A transfer spans three layers, not one password
Play Console has no single button that transfers an account as a whole. A developer account is a Google account, plus its permissions in Console, its payments profile and its verified identity. Asking which logins to change covers only the first layer. A better pre-purchase question is what will be controlled only by you after handover, and what stays tied to the seller. Interfaces and flows change, so rely on the Play Console and Help Center pages as they stand at handover time.
Login layer: everything below must end up in your hands
The Google account email and password are the starting point, not the finish. Check the recovery email, recovery phone, two-step verification methods (authenticator app, backup codes, security keys or passkeys) and signed-in devices and sessions. Changing only the password leaves the previous holder able to use account recovery. Inside Console, confirm you hold owner or admin level under users and permissions, and remove stale users. Update the developer contact email and phone too, otherwise platform notices and verification codes still reach the old contact.
Linked services: payments, ads, cloud projects, API credentials
Accounts often carry dependencies that are invisible from the Console home page. The payments profile determines who receives payouts and who is billed. A Google Ads link needs a clear owner. Firebase or Google Cloud projects may hold service accounts and API access used for automated publishing or subscription queries. Notification Google Groups may also exist. None of these automatically follow a login change. Ask the seller to state which ones exist, and treat any old credential that remains valid as a risk to revoke and recreate.
App layer: for accounts with apps, verify signing and ownership
When buying an account that comes with apps, three things matter more than the app count. First, the package names really sit under this account and their status is clean, with no policy warnings or restrictions on record. Second, whether Play App Signing is enabled. If so, Google holds the app signing key, but the upload key remains with the original developer, so confirm you receive it or understand the platform's reset process. Third, Play Console offers an app transfer feature with its own conditions, such as subscription and payment setup limits. Check the official help page and do not treat it as a substitute for account handover.
Identity layer: a new login does not change the verified identity
This is the point most often overlooked. An individual account is verified against a real person's name and details. An organization account is tied to a company name, a D-U-N-S number and similar data. Replacing the login email changes none of that. If the platform later asks for re-verification, extra documents or an appeal, it will expect materials from the registered entity. The test is simple: before ordering, ask who the registered entity is and who will cooperate when verification is needed. If the answer involves supplying identity documents that are not yours, or submitting inaccurate information, stop. It breaks platform rules and puts the account at direct risk.
Handover order and when to stop
A safer sequence is this. Have the seller add you in Console with owner or admin rights, and confirm you can see apps, payments and users. Then replace recovery email and phone, reset two-step verification and sign out other devices. Next, deal with linked services and API credentials. Finally remove old users and verify the developer contact details. Do each step on your own device and keep screenshots. Stop or switch plans if the seller cannot prove control of the recovery email or phone, if the process keeps needing live codes from the old holder who is unavailable, if the account has unresolved policy or payment issues, or if the registered entity is not disclosed.