What happens to your online accounts when you die?

What happens to your online accounts when you die?

BSides Manchester What happens to the numerous user logins you’ve accumulated after you die or become too infirm to manipulate a keyboard?

Some people have a plan, the digital equivalent of living will, or have chosen “family” option in a password management package such as LastPass or have entrusted a book of passwords to a family member.

But the consequences of doing nothing are not as neutral as some might expect and were spelled out during an informative presentation by Chris Boyd of Malwarebyes at BSides in Manchester on Thursday. The presentation, cheerily titled “The digital entropy of death”, covered what could happen to your carefully curated online presence after you log off.

Chris Boyd at BSides - Pic by John Leyden
The dormant accounts of the deceased can be abused, warns Malwarebytes’ Chris Boyd. Pic: John Leyden

Miscreants are already targeting obviously abandoned profiles. Boyd explained that in some cases it’s easier for fraudsters to gain hold of these accounts than the account-holders’ relatives, because crooks know the systems better and controls – although present – are often deeply embedded on the sites such as Facebook, Twitter et al.

Alongside regular postings asking for help on Facebook due to compromise of dead people’s logins (examples here and here) there’s also the problem of “cloning”.

“Facebook users have reported receiving friend requests from accounts associated with dead friends and family members,” The Independent reports. “Such requests appear to be the result of cloning or hacking scams that see criminals try [to] add people on the site, and then use that friendship as a way of stealing money from them or running other cons.”

Social media accounts are, of course, just the tip of the iceberg. Most people these days run 100+ accounts, as figures from password management software apps show. These figures are only increasing over time. Some sites are managing the inevitability of their users shuffling off this mortal coil with features designed to deactivate accounts after months of inactivity or other features, Boyd explained in a recent blog post:

Many sites now offer a way for relatives and executors to memorialise, or just delete, an account. In other circumstances, services would rather you ‘self-manage’ and plan ahead for your own demise (cheerful!) by setting a ticking timer. If the account is inactive for the specified length of time, then into the great digital ether it goes.

While a lot of services don’t openly advertise what to do in the event of a death on their website, they will give advice should you contact them, whether social network, email service, or web host. When there’s no option available, though, people will forge their own path and take care of their so-called ‘digital estate planning’ themselves.

Users would be ill-advised to leave everything to their next of kin. “Do some pre-handover diligence, and take some time to ensure everything is locked down tight,” Boyd explained. “If there’s anything hugely important you need them to know, tell them in advance.”

People may have bought digital purchases tied to certain platforms. Games on Steam, or music on iTunes or Spotify.

“Legally, when you go, so do your files (in as much as anything you can’t download and keep locally is gone forever),” Boyd explained. “That’s because you’re buying into a licence to use a thing, as opposed to buying the thing itself.”

Here’s a video of his presentation, if you want to see more…

There’s nothing stopping someone from passing on a login to a family member so they can continue to make use of all the purchased content, at least for now. Boyd predicted that at some point, all of our digital accounts tied to financial purchases will have some sort of average human lifespan timer attached to them.

Millennials mark the first generation not to know life before an always-on, everywhere internet, which will become the norm from now on. “Younger generations absolutely will demand reforms to the way we think about digital content, ownership, and inheritance,” Boyd concluded. ®

As well as the inevitable rise and fall of social media site (e.g. MySpace), and web 2.0 services there is also the issue of link rot, the phenomenon of more and more URLs not working over time. This issue is covered by Boyd in another recent blog post here.

Why you should keep track of your most critical digital assets

What happens to your Facebook account after you die?

The death of a loved one has always been a difficult moment but with the rise of the internet and social media platforms, families now also have to contend with sometimes-murky digital afterlife rules.

Only 13% of people have made any sort of plans regarding their social media accounts following their death, according to a 2017 survey by the Digital Legacy Association (DLA).

“Social media platforms are now understanding that they need to have an end of life policy,” James Norris, founder of the DLA, told Euronews.

“The technology they’re starting to bring in is a great start but there’s still a lot to do.

“One of the main problems when it comes to planning for your digital death and the array of different accounts that we have is that each platform is different and each requires a different way in which to manage how the account is passed on,” he explained, recommending people document their wishes in a social media will.

Below are the rules on users’s death for the main platforms.

Rules on deceased social media users

Facebook users can appoint a legacy contact who would then have access to their account after their death. That person can then look after the memorialised account or delete it.

If no legacy contact has been appointed by the user, Facebook memorialises the account when it becomes aware of the user’s passing.

Once memorialised, the account can’t be logged into and remains visible to the audience it was shared with as a place for them to “gather and share memories,” according to Facebook’s settings.

To remove a deceased user’s account, Twitter requires a person authorised to act on behalf of the estate or a verified immediate family member of the deceased to make a request or the account will be deactivated.

