Digital Estate Planning: Why Passwords Aren’t Enough

She discovered the notebook tucked away in the top drawer of her mother’s desk. It contained six pages. Every account. Every password. Username, password, recovery question. Her mother had always been organized, and this notebook was proof of that.

Then she attempted to log in.

The bank account requested a six-digit code sent to her mother’s phone. Unfortunately, the phone was secured with a fingerprint. The email associated with her financial accounts had been created decades ago with a provider that no longer exists. The recovery phone number linked to that account was a landline that had been disconnected years earlier.

The notebook was comprehensive. Yet, it offered no assistance.

This illustrates the digital estate planning gap that many families overlook until it’s too late.

It’s one of the most frequent mistakes families encounter today, and it rarely makes it into anyone’s planning.

Why the Password Is No Longer Sufficient

Nowadays, most online accounts require a two-step login process. The first step involves entering your password, while the second step requires a verification code sent to a trusted device or phone number when someone attempts to access the account.

This process is known as two-factor authentication, and it has become the standard security measure for financial accounts, investment platforms, email services, and cloud storage. It serves as one of the most effective defenses against fraud and identity theft.

However, it is also a common reason why families struggle to access accounts after a loved one passes away. The individual attempting to log in may have the correct password, but the verification code is sent to a locked phone, an outdated number, or an email address that no longer exists.

While the password may be accurate, the account remains inaccessible.

It’s important to clarify the proper approach in such situations. After a death, using someone’s login credentials is not the recommended course of action. Most platforms explicitly prohibit this in their terms of service, and it may not be legally appropriate. The correct method is to follow each platform’s official process for deceased accounts, which typically involves submitting a death certificate, a copy of the will, and documentation establishing legal authority.

Some platforms still require verification through the linked phone or email even during this official process. The platform sends the verification code to the linked phone or email when the account is accessed. If that phone is locked or the email address is no longer valid, the code has no destination. While legal authority may be established, the verification step remains a barrier.

This highlights the necessity of a digital estate plan that considers where each verification code is sent, not just the accuracy of the password.

In summary, two-factor authentication prevents access at the second step, even after the correct password is entered. Simply having a list of passwords won’t resolve this issue. A digital estate plan must address where each verification code is directed and how the person managing your estate can obtain it.

The Old Email Dilemma

Numerous accounts were established years ago and associated with email addresses that individuals no longer utilize. Back then, that email seemed like the best option. Now, it might be inactive, switched to a different provider, or simply forgotten.

The phone number associated with an account may have changed multiple times since the account was created. The authenticator app on a phone might only function on that particular device. If that device is locked, broken, or just not available to family members, the second factor becomes useless.

Each account has its own series of linked access points. When one link in that series is compromised, the account becomes inaccessible without navigating the platform’s recovery process, which can take weeks, necessitates documentation, and isn’t always successful.

In summary: Digital accounts are only as reachable as the most up-to-date version of every linked email address, phone number, and device. If your estate plan doesn’t keep track of these, it is already outdated before it is ever needed.

The positive aspect is that all of these issues can be resolved before they turn into someone else’s headache.

The Accounts That Create the Most Issues

The accounts that pose the greatest practical challenges after someone passes away are typically those that families rely on daily.

Financial accounts that exist solely online, without a physical branch to visit, necessitate documentation and verification that can be hard to provide without the right legal authority. While investment platforms and retirement accounts may have designated beneficiaries, accessing and managing those assets still involves navigating each platform’s specific procedures. Email accounts often store years’ worth of financial statements, tax documents, and recovery information for other accounts. Cloud storage can contain important documents, photos, or business records that aren’t backed up anywhere else.

Additionally, there’s an increasing number of digital-only assets: cryptocurrency, online business accounts, subscription income, and licensing agreements. These can hold significant financial value that could vanish entirely if no one is aware of their existence or how to access them.

In summary: The most impactful digital assets are frequently financial or operational rather than personal. Any estate plan that fails to inventory and address these assets is lacking.

A will should clearly state provisions that grant your executor authority over digital assets and indicate where the access information is kept. Without these provisions, your executor might encounter unnecessary legal hurdles, even with a valid will in place.

What Your Will Cannot Do

One method that individuals often consider is including their account credentials directly in their will. While this may seem practical, it is actually quite insecure.

