You should look for trusted users and do a background check.
Some things I would recommend
1. Always do a recovery test.
2. If recovery fails, don't let him recover to the same email
3. Do not pay with people who doesn't want to provide any real information about them.
4. Take all of their contact information. (Phone/WhatsApp/Facebook....)
5. Do a background checks in runescape display name, login name, skype... phone numbers..
6. If you found that he is lying by any sort, like he doesn't have a mobile number or a reason why he is banned in any other forum or any sort of lies.. DO NOT BUY.
7. Don't buy if the user doesn't have verified PayPal.
8. Let the account stay in your hands for at least a 3 days before paying(after recovey test).
9. Require the first email that was made with the account so the recovery works.
and list goes on........
Those are some serious precautions. If buying from a mod/omm/500$+ donor etc that won't be necessary ofcourse, but it might be if buying from a newcommer.
If you have further questions don't hesitate to messege me, I'll be happy to help!