Ask before paying
Trusted devices, recovery transfer, backup codes, full logout.
Order
Prove login → move recovery → clear devices → change password.
Red flags
No device list; code relay only; recovery stuck; pay before 2FA.
Practice
Write 2FA into scope. Done means buyer-controlled.