Digital Accounts After Death: Access, Preserve, Transfer, or Close

A spouse’s phone may still unlock. A password manager may still open. An email session may still be active on a shared computer. Those facts can make digital estate work look deceptively simple.

They do not settle whether you are authorized to use an account.

A password is a credential. Authority comes from a different place: the account owner’s directions, the provider’s legacy tools and terms, applicable state law, fiduciary documents, and sometimes a court order. The distinction protects you, the estate, other beneficiaries, and records that may later be needed for taxes, litigation, or ownership disputes.

This guide gives a preservation-first method for deciding whether each account should be accessed, transferred, memorialized, archived, or closed. It is written for a surviving spouse with meaningful household, investment, business, or intellectual-property interests. It is not a substitute for advice from an estate attorney in the state governing the estate.

The short answer

After a spouse dies, do not begin by trying passwords. Begin by establishing authority and preserving evidence.

1. Secure the devices and keep essential phone and email services from lapsing.
2. Inventory accounts without changing or deleting them.
3. Identify who owns each account and who has legal authority to act.
4. Use the provider’s official deceased-user or legacy-contact process.
5. Preserve records before transferring, memorializing, or closing anything.
6. Escalate valuable, disputed, encrypted, or business-critical assets to the appropriate attorney or technical specialist.

That order matters. Closing an email address can break recovery for dozens of other services. Canceling a mobile line can remove a verification channel. Deleting a cloud account can destroy family photographs, business files, or evidence. Logging in and moving assets can create a poor audit trail even when the surviving spouse believes the outcome is obvious.

Why a known password is not permission

Most U.S. states have enacted a version of the Revised Uniform Fiduciary Access to Digital Assets Act, commonly called RUFADAA. The law was designed to give fiduciaries a structured route to manage digital property while respecting privacy choices and providers’ obligations. State enactments and facts differ, so the governing state’s statute must be checked.

The practical framework usually considers several sources of direction:

• an online tool supplied by the provider, such as a designated legacy contact;
• the deceased person’s will, trust, power of attorney, or another record expressing consent;
• the authority of a court-appointed personal representative, trustee, guardian, conservator, or agent;
• the provider’s terms and required documentation; and
• the state’s version of the governing digital-assets law.

Digital property and the content of private communications are not always treated the same way. A fiduciary may be entitled to a catalog showing that communications existed (such as sender, recipient, date, and time)without automatically receiving the message contents. Disclosure of content may require the user’s affirmative consent or additional legal process. Do not assume a general clause about “all property” resolves that issue.

Marriage by itself also does not make every individual account joint. A surviving spouse may own the household computer, pay the subscription, inherit the underlying economic interest, or serve as personal representative, but those are separate questions. Document the basis for action instead of relying on relationship alone.

First 24 hours: preserve without entering

Treat phones, computers, tablets, external drives, security keys, and paper recovery codes as estate records.

• Place devices in a physically secure location and record who has custody.
• Keep them charged if doing so is safe, but do not guess passcodes or repeatedly attempt biometric access.
• Do not factory-reset, update, trade in, or give away a device.
• Photograph the device and serial-number label without displaying private content.
• Preserve existing internet, mobile, domain, hosting, and cloud subscriptions long enough to understand dependencies.
• Do not forward the deceased person’s email, impersonate them in a chat, or answer messages as though they were alive.
• If litigation, a tax examination, a business dispute, or a regulatory matter is possible, ask counsel about a preservation hold before changing data.

If a device is already unlocked, resist the urge to browse. Note its condition, secure it, and ask the estate attorney whether a targeted forensic preservation is appropriate. A qualified examiner can sometimes capture relevant records while maintaining a chain of custody and avoiding needless exposure of personal communications.

Shared household accounts require a separate judgment. It may be appropriate to continue paying for electricity or internet from an account you independently own and are authorized to use. That is different from entering an individually owned bank, brokerage, email, or crypto account using the deceased person’s credentials.

Keep the recovery chain intact

Email and mobile service are often the roots of a digital identity. They receive password resets, security alerts, invoices, domain-renewal notices, and two-factor codes. Abruptly canceling either one can make an orderly provider process much harder.