When a will is submitted for probate, it becomes a public document. Anyone can request a copy of it. By listing passwords, usernames, or account numbers in a will, you are essentially making them public.

For this reason, we strongly advise our clients not to include any access credentials in their wills.

What should be included in a will is a directive: who has the authority over digital assets and where to locate the access information that has been securely and privately stored elsewhere.

In summary: A will is a public document after someone passes away. Passwords should not be included in it. The will should designate authority, while the access information should be kept in a secure location.

This issue goes beyond just access. It affects your family, who are already in mourning, being locked out of accounts that contain the funds they need for funeral expenses, mortgage payments, and medical bills. This added stress compounds their grief.

What a Genuine Digital Estate Plan Entails

A well-structured digital estate plan is more than just a list; it’s a comprehensive system.

This system encompasses an inventory of all accounts that hold financial, sentimental, or legal significance. It details the two-factor authentication methods for each account, specifying which phone number, email address, or app receives the verification code. Additionally, it includes backup authentication codes that most platforms allow users to generate, which can be printed and stored securely offline. Furthermore, it designates an individual with explicit legal authority to manage those accounts in accordance with applicable laws.

Moreover, this plan is not static; it requires regular updates. If a phone number changes, the plan must reflect that change. New accounts should be added promptly, and any retired email addresses must be updated across all linked accounts in both the platform and the plan.

In many jurisdictions, the Revised Uniform Fiduciary Access to Digital Assets Act provides a legal framework that dictates what a fiduciary can access and under what circumstances. The ability of a family to access digital assets after a death, and the process involved, largely depends on whether the necessary legal authority was established beforehand.

Within this framework, a will or trust can incorporate specific digital estate provisions that appoint your executor and grant them the legal authority to access, manage, transfer, and close digital assets. Without such provisions, even a valid will might leave your executor with insufficient authority.

Digital estate laws differ from state to state, and each financial institution has its own documentation requirements and procedures. What one bank mandates may vary from the requirements of a brokerage, a cloud storage service, or a cryptocurrency exchange. Therefore, the plan must consider both the legal authority and the specific processes required by each relevant platform.

When we collaborate with clients to create this plan, we meticulously address each account, every linked contact, and all points of legal authority, ensuring that the system is established before it is needed, rather than being hastily assembled after a death complicates matters.

The key takeaway: A genuine digital estate plan is a well-maintained system with designated legal authority. Simply having a list is not sufficient.

What You Can Do Right Now

Begin by creating an inventory. Review your accounts (financial, email, cloud storage, and any platforms that store business or legal documents) and note down which phone number, email address, or app receives the two-factor verification code for each one. This chain of access is essential for your family, and it’s likely not documented at the moment.

Examine the recovery contacts linked to your email accounts. Many individuals have phone numbers or backup email addresses associated with those accounts that they set up years ago and no longer use. If those contacts are outdated, the accounts tied to them may already be inaccessible.

Create backup codes. Most platforms that offer two-factor authentication allow users to generate a set of one-time backup codes. Print these codes, store them securely offline, and ensure that the person managing your estate knows where to locate them.

If this seems like more than you want to handle alone, that’s precisely where we come in. When clients collaborate with us on estate planning, addressing the digital aspect is one of the first priorities because we understand the challenges families face when left to navigate this on their own during the most difficult times, one locked account at a time.

Every family’s digital presence is unique. We dedicate time to comprehend yours in detail, including the accounts, devices, and associated phone numbers and email addresses, ensuring that the plan we create is effective for those who will need to implement it.

Schedule a complimentary 15-minute consultation to learn more.

This article is a service of Kristen Wong of Seasons Estate Planning, APC, a Personal Family Lawyer® Firm. We don’t just draft documents; we ensure you make informed and empowered decisions about life and death, for yourself and the people you love. That’s why we offer a Life & Legacy Planning Session™, during which you will get more financially organized than you’ve ever been before and make all the best choices for the people you love. You can begin by calling our office today to schedule a Life & Legacy Planning Session™.

The content is sourced from Personal Family Lawyer® for use by Personal Family Lawyer® firms, a source believed to be providing accurate information. This material was created for educational and informational purposes only and is not intended as ERISA, tax, legal, or investment advice. If you are seeking legal advice specific to your needs, such advice services must be obtained on your own separate from this educational material.