They will need to provide details including information about the deceased, a copy of their ID, and a copy of the late user’s death certificate, according to Twitter’s Help Centre.


Like Facebook, Google allows users to appoint a person who would be responsible for their account after their death. This so-called “Inactive Account Manager” is then able to access account information and delete the account.

If no such person is appointed, immediate family members can get in touch to request the account be deleted.

However, Google highlights on its Help page that “any decision to satisfy a request about a deceased user will be made only after careful review”.

How do companies deal with digital assets post death?

How do companies deal with digital assets post death?

How do large digital companies deal with subscriptions and/or accounts post death? What happens to the public’s copious amount of photos, videos, messages and documents on social media?

In as little as two years (from 2012 to 2014), the public have produced more data than in all of human civilisation before that – and is still increasing at an exponential rate.

While digital assets can take many forms such as online photos, subscriptions, music libraries, social network profiles or email accounts – the majority of us do not have physical records of them.

It is therefore not clear what people’s digital presences will look like in years to come but we can be certain that an ever-increasing number of people will be creating and accumulating more and more data until they pass away.

So, how do companies deal with such assets after death and how do they help and/or support digital estate planning?

Unfortunately, as an example, the world’s largest online retailer, Amazon, do not make it easy to find this out. However, a company called ‘Everplans’ provides instructions, advice and assistance on how to close an Amazon account when someone dies for their basic account and Amazon Prime accounts.

Everplans is the web’s leading resource for planning and organising your life, it enables you to create, store and share important documents that loved ones might need in the future in the event of death – which includes all assets in digital form. An Everplans’ Digital Estate Plan can be created in five easy steps and a digital executor appointed who carries out loved ones’ wishes for digital assets.

However, Social media do offer support and advice when it comes to dealing with accounts post death. Facebook instituted a policy a few years ago regarding how to handle profiles of deceased individuals – where family members can choose one of two options, either close it or turn the account into a memorial profile.

More and more online social networks are adopting rules to handle the situation such as Twitter, LinkedIn, Pinterest and Instagram whereby proof of death, ID and possibly form filling is required to deactivate the account or ‘memorialise’ the accounts of deceased users.

While companies are showing signs of helping and advising on how to deal with accounts after someone dies, they are still behind the times. Currently, the majority of people have to adhere to “Terms and Conditions” of each digital service offered. An example of this is Apple’s Itunes where currently everything bought expires upon death – which shows company legislation needs to catch up to reality!

As a private client professional, have you ever dealt with digital assets in estate planning?

How to settle your loved one’s digital estate

Giving up the ghost online and what it means to you

A GHOST tour in Edinburgh was where I first discovered the morbid truth about why Victorian headstones often had bells attached.

Buried by mistake? Ring urgently for service.

We’ve come a long way since then, and thanks to modern medicine can be certain when someone’s been ‘called home’ before doing the needful.

If you’re squirming a bit in your seat at the thought, it’s natural. The D word is nobody’s favourite and talking about it is the biggest slap in the face to any healthy dose of self-denial about what’s at the ‘end of the line’.

Anyway, let’s say you are doing a bit of planning and you’ve sorted out what to wear, who to invite and all that, then as a child of the Digital Age you must also put on your ‘to do’ list who can access your social media accounts and other digital assets when you’re gone.

Apparently it’s a bit of a grey area in legal circles and they want to do something about it.

At the helm is the NSW Law Reform Commission which his reviewing laws affecting life beyond your digital death.

Initially they’ve called for submissions from the legal profession and later in the year the public can throw in their two cents worth (and for those born after 1992, when the two-cent coin was demonetised, it means your opinion).

When making the review public, Attorney General Mark Speakman said: “In today’s hyper-connected world, an unprecedented amount of work and socialising occurs online, yet few of us consider what happens to our digital assets once we’re gone or are no longer able to make decisions.

“This is leading to confusion and complexity as family, friends and lawyers are left to untangle digital asset ownership issues, applying laws that were developed long before the arrival of email, blogs, social media and cryptocurrency.”

What the LRC is more worried about is who can access your digital stuff, but although it’s inappropriate to laugh at a time like this, this quote from Speakman was just a little bit ironic.

He said: “When a loved one passes away, bureaucratic hurdles and legal uncertainty are the last thing families and friends feel like confronting, so we need clear and fair laws to deal with these 21st Century problems.”

Bureaucratic hurdles and legal uncertainty are what families and friends are confronted with when a loved one passes away.

I suppose we’ve really only got ourselves to blame, being the most connected of all countries in the world. So, the review will focus on NSW, Commonwealth and international laws, including those relating to intellectual property, privacy, contract, crime, estate administration, wills, succession and assisted-decision making.

The LRC will scrutinise (their words, sounds expensive) the policies and terms of service agreements of social media companies and other digital service providers.