Call the carrier or provider as yourself. Explain that the subscriber died and ask for its bereavement or account-transfer process. Do not ask an employee to bypass authentication. Keep the service paid from an authorized source while the attorney or personal representative determines whether it should be transferred, retained temporarily, or closed.

For a family mobile plan, identify the actual account owner, authorized managers, device-financing obligations, and whether moving a number will affect other lines. For email attached to an employer, partnership, nonprofit, or family office, contact the organization’s authorized administrator promptly. Business data may belong to the organization rather than the individual, and retention rules may apply.

Build a digital-account inventory

Inventory first; decide later. Start with information you can lawfully review: your own bank and card statements, household bills, mailed notices, shared files, contracts, tax workpapers, domain records, and the deceased person’s estate-planning documents.

Use one row per account and record:

Field	What to capture
Provider and account	The service name and a non-sensitive identifier
Apparent owner	Individual, joint owners, trust, estate, or business
Asset or function	Money, records, photographs, communications, subscription, domain, or intellectual property
Estimated importance	Financial value, sentimental value, legal relevance, or operational dependency
Recurring cost	Amount, payment source, renewal date, and cancellation risk
Recovery dependencies	Email, phone number, authenticator, security key, device, or recovery contact
Authority candidate	Personal representative, trustee, joint owner, business administrator, or named legacy contact
Provider route	Bereavement form, legacy tool, court process, or business-admin process
Desired outcome	Preserve, export, transfer, memorialize, close, or investigate
Retention need	Tax, probate, business, litigation, insurance, or family archive
Status and evidence	Request date, case number, documents sent, response, and final disposition

Never put passwords, complete recovery codes, private keys, full account numbers, or copies of identity documents in this working spreadsheet. Keep sensitive credentials in a properly secured vault controlled by the authorized person. Record where an item is held, not the secret itself.

Categories people commonly miss

• primary and secondary email accounts;
• phones, tablets, computers, smart-home hubs, and security systems;
• cloud storage, photo libraries, scanning services, and online backup;
• banks, brokerages, retirement portals, payment apps, rewards, and stored-value accounts;
• cryptocurrency exchanges, hardware wallets, seed phrases, and decentralized-finance positions;
• tax software, payroll portals, benefits sites, and government accounts;
• social media, messaging, dating, gaming, and community accounts;
• domains, DNS, hosting, content-management systems, analytics, advertising, and email marketing;
• online stores, marketplace seller accounts, payment processors, and app stores;
• airline, hotel, club, and subscription memberships;
• royalty, licensing, patent, trademark, copyright, and creator-platform accounts;
• medical portals, genealogy accounts, and genetic-testing services; and
• password managers, authenticator apps, security keys, and encrypted storage.

Connect this inventory to the household continuity file described in How to Build a Financial Continuity File After a Spouse Dies, but limit access to people who genuinely need it.

Match the actor to the authority

The right person is not always the person who knows the technology.

Personal representative or executor. This person administers probate property under appointment documents and applicable law. A nomination in a will may not be enough before court appointment.

Trustee. A trustee controls trust property under the trust instrument. The trustee’s authority does not automatically extend to an account owned individually by the deceased.

Joint owner. A genuine joint account holder may have independent contractual rights. An additional user, authorized signer, family-plan member, or person whose card paid the bill is not necessarily a joint owner.

Named legacy contact. A provider-created role is limited to what that provider allows. It is not a universal appointment over the digital estate.

Business administrator. A board-authorized officer, partner, manager, or IT administrator may control company accounts. Preserve corporate approvals and do not mix company assets into the probate inventory.

Beneficiary. Inheriting an asset does not necessarily authorize immediate access to the account holding it. Distribution generally follows administration and the provider’s transfer process.

A useful control is a two-person review for valuable or sensitive accounts: one authorized fiduciary approves the action, and a second person (attorney, accountant, or trusted administrator)records what was done and why.

What major provider processes illustrate

Provider rules change, so always begin at the provider’s current official support page.

Apple

Apple’s Legacy Contact feature lets an account holder nominate someone in advance. Apple says an access request generally requires the access key created when the contact was added and the account holder’s death certificate. Approved access covers certain account data, but it does not include everything. Apple specifically excludes items such as purchased media and data stored in iCloud Keychain, including passwords, passkeys, and payment information.

