An account bought on Monday and locked on Thursday is the most-repeated story in every thread about buying LinkedIn accounts, and it is almost never the purchase that did it. Four specific things cause it. Three of them are closed before the money moves, one of them decides whether the account can be recovered at all, and none of them is a mystery.
Three different things get called a ban
Before doing anything, establish which of these you are actually in. They have different causes and completely different odds.
- A checkpoint. Login is blocked pending a code sent to the email address or phone number bound to the account. Nothing has been judged; the account is intact. This is the most common failure after a purchase and the most trivially avoidable one.
- An identity challenge. LinkedIn asks for a government document matching the name on the profile. The account is alive and waiting. Whether it stays alive depends entirely on whether such a document exists and whether you hold it.
- A permanent restriction. The account is closed. An appeal route exists, but an appeal is a request to look at evidence, and without a matching identity document there is no evidence to look at.
The word "banned" in a forum post usually means the first of the three. People write it up as a ban because from the outside a checkpoint and a closure look identical: you cannot get in. They are not the same event and they do not call for the same response.
The four things that actually cause it
LinkedIn has no signal that says an account changed hands. What it has is a set of signals that say an account is behaving unlike the person it belongs to. There are four that a buyer produces without meaning to, usually in the first forty-eight hours.
1. The login-geography jump
A profile that logged in from one American city for five years suddenly logs in from another continent, on a consumer VPN, with no travel pattern leading up to it. This is the cheapest signal in the set to produce and the cheapest to avoid.
The fix is not a VPN, it is consistency: one dedicated residential IP in the country the account's history sits in, used every day, rather than a shared exit node that lands somewhere new each morning. A handover that includes a country-matched ISP residential proxy is handing you exactly this, and the mistake buyers make is treating it as an optional extra and logging in without it "just once, to check".
2. The recovery email still points at the seller
This is the one that turns a routine checkpoint into a lost account. The purchase completed, the password works, and then three days later LinkedIn asks for a code — and the code goes to an inbox somebody else owns.
It has a second edge that is worse. Whoever controls the recovery address can reset the password and take the account back, at any point, with no dispute process you can invoke. A sale where the recovery path did not move is not a sale of an account. It is a rental with no contract and no end date.
There is a test, and it takes two minutes: before the balance is paid, run a password reset from the login screen and confirm the code lands in your inbox. A seller who will not let you do that before payment is telling you what you needed to know.
3. Device and fingerprint discontinuity
Browser, operating system, screen resolution, timezone, language headers and session cookies all change at once, in a single session, on an account that has not changed any of them in years. Individually none of these means anything. Arriving together on the day of a transfer, they are the shape of a compromised account, which is the pattern LinkedIn's security systems are actually built to catch.
This is what the anti-detect browser profile and the exported session cookies in a proper handover exist for: the first login after the sale should resemble the last login before it. Importing that profile before the first login — not after — is the whole point of it.
4. Automation resumed on day one
A dormant profile wakes up and sends a burst of connection requests, or gets wired into an outreach tool running its default send volume. The account has no recent activity to make that volume look continuous, and send allowances on LinkedIn are not a fresh allocation handed to each new operator — the account carries whatever standing the previous owner built.
There is no published threshold to stay under here, and any article quoting one is quoting a guess. The relative rule is the honest one: the account's own ordinary week is the ceiling for your first week.
| Vector | What it looks like from LinkedIn's side | What closes it |
|---|---|---|
| Geography jump | An impossible journey between two logins | A country-matched residential IP, used from the first login |
| Recovery email | Nothing — until a checkpoint, when you cannot answer it | The recovery address transferred, and tested, before payment |
| Fingerprint break | A device, network and browser change in one session | The anti-detect profile and session cookies, imported before first login |
| Day-one automation | A dormant account producing a volume spike | Pacing against the account's own history, not the tool's default |
What a handover changes that a credentials dump does not
Most of what is sold as a LinkedIn account is an email address and a password in a text file. That is why the warning articles are right more often than they are wrong: with only those two strings, three of the four vectors above are wide open and there is no way to close them afterwards.
Compare it with what an ownership transfer on this site actually moves at delivery: the login email, a master password you reset yourself, the session cookies, control of the recovery email, the pre-built anti-detect browser profile, and the configured ISP residential proxy matched to the account's own country. That list is not a feature list. Read it against the table above and it is the same four rows, answered one at a time.
