The registration email is the whole game
An OSRS account's real ownership lives in the email address it was registered to. Whoever controls that email can begin a recovery, and a recovery can succeed long after a sale. A login and password alone give you use of an account, not ownership of it.
So the first question, asked in the order chat where the answer is attached to the order, is whether the original registration email is included and whether it has been recovered. An account sold without it is not necessarily a scam — some genuinely old accounts have lost email access — but it is materially riskier and should be priced as such.
Get the answer in writing, in the chat. A commitment made in a Discord message is not visible to anyone reviewing the order later, which makes it worth very little at the point you would need it.
Sale history and how long the seller has held it
Every previous owner is a potential recovery claim. An account that has changed hands four times has four people who may still hold something that helps them recover it, and you will not meet any of them until it matters.
Ask how long the seller has held the account and whether they built it. Neither answer is disqualifying on its own, but a seller who has held an account for years and built it themselves is a different proposition to one who bought it last week to flip it.
Verify what you are being sold
Ask for stats, quest completion, diary progress, membership status and bank contents — whatever actually matters for what you intend to do with the account. Ask in the order chat, before confirming delivery, and be specific rather than accepting a summary.
Check for anything that suggests the account has been used in a way that will attract attention later. A previous ban or mute history is worth asking about directly.
The handover, in the right order
Order first, so the payment is held in escrow. The seller then passes the credentials, and the registration email where it is included, through the order chat.
Change everything before you confirm: the email the account points to, the password, and any authenticator. Log in, look around, and satisfy yourself the account is as described and solely yours.
Confirm delivery only then. Before you confirm, a dispute freezes the escrow release; after you confirm, the seller has been paid and the money has gone. This ordering is the entire protection, and reversing it — confirming quickly to be polite, then changing credentials afterwards — gives it away for nothing.
The short version
Change the email, password and authenticator before you confirm delivery, never after. Everything else is a question you ask in the order chat, in writing.