If there is no Legacy Contact, Apple publishes a separate route for requesting access or deletion and notes that legal documentation requirements vary by country and region. Follow that route; possession of an iPhone passcode is not a substitute.

Google

Google recommends Inactive Account Manager for advance planning. After a death, immediate family members and representatives can use Google’s deceased-user request process to seek closure, request funds in some circumstances, or request certain data. Google states that it cannot provide passwords or other login details.

Choose carefully between requesting data and closing the account. Google warns within the request flow that closing the account can eliminate the ability to request its contents later. Preserve first, close last.

Facebook

Facebook may memorialize an account when it receives a valid request. A memorialized account cannot be logged into. A named legacy contact may perform limited tasks, depending on settings, but cannot sign in as the deceased or read private messages. If no legacy contact was selected, Facebook says the account cannot be changed after memorialization.

These three examples show why “I have the password” is the wrong operating model. Each provider defines a limited role, evidence package, and outcome. The estate file should retain the request, proof of submission, provider response, and description of anything exported or deleted.

Financial, crypto, and tax-sensitive accounts

Do not transact through a deceased person’s online banking or brokerage login. Contact the institution’s estate or bereavement team and provide documents through its verified channel. Confirm the destination and tax treatment of any transfer with the estate attorney and tax adviser.

Cryptocurrency requires special care because authority, custody, and technical control can diverge. An exchange account may have a conventional estate process. A self-custodied wallet may depend on a seed phrase, private key, hardware device, multisignature arrangement, or smart contract. Anyone who sees a private key may be able to move the asset irreversibly.

• Do not type a seed phrase into a website or send it by email.
• Do not photograph or copy it into the general estate file.
• Do not test a wallet by making an unreviewed transfer.
• Record the existence and secure location of the recovery material without exposing it.
• Use an estate attorney, tax professional, and technically qualified digital-asset specialist for material holdings.

Preserve transaction histories and valuation evidence. Digital assets can create date-of-death valuation, basis, income, estate-tax, and reporting questions. A wallet balance alone may not reveal staking rewards, decentralized positions, wrapped assets, liabilities, or ownership through an entity or trust.

Government benefit and tax accounts deserve the same discipline. Notify agencies through official routes rather than entering the deceased person’s portal. USAGov maintains a current directory for reporting a death to federal agencies, and the Consumer Financial Protection Bureau’s surviving-spouse materials provide a broader financial checklist.

Domains, websites, and online businesses

A domain can be both an asset and the key to an operating business. Before changing a registrar or hosting account, map the full dependency chain:

domain registrar → DNS provider → web host → email provider → payment method → analytics and advertising → backups

Losing any link can take the website or email offline. Keep renewals current from an authorized source, export configuration records, preserve recent backups, and identify whether the account belongs to the deceased, a trust, or a company. If employees, customers, subscribers, or regulated data are involved, bring company counsel and the authorized business administrator into the decision.

Do not redirect a domain, publish a death announcement, export a mailing list, or send customer communications until the person with business authority approves the action. Privacy policies, contracts, employment rules, and data-protection obligations continue after the owner’s death.

Decide: preserve, transfer, memorialize, or close

For every account, write the decision and rationale before acting.

Preserve when the account contains tax records, business data, intellectual property, family archives, evidence, or information needed to locate assets. Export in a format that retains dates and context, and hash or otherwise document important evidentiary files when counsel recommends it.

Transfer when ownership or administration can lawfully continue, for example, a domain owned by a company or a shared service placed into the surviving spouse’s name. Record the provider’s confirmation and the effective date.

Memorialize when the platform offers that status and the family wants the profile retained. Understand what becomes public, what the legacy contact can do, and whether future deletion remains possible.

Close when authority is established, required records are preserved, dependencies are removed, recurring charges are resolved, and no tax, legal, sentimental, or business reason supports retention.

Review Subscriptions and Recurring Payments After a Spouse Dies before closing the card or bank account funding online services. Canceling the payment source first can trigger data deletion or domain expiration.

Copy-ready provider request

Use this as a starting point, then adapt it to the provider’s official form. Do not email sensitive documents unless the provider confirms a secure channel.

Subject: Request concerning the account of a deceased user

I am writing regarding the account of [full legal name], who died on [date]. My role is [court-appointed personal representative / trustee / joint owner / named legacy contact / authorized business representative].

