Check who can reset the password, not just who can log in
A successful login only proves the password worked at the moment of handover. Control is decided by the reset paths: who receives verification codes, who can run account recovery, and who can remove or replace 2-step verification. If any one of these still sits with the seller, the account has not really changed hands. Before looking at the console, ask which email, phone number and device each of those paths is tied to.
The login email and Play Console permissions are two layers
A developer account sits on top of a Google Account, and Play Console has its own Users and permissions area. The first decides who holds the credentials. The second decides who can do what inside the console. A common surprise is receiving the login email but finding other users still listed, or discovering you are an invited admin rather than the account owner. Confirm who the owner is, list every user with their permission scope, and have unrecognized users removed at handover.
Recovery email and phone should end up with the buyer only
Recovery email and recovery phone are among the main signals Google uses to decide whether someone is the legitimate account holder. If they remain the seller's, the seller can start a recovery at any time, and the risk of a takeback or lock never goes away. Ask for both to be replaced with buyer-controlled details during handover, and complete a code test yourself instead of accepting a verbal confirmation. Also check whether the recovery address belongs to another Google Account, and who controls that one.
The 2-step verification method decides whether it can be handed over
2-step verification comes in several forms: device prompts, authenticator apps, security keys, backup codes and SMS. They differ a lot in how cleanly they transfer. A method tied to the seller's personal number or a physical key cannot be handed over until the buyer adds their own method and the seller's is removed. An authenticator secret stored only on the seller's phone breaks when that phone changes. A safer order is: the buyer adds and tests their own method, the seller's old methods are removed, then backup codes are regenerated so old ones stop working. Exact menu names follow what Google's account security page shows at the time.
A checklist you can run on handover day
Run these in order. One, log in fully from your own device, including the 2-step prompt. Two, open Play Console and check the account type (personal or organization), the developer account ID and the app list against what was agreed. Three, review Users and permissions: confirm the owner and remove anyone unexplained. Four, review the Google Account's recovery email, recovery phone, signed-in devices and backup codes, and confirm all are now yours. Five, settle in writing who is responsible for the registration fee, renewals and payment profile details, bearing in mind that the platform's pages at that time govern. Six, pay the balance only after all of this passes.
Situations where you should stop and reassess
If the seller will not give up recovery details, or says verification will stay with them and they will help when needed, control has not been transferred. Stop as well if 2-step verification can only live on the seller's device and no buyer method can be added. Unexplained console users, or an account type or identity that differs from what was agreed, need to be clarified first. Platform rules on account transfer and identity can change, and identity verification is tied to the registered person or organization, so changing credentials does not change who the account is verified as. Check that your intended use fits current platform terms, and rely on the platform's pages rather than verbal assurances.