How to make a bought account properly yours

Password first, then email

Change the password before anything else. It is the credential that was shared, and until it changes, everything else you do can be undone by whoever still has it.

Then change the linked email to one you control. This is the step people skip, and it is the one that actually matters: a password reset goes to the email on file, so leaving the old address attached means leaving a spare key under the mat.

Do it in that order, not the other way round

Changing the email first usually triggers a confirmation to the old address — which is not yours. Changing the password first closes the session and makes the email change stick.

Then two-factor, if the provider offers it

Optional, and worth the two minutes. Once it is on, knowing the password is no longer enough for anyone, including us.

Tell the shop you are done

On our order page there is a checkbox for this. Ticking it makes us destroy our copy of the login immediately instead of holding it for thirty days. There is no reason not to, and one good reason to: we cannot lose what we no longer have.

If something goes wrong afterwards

You have seven days. If the login stops working or the original holder recovers the account, open a claim from the order page and we replace it. That is what the window is for — use it rather than arguing with your bank, which is slower and worse for everyone.