Selling a Business: How to Hand Over Accounts Without Bans
A practical guide to transferring ad accounts, social pages, and marketplace logins when selling a business, without triggering platform fraud checks.
When This Is Actually Legal
Let's separate two scenarios that get confused constantly.
The first is selling an account as a product: a Facebook ad account with spend history, a grown Instagram page, a marketplace account with a rating. This directly violates the rules of nearly every major platform. Meta, Google, Amazon, and TikTok explicitly prohibit transferring account ownership to a third party outside their official mechanisms. If a cabinet gets banned after such a sale, that's not a bug — it's the antifraud system doing its job.
The second scenario is selling the whole business: an agency, an online store, a SaaS product, a portfolio of sites. Along with the legal entity, domains, and customer base, the new owner also inherits working tools — ad accounts, social pages, CRM access, a Shopify login or a marketplace seller account. This is a standard part of M&A, and many platforms have official mechanisms for it: Business Manager ownership transfer in Meta, admin transfer in Google Ads MCC, owner change in Google Business Profile, billing transfer in AWS Organizations.
The difference is fundamental: in the first case you're circumventing platform rules; in the second, you're using a legitimate procedure to change ownership of a business asset. This article is about the second case. If a platform has no built-in transfer mechanism and what's actually being sold is access to a specific account, it's worth consulting a lawyer and reading the terms of service beforehand, rather than relying on "this is how it's usually done."
What Typically Counts as a Digital Asset in a Sale
When a deal to sell an agency or a store closes, the list of accesses to transfer is usually longer than it first appears:
- ad accounts (Meta Ads, Google Ads, TikTok Ads) and the Business Managers tied to them;
- social pages and accounts, including TikTok, YouTube, LinkedIn;
- a marketplace seller account or a Shopify/WooCommerce admin panel;
- email marketing — an ESP account, subscriber list, sending domain reputation;
- analytics — GA4, Search Console, pixels;
- 2FA code storage and backup recovery emails;
- API keys for integrations — payment gateways, CRM, inventory systems.
Each item is a separate login, often a separate session, frequently a separate phone number for 2FA. If the seller just dumps passwords into a single file and the buyer logs in from a different laptop in a different country, access can get locked on day one — and dealing with platform support becomes a post-signing headache.
Why an Abrupt Access Change Looks Suspicious
Antifraud systems on major platforms are trained on one simple pattern: an account that has logged in from the same device, same IP, same location for years suddenly changes everything at once in a single day — password, recovery email, 2FA phone, login device, time zone. To the system, this is a textbook account takeover profile, and the typical response is a temporary freeze, a request for identity re-verification, or restricted functionality like disabling ad delivery.
This is exactly the technical problem agencies run into with ordinary profile handoff between employees, just at a smaller scale. The logic mirrors what's described in the piece on transferring a profile between teammates without changing the password: the fewer abrupt changes a platform sees at once, the calmer its protection system behaves.
When selling a business, the stakes are higher: freezing an ad account with $40,000–60,000 in spend history isn't just an inconvenience — it's a direct financial risk to the deal and to both parties' reputations.
A Due Diligence Checklist for Digital Assets
Before signing, it's worth building a registry — separate from legal due diligence, but just as thorough.
| What to check | Why it matters |
|---|---|
| Who formally owns the account/cabinet | Many agencies have had a client's ad account sitting under the founder's personal email for years |
| Is the 2FA phone tied to the seller's personal number | Without replacing the number, access disappears along with the seller |
| Does the platform have an official ownership-transfer feature | Meta Business Manager, Google Ads MCC, AWS Organizations — this removes half the risk |
| Login and device history over the last 90 days | A sudden pattern break is a red flag for antifraud |
| Linked payment methods | The seller's card needs to be removed, not left "just in case" |
| Secondary integrations (pixels, APIs, webhooks) | These get forgotten most often, and traffic or data gets lost as a result |
The main mistake at this stage is assuming this registry is only for lawyers. In practice, it's used by the technical person running the actual transfer, and without a precise list they will inevitably miss something.
How to Transfer Access Technically, Step by Step
1. Use the platform's official mechanism if one exists. Business Manager ownership transfer in Meta, adding a new administrator in Google Ads followed by removing the old one, transferring a GitHub Organization — all of this is built into platform rules and doesn't look anomalous to the system, because it happens through a standard interface rather than a manual password change.
2. Don't change everything at once. If there's no official mechanism and you have to work through credential changes, stretch the process over 2–4 weeks. First add the new admin/user, let the account "get used to" the new login pattern, and only then remove the old owner.