Facebook is at a bit of an advantage here already, having had lots of experience in this area.

On a more serious note, social media companies do handle sites of the deceased differently, from memorialising them to simply shutting them down.

Having a say in what you’d like to happen, particularly given there can be a story of a whole life recorded there, is important.

If you haven’t made arrangements for anyone to take control of your sites or access private emails, the LRC is considering whether additional privacy protections are needed.

The issue of ownership of digital assets upon death cuts across many different areas of law which is why it’s not clear and fair but complicated.

Here I was thinking I’d just leave a list of my 70,000 passwords for someone else to troll through my social media, blogs and websites if they could actually be bothered.

But really, who could forgo the opportunity to plan ahead by scheduling posts and memes to appear long after I’m gone, saying things like ‘I can see what you’re doing’ or ‘There is no Planet-B’.

Visit www.lawreform.justice.nsw.gov.au to read more.

Preparing for your digital death: Rest in peace, but leave your passwords handy

Preparing for your digital death: Rest in peace, but leave your passwords handy

Grieving relatives have reportedly asked undertakers to swipe their dead loved ones fingerprints on their digital devices in an effort to access their pictures, memories and social media accounts.

But the practice is often futile, with experts saying even if an undertaker agrees to carry it out, it only works if the body is still “slightly warm”, according to UK Law Society wills and equity chairman Ian Bond.

The message is to rest in peace — but leave your passwords handy, Mr Bond told The Times.

He said lawyers dealing with wills and probate had seen some clients go to the macabre lengths of securing a dead person’s thumbprint in an effort to retrieve photos and messages from devices like iPhones and iPads.

Mr Bond said he had heard of cases where family members were placing the hands of recently deceased persons who were “slightly warm” on mobile phones to unlock them.

“Although this sounds a bit sinister it is done with the best intentions,” he said.

It’s a problem increasingly encountered in a digital age where people conduct their lives and their business online and camera phones have replaced photo albums for storing cherished memories, says Law Society NSW president Doug Humphreys.

Leave those passwords somewhere secure, but where others can find them when you die, is the advice. Picture” Thinkstock
Leave those passwords somewhere secure, but where others can find them when you die, is the advice. Picture” Thinkstock


So much so that last week, NSW Attorney-General Mark Speakman asked the NSW Law Reform Commission to investigate whether new laws were needed to clear up who can access data after death.

“Not many of us think about what happens to our digital assets once we’ve gone or once we can’t make decisions anymore,” Mr Speakman said.

“The last thing that bereaved families want are bureaucratic hurdles and legal uncertainty.

“The Law Reform Commission will look at whether our laws are clear and fair enough to make sure people have some certainty over what will happen to their digital assets when they die.”


While he’s unaware of specific incidents in Australia of undertakers being asked for access to the fingerprints of the dead, Mr Humphreys is well aware of the legal and logistical nightmare surviving relatives encounter if their loved one said.

“I haven’t heard directly of undertakers being asked to scan a thumbprint. The thing is, it might sound far-fetched, but I can understand why people might do it. Because people have their lives on their phones. Their pictures, their memories are all there. And unravelling that life once they are gone can mean dealing with international companies, international laws, making the whole process so much harder.”

Increasingly, digital wills are being drawn up by lawyers to include passwords and access codes.

Apple has strict privacy terms whereby unless a person knows the user’s password, they cannot open the device. Facebook doesn’t usually let anyone take over the account of someone who has died unless a user has nominated a “legacy contact”.

What’s needed, is to ensure private emails, social media accounts and digital music libraries are treated just like the concrete items like house and heirlooms are treated, Mr Humphreys said.

Apple has strict privacy terms whereby unless a person knows the user’s password, they cannot open the device. Picture: Supplied
Apple has strict privacy terms whereby unless a person knows the user’s password, they cannot open the device. Picture: Supplied


“As a lawyer — and this is advice I would have given five or ten years ago but is probably even more important now — ‘bucket file’,” he said.

“Where the questions used to be ‘where’s your will? Where are the spare keys to the house? What bank accounts do you have and where do you have them? Where are the insurance policies? What shares do your own?’ and all that sort of stuff; now you need to add your passwords, passcodes and keys to your social media and cloud accounts to the bucket,” he said.

“The logical place to put all of that stuff is probably with whoever is keeping your will. But just make sure someone knows where it is, and it’s safe, but accessible.”

Mr Humphreys said people are often reeling with sudden death, or grim diagnoses so the conversation should be had long before anyone becomes unwell.

“Like anything, this is all about actually being organised and regrettably a lot of us are not,” he said.

“We have to think about making life easier when we are gone — because one thing is certain — none of us are getting out alive,

The Law Reform Commission will report back to the Government with its recommendations, with the review process expected to take between 12 and 18 months.