platform asks for confirmation from the seller’s device or number, pause and coordinate with the seller rather than attempting to skip the step. If the seller is unavailable, or the prompt cannot be completed, use the platform’s recovery or support process. Do not repeatedly guess, submit inconsistent information, or use another person’s identity to satisfy a check.
A request for more confirmation is not a reason to move the conversation to an unofficial workaround. It is a signal to follow the platform’s instructions and allow its process to determine what is needed.
How should buyer and seller coordinate the change?
Agree in advance on a simple sequence: the seller remains available for any confirmation the platform requires; the buyer signs in through the official flow; the buyer adds and tests an accessible second factor; and the old method is removed or replaced only when the platform permits it. Keep communication limited to the steps needed for the transfer, and do not exchange passwords or codes in a public or insecure place.
The seller should not retain access as an informal backup after the buyer has accepted control. At the same time, the buyer should not remove the seller’s method before having a working replacement if the platform requires the existing method to approve the change. Follow the screens in order and stop if the sequence differs from what either party expected.
Keep a brief record of which security changes were completed and which remain unresolved. Do not record secret codes in that handover note. If the platform blocks a change, record the message in general terms and use the platform’s official help route rather than asking the seller to keep signing in indefinitely.
When is the two-factor handover complete?
The handover is complete when the buyer can access the account through the platform’s normal sign-in process, control an approved second-factor method, and manage the available recovery settings without depending on the seller. If backup codes are offered, the buyer should have replaced any seller-held set and stored the new set securely. The buyer should also know whether any old device or number remains attached.
Do not assume that changing the password alone transfers control, or that a successful sign-in proves every recovery option has been updated. Review the security settings shown by the platform and resolve any method that still belongs to or depends on the seller, where removal is allowed.
If a required confirmation cannot be completed, the platform’s recovery process is still pending, or the proposed transfer is not allowed by the platform, the account should not be treated as fully handed over. Pause operations that depend on secure, independent access until the issue is resolved through the platform’s own process.