Recently brought a used S8 online, but looks like the owner reset the device without removing their email account from it, and so its locked out.

They have passed me over their credentials to log back in and remove this, but I just wanted to find out about the 24 hour verification process.

Does it reset every time I try to access the phone?
Would it require the old password for the account or if the accounts been reset would the new one work.

Thank You!