The honest limit is worth stating with it. The 48-hour replacement window on an account bought here covers the infrastructure — a proxy misconfiguration, a fingerprint inconsistency at first login, an account that was already restricted before you ever touched it. It does not cover your send volume, your automation settings, or a name and photo change you make afterwards. Those are operating decisions, and after two days they are yours. A vendor promising to replace an account you burned yourself is promising something no vendor does.
The first seven days, in order
Nothing here is difficult. It is a sequence, and the value is entirely in doing it in this order.
- Before the first login: install the proxy and import the anti-detect profile. The first login is the highest-risk event in the account's life; do not spend it on your own laptop's Chrome.
- At the first login: set a new master password, then immediately run a password reset and watch where the code lands. This is the recovery-path test, and doing it on day one leaves you inside the replacement window if it fails.
- Days one and two: read the feed. Nothing else. No profile edits, no invitations, no messages. You are establishing that the account's new session behaves like the old one.
- Day three: ordinary human activity — a few reactions, a comment, accepting invitations that were already pending.
- Days four and five: a handful of connection requests to people who plausibly fit the account's existing history and industry. Relevance matters here more than volume, because a low acceptance rate is itself a signal.
- Days six and seven: edit the headline, the About section, the Experience entries and the current city if you need to. Leave the name and the photograph alone — they are what the identity document has to match if a challenge ever arrives.
- Week two onward: connect the tooling, starting well below its default and climbing over weeks rather than days.
Buyers who lose accounts almost always compressed this into an afternoon. The sequence is not superstition — each step removes one of the four signals, and running them concurrently produces all four at once.
When the identity challenge lands
Sooner or later LinkedIn asks an account to prove who it belongs to, and it asks in the one way that cannot be worked around: upload a government ID matching the name on the profile. This is where most bought accounts end, because there is no real person behind them and no document that matches.
What a recovery path requires at that moment is short and unforgiving:
- A real, identifiable person behind the profile name. Not a plausible name — a person who exists and holds a document.
- The verification record in your hands, not the vendor's. On accounts sold here the passport scan is released to the buyer at handover for exactly this reason; the point of NFC-verified accounts is that the chip read is cryptographically signed by the issuing government under the ICAO 9303 e-passport standard, so it survives the check that a photographed document fails.
- A profile name and photograph that still match it. This is the trap. Rebranding the profile after purchase feels like the natural first move and it quietly dissociates the account from the only thing that can defend it.
If those three hold, an identity challenge is an interruption. If any one of them is missing, it is the end of the account, and no amount of proxy hygiene changes that — which is why this is the question to settle before payment rather than after.
When the account is genuinely gone
Four cases where nothing works, listed because a post that only sells reassurance is not useful to somebody deciding.
- The profile was fabricated. A generated identity fails LinkedIn's identity requirement permanently and from the day it was created. Age does not help it and neither does an appeal.
- The account was already restricted when you bought it. Not recoverable, and not detectable from a screenshot — which is the entire reason a post-delivery verification window exists and should be used on day one rather than on day forty.
- The account had already been sold once before. A second transfer compounds every risk in the first and the history can no longer be established by anybody. This is one of the things that ends a conversation on the supply side here: the aged linkedin accounts on this shelf — seventeen listings, each with an audited registration date and connection count — are bought from the person who registered them, not resold from another marketplace.
- The real owner never consented. An account obtained without its holder's agreement can be reclaimed by that holder whenever they notice, and they hold every proof. A signed transfer agreement is not paperwork theatre; it is the difference between an asset and a loan nobody agreed to.
Five questions to ask before the money moves
Ask these of any seller, including this one. Each maps to something above, and each has a right answer that costs an honest vendor nothing to give.
- Does the recovery email transfer to me, and may I test a password reset before the balance is paid?
- Is there a government identity document behind the name on this profile, and do I receive it at handover or does the vendor keep it?
- Which country has this account historically logged in from, and does the infrastructure I am given match it?
- Has this account been sold before, and who did you buy it from?
- If it is restricted in the first forty-eight hours, what exactly happens — and is that in writing before I pay?
The spread between a login-and-password sale and a real handover is a few hundred dollars: the published tiers here run $200, $275, $350 and $500 depending on the account's age and network. It is a far wider spread in what happens on the Thursday after. An account that arrives with its recovery path, its infrastructure and its identity document is an account you can defend. One that arrives as two strings in a message is one you are renting from whoever sold it to you, until they decide otherwise.