I am requesting [preservation pending review / disclosure of specified data / transfer of an eligible asset / memorialization / closure]. Please identify the governing process, the documents required, the secure submission method, any deadline, and whether taking this action affects later access to account content.

The account can be identified by [non-sensitive account identifier]. I will not send passwords, one-time codes, private keys, or full identity documents by ordinary email.

Please assign a case number and confirm in writing what action is taken and its effective date.

Keep the submitted version, attachment list, transmission receipt, case number, and response in the estate administration file.

A controlled checklist

• Secure devices, recovery media, and paper codes without attempting entry.
• Keep critical phone, email, domain, hosting, and backup services from lapsing.
• Identify the governing state, estate attorney, and appointed fiduciary.
• Locate the will, trust, consent language, and provider legacy designations.
• Inventory accounts from lawful records without storing secrets in the inventory.
• Separate individual, joint, trust, estate, and business ownership.
• Flag money, crypto, business operations, intellectual property, and possible evidence.
• Check each provider’s current official bereavement or legacy process.
• Preserve necessary records before any closure or memorialization request.
• Record who approved each action, what was submitted, and what the provider did.
• Remove recurring charges only after dependent data and services are protected.
• Monitor the deceased person’s identity and report suspected misuse through official channels.

The FTC’s identity-theft resources explain how to report misuse and build a recovery plan. A new login alert, password-reset email, address change, or unfamiliar transaction should be preserved and escalated; do not respond through links in the alert itself. Navigate independently to the institution’s official site or call a verified number.

Questions to ask the estate attorney

1. Which state’s digital-assets law governs this estate and this account?
2. Has the personal representative been formally appointed?
3. Does the estate plan contain explicit consent to disclose electronic communications?
4. Did a provider’s online legacy designation override or supplement the will?
5. Is the account probate property, trust property, jointly owned property, or a business asset?
6. Do we need a preservation letter, subpoena, or court order?
7. Could any deletion violate a litigation hold, tax-record rule, fiduciary duty, or business policy?
8. What documentation should remain in the fiduciary accounting?

Frequently asked questions

May I unlock my spouse’s phone if I know the passcode?

Knowing the passcode does not by itself establish legal authority. Secure the device and ask the estate attorney how applicable law, ownership, the estate plan, and the provider’s rules apply. A targeted forensic preservation may be safer when the device contains valuable or disputed records.

Should I cancel the phone line immediately?

Usually not before mapping dependencies and speaking with the carrier through its official process. The number may support account recovery, security notices, a family plan, or business operations. Keep it paid only through an authorized source and do not impersonate the deceased.

Does being executor give me every password?

No. Appointment as personal representative can support a provider request, but the scope of disclosure depends on state law, the user’s consent, the provider’s process, and the type of data. Content of private communications can receive greater protection than other digital assets.

Can a legacy contact read private messages?

Do not assume so. Provider roles are limited. Apple excludes Keychain credentials and certain purchased content from Legacy Contact access; Facebook says a legacy contact cannot log in or read messages; Google does not provide passwords. Read the provider’s current terms for the exact account.

What should happen to family photos?

Preserve them before requesting closure. Confirm who owns the account and whether other family members have independent rights or copies. Export original files with dates and metadata when the provider permits, maintain at least two secure backups, and document the source.

What if the estate plan says nothing about digital assets?

Do not improvise. The personal representative should ask counsel about the state’s statute, the provider’s terms, and any required court process. The lack of a digital-assets clause does not make credential use automatically authorized.

The durable rule

The safest digital-estate work is deliberately boring: secure, inventory, establish authority, preserve, request, document, and only then transfer or close. It produces an audit trail instead of a trail of unexplained logins.

Once the immediate estate work is stable, use this experience to improve your own continuity plan. Name provider-specific legacy contacts where appropriate, give fiduciaries explicit instructions about digital property and communications, document business-account ownership, and keep secrets in a secure system rather than in the estate inventory. Your attorney can align those directions with your will, trust, powers of attorney, and state law.

This article is general educational information, not legal, cybersecurity, tax, or investment advice. Digital-access law and provider procedures vary and change. Consult qualified professionals before accessing, transferring, deleting, or distributing digital assets.