2FA Hygiene After Buying an Account: The First 24 Hours

The first twenty-four hours after taking control of a verified account are the most security-sensitive window of the entire ownership cycle. Credentials have just changed hands. Old session tokens may still be valid. The previous owner has, by definition, full knowledge of how the account was configured before the sale. If you do not lock down the account properly in the first day, you are operating on borrowed time. This article walks through the exact protocol we recommend, in the order we recommend running it, with the reasoning behind each step.

Step one: change the primary password from a clean environment

Before doing anything else, log into the account from a clean browser session in a private window on a device the previous owner has never touched. Change the primary password to something newly generated by a password manager. Use at least sixteen characters with high entropy. Do not reuse a password from any other account in your portfolio. This step alone closes off the most common attack vector: the seller logging back in with the original credentials they still remember.

Most platforms will invalidate active sessions when the password changes. Some do not. Check the platform's session management page immediately after the password change and force-terminate any sessions you do not recognise.

Step two: rotate the recovery email

The recovery email is the most powerful re-entry vector for someone who has lost the primary password. If it points to an inbox the previous owner controls, they can trigger a password reset and recover the account at any time, even after you have changed the password. Replace the recovery email with one you fully control. Ideally use a freshly created inbox dedicated to this single account, with its own strong password and its own 2FA.

Some platforms require email verification to change the recovery email. The verification link goes to the old recovery email first. This is why having the seller present during this step is critical. Coordinate so the seller forwards the verification link the moment it arrives, and complete the change within minutes. Never leave the verification email sitting in the seller's inbox overnight.

Step three: rotate the recovery phone

The recovery phone is the second-most-powerful re-entry vector. Replace it with a number you control. If the platform allows phone-free configurations, consider removing the number entirely and relying on app-based 2FA only. If the phone is required, use a long-lived SIM you own outright, not a temporary or pay-as-you-go number that might be reassigned.

Step four: disable existing 2FA and re-enable on your device

This is the step buyers most commonly skip and most commonly regret. The previous owner's 2FA seed, whether stored in Google Authenticator or Authy or a hardware key, remains valid forever unless you actively remove it. Even if they swear they deleted it, you cannot verify that. Treat existing 2FA as compromised by default. Disable it completely, then re-enable it from scratch using a 2FA app on your own device.

When you re-enable 2FA, the platform will generate a new set of backup codes. Print them. Store the printed copy in a secure physical location. Store a digital copy in your password manager. These backup codes are the only thing standing between you and a permanent lockout if your 2FA device is lost or destroyed.

Step five: review and revoke API keys

Many exchange accounts have API keys configured by the previous owner. These keys can have permissions ranging from read-only to full withdrawal authority, and they bypass 2FA entirely. The first thing to do after the password and 2FA changes is to navigate to the API management page and revoke every existing key. Do not analyse what they were used for. Do not assume any of them are safe. Revoke all of them, then issue new keys only as you need them for your own integrations.

Step six: audit connected applications and OAuth grants

Most platforms support OAuth integrations that grant third-party applications limited access to the account. The previous owner may have authorised applications you have no awareness of. Some of these applications, depending on the grant scope, can read sensitive data or perform actions on the account's behalf. Revoke all third-party application grants you did not personally create.

Step seven: update the security email destinations

Many platforms send security notifications - login alerts, withdrawal confirmations, configuration changes - to a separate notification email address that may or may not be the same as the recovery email. Make sure this notification address is one you check regularly. Future security events will only protect you if you actually see the alerts.

Step eight: lock down withdrawal addresses

On exchange accounts, the withdrawal address whitelist is the last line of defence against fund theft. Even if every other layer is compromised, a properly configured whitelist with a delay window prevents funds from leaving to addresses you have not pre-approved. Set up the whitelist with addresses you control, enable the maximum-strength delay window (often 24 to 48 hours), and configure email notifications for any whitelist changes.

Step nine: document the new state

Write down, in a secure location, the exact configuration you have just put in place. Which recovery email is in use. Which phone number. Which 2FA app on which device. Where the backup codes are stored. Which API keys exist and what they are used for. This documentation will save you significant time the next time you need to access the account from a new device or recover from a partial loss.

Step ten: monitor for the first week

For the first seven days after the handover, check the account's security log daily. Look for unfamiliar logins, unexpected device additions, or any configuration changes you did not make. If anything suspicious appears, lock the account immediately and start the security review process from scratch. Most takeovers, when they happen, happen within the first week. After that window passes cleanly, the operational risk drops dramatically.

The bigger picture

This protocol takes about an hour to run end-to-end on a single account. That is the cheapest insurance premium in the entire verified-account market. Buyers who skip it routinely lose accounts to the original sellers months later and have no recourse. Buyers who run it consistently end up with accounts that remain theirs indefinitely, and they build the operational discipline that compounds across a portfolio of dozens or hundreds of accounts.

Spend the hour. Every time. The accounts you buy will keep working, and your operational risk will stay near zero across whatever scale you eventually run at.