3. Preserve the login environment during the transition. This is the trickiest part, and a separate isolated browser profile with a managed fingerprint usually helps: the same time zone, the same IP region, the same set of OS and screen parameters the account used before. An abrupt fingerprint change happening alongside an ownership change is one more reason for a review system to demand identity verification at the worst possible moment.
4. Transfer 2FA access separately and securely. Two-factor codes can't just be read over the phone or pasted into a shared file — this is the most common reason a new owner loses access a month after the deal, once the seller's old phone is switched off or lost. If accounts were managed through profiles with their own 2FA key vault, this step reduces to a standard profile handoff — keys move along with everything else, without sending secrets as plain text.
5. Update payment details and contact email last. This is the final step, after which there's no going back. Do it only once the buyer's access is confirmed and stable for at least a few days.
6. Keep a log of the transfer. Who did what, and when, during the handover period — useful if the platform raises questions, and simply good insurance in case of a dispute between the parties. This practice overlaps with what's described in the piece on activity logs as an audit tool, not surveillance: recording actions is documentation for a dispute, not spying.
7. Only after things stabilize — switch IP and device for good. Once the new owner is established, work can gradually move to their regular proxy and familiar environment, without rushing.
Common Mistakes
Changing the password and 2FA on the same day as the sale. A classic: the contract is signed, and that same evening everything gets changed at once. Within 24 hours the account goes into review, ad campaigns pause, and the buyer calls the seller with a complaint, even though the seller is no longer legally involved.
A forgotten admin access left for the seller. Six months later it turns out the former owner is still listed as an administrator in Google Analytics, or still has access to one of the connected services. It's not malice — the registry during the transfer was simply incomplete.
Sending the password over messenger. A password and 2FA codes sent as text stay in chat history forever — for both seller and buyer, and potentially for third parties if either account's messenger gets compromised.
One shared account for the buyer's entire team instead of separated roles. The new owner immediately hands the password to three employees and ends up with the same problem discussed for ordinary teams in the piece on onboarding a new employee without leaking access: without splitting work across profiles and roles, it's impossible to tell who did what in the cabinet if something goes wrong.
Ignoring cookie and session backups. If the session drops after a password change and there's no backup of the profile state, you'll have to go through identity verification from scratch — which on some platforms can take anywhere from a couple of days to several weeks.
The Browser Profile's Role in This Process
The simplest approach is to treat each transferred account not as a login-password pair, but as a complete working environment: browser fingerprint, a proxy with the right geolocation, cookies, saved sessions, 2FA key storage. That's how profiles work in GetAntik, and for a business sale scenario this gives a concrete advantage — the entire set transfers to the new owner via profile transfer to another account rather than being rebuilt manually from scratch on the buyer's side.
Since profile data is encrypted on the device with the account password and the server can't read it, the transfer happens without a third party — including the antidetect platform itself — ever seeing passwords and sessions in plain form. More on how this protection works is on the security page.
If the seller's team and the buyer's team work in parallel for a while — say, the buyer is already managing the ad account while the seller still has obligations to the client under old agreements — it's convenient not to cut off access abruptly, but to grant temporary live access to the same profile for the handover period, without exposing the password to the other side.
Once the deal closes, the seller's access should be shut down just as carefully as when an employee leaves a team — a full permissions-revocation cycle, not just deleting one password. That process is covered in detail in the piece on closing access during offboarding without losing accounts, and it applies almost unchanged to wrapping up a business sale.
A good way to try this approach is to start with the free plan's 3 profiles — enough to test transferring a couple of accounts before a real deal, check the pricing for a larger team, or go straight to the download page.
FAQ
Can I just sell a Facebook ad account separately, without selling the business? Technically this violates Meta's rules — ad accounts and Business Managers can't be transferred as a standalone product. If it's a full business sale, with the legal entity and assets included, the correct path is an official ownership transfer inside Business Manager, not selling a login and password.
How much time should I budget for a secure access transfer when selling an agency? In practice, two to six weeks, depending on the number of platforms and whether official ownership-transfer tools exist. Platforms with a native mechanism (Google Workspace, AWS) transfer in days; accounts without one require a more careful, staged handover.
What if the old owner is already unreachable and access is lost? Start with the platform's own access-recovery procedure, providing documents confirming the transfer of business ownership. This is slow and doesn't guarantee success — which is exactly why the access registry and 2FA setup need to be prepared before the deal closes, not after.
Should I change the login IP and device right after the transfer? No, and in most cases an abrupt change does more harm than good. It's smarter to keep the platform's familiar geolocation and environment settings for a while, gradually moving work over to the new owner's infrastructure.