What to Do After Buying a Game Account (Security Checklist)

The moment your purchase is confirmed, do these things in order: change the email address to one you own, set a new strong password, enable authenticator-based two-factor authentication, remove the seller's phone number and sign out their devices, then save your proof of purchase. Each step closes a specific recovery path the previous owner could use; skip one and the account is never fully yours.

Buying a game account on a reputable marketplace is straightforward, but the transfer of security is on you. The seller hands over credentials; you have to turn them into a locked-down account that only you control. This checklist walks through every step, in the right order, for Riot (Valorant and League of Legends), Steam (CS2) and Epic Games (Fortnite). If you haven't bought yet, read our guide on how to buy game accounts safely first.

1. Change the email to one you control

This is the most important step, and it must come first. Every major gaming platform uses the registered email address as its account-recovery anchor. If the email tied to the account still belongs to the seller, they can trigger a "forgot password" flow at any time and lock you out, even after you change the password.

A proper listing includes access to the original email inbox; use it now to complete the email-change verification. If you didn't receive it, contact the marketplace's support immediately, while your buyer protection is still active.

• Riot (Valorant / LoL): change the email in your Riot account settings; you may need to confirm from the old inbox. Step-by-step: how to change your Valorant email.
• Steam (CS2): Account Details, then manage your email address. Steam sends a verification to the current email, so original email access matters here too. See how to change your Steam email.
• Epic Games (Fortnite): edit the email in your Epic account settings; Epic sends a confirmation code to the existing address. See how to change your Fortnite email.

Use a dedicated email address for gaming accounts, one you don't use for anything else. If that inbox is ever compromised, the damage stays contained.

2. Change the password

Once the email is yours, change the password immediately. The seller knew the old one; there's no reason to leave it in place. A strong password is long (16 characters or more), mixes character types, and is unique to this account.

The simplest way to meet all three every time is a password manager: let it generate the password and remember it for you. Avoid your username, your birthday, the game's name or any password you already use elsewhere. Credential-stuffing attacks try leaked username and password pairs across many platforms, and a unique password shuts that door.

3. Enable two-factor authentication

With a new email and password in place, two-factor authentication (2FA) is the next lock. Even if someone obtains your password, they can't sign in without the second factor. Use an authenticator app rather than SMS where possible: SMS codes can be intercepted through SIM swapping, while an app's codes exist only on your device.

• Riot: multi-factor authentication in the account settings, by email code, authenticator app or the Riot Mobile app.
• Steam: Steam Guard, managed through the Steam mobile app. It also affects trading, as explained below.
• Epic: Password & Security, then Two-Factor Authentication, ideally with an authenticator app.

For exactly where each setting lives, see our guide on how to enable 2FA on your game account. When you enable 2FA you'll usually be offered backup codes; store them in your password manager or print them.

4. Remove old phone numbers and sign out old devices

Phone numbers are a second recovery path. If the seller's number is still on the account, they could use an SMS reset, or cite the number as proof in a support claim.

• Remove any phone number you didn't add yourself, then add your own.
• Sign out of all active sessions. Most platforms have a "sign out everywhere" or "deauthorize all devices" option, which ends any sessions the seller still has open.
• On Steam, review the devices listed under Steam Guard and remove anything you don't recognise.

After signing out every session, sign back in yourself, so only your devices hold active logins.

5. Review linked accounts and payment methods

Before you connect your own accounts, check what's already linked.

• Connected social logins: some accounts have Google, Apple, Facebook or PlayStation sign-ins attached. Remove any you don't own; they're extra recovery routes for whoever controls them.
• Linked consoles: unlink consoles you didn't set up, then link your own where the platform allows it.
• Saved payment methods: remove any card or PayPal account the seller left on file, and don't add your own until steps 1 to 4 are done.

6. Keep your proof of purchase

Marketplaces keep transaction records; keep yours too. If you ever need to show platform support or the marketplace that you acquired the account in good faith, a dated receipt showing what was bought, when and from whom strengthens your case. Save the order confirmation, email receipts and a private record of the credentials as delivered, in a folder separate from the accounts themselves. If you ever lose access, our Riot, Steam and Epic recovery guides explain what each support team asks for.

Platform differences to know

• Riot ties accounts to a region, and region changes are limited, so confirm the region before you spend anything. Riot's enforcement targets how an account is played, such as boosting and account sharing, so play it yourself; our explainer on smurfing and Riot's rules covers what it targets.
• Steam holds trades for up to 15 days until the Steam Guard Mobile Authenticator has been active for seven days, and security changes such as a new email or password bring their own temporary trading and market restrictions. That's a fraud-prevention measure, not a fault.
• Epic (Fortnite) allows one linked account per console platform. After a console account is unlinked, Epic blocks linking a different account of the same platform until the restriction is lifted with a code sent to the account email, so check the link status before adding your own console.

Step	What to do	Why it matters
1	Change the account email to your own	Closes the seller's password-reset path
2	Set a new, unique, strong password	Invalidates the credentials the seller knew
3	Enable authenticator 2FA; save backup codes	Blocks sign-in even if your password leaks
4	Remove the seller's phone; sign out all devices	Ends active sessions and the SMS-recovery route
5	Remove linked socials, consoles, saved cards	Strips alternate sign-ins and billing exposure
6	Save your purchase receipt and confirmation	Supports your case if you ever need help

Frequently Asked Questions

What is the single most important step?

Changing the email address. Password resets, 2FA recovery and phone recovery all route through the registered email. As long as someone else controls that inbox, they have a way back in. Change the email first, verify it, then work through the rest of the checklist.

What if I didn't get access to the original email?

Contact the seller through the marketplace straight away and ask for the email access the listing promised. If they don't respond, open a dispute with marketplace support while your protection window is still open, and keep the conversation on record. Without the original email you can't fully secure the account.

How soon should I complete these steps?

Straight away, in one sitting. The longer the seller's email, password and devices stay active, the longer they have a way in. With access to the original email, the whole checklist usually takes well under an hour.

Can the seller still recover the account after I've done all of this?

If you've completed every step (your own email, a new password, your own 2FA, their phone removed and their devices signed out), their practical routes back in are closed. The remaining risk is a support claim using old purchase records, which is why keeping your own proof of purchase matters. What these steps can't change is the publisher's own rules on account transfers.

Ready to buy your next account? Purchases on BuyAccount come with 14-day buyer protection against recovery, listing mismatches and failed delivery, and if you have accounts you no longer use, you can apply to become a seller.