Hacked Accounts and Recovery

Helping a Relative Access the Accounts of a Loved One Who Has Died

General guidance on how families usually work with providers to close, memorialize or access a deceased person's online accounts, and why logging in is a poor idea.

On this page
  1. A difficult task at a difficult time
  2. Why you should not simply log in
  3. Start with the essentials
  4. How providers typically handle requests
  5. Protect the person and the family
  6. Documents and records make it easier
  7. Be kind to yourself

A difficult task at a difficult time

After a death, families often discover that the person’s life continues online. There may be email, photo storage, social media, subscription services, banking apps and perhaps small businesses or creative work. Dealing with all of this while grieving is hard, and there is rarely one simple answer, because rules differ by provider and by country.

This is general information, not legal advice. For anything involving property or money, a qualified professional such as an estate lawyer can explain what applies where you live.

Why you should not simply log in

It is tempting to guess a password or use a saved device login. Many families do so with good intentions, but there are reasons to be careful:

  • Terms of service for many providers prohibit sharing or using someone else’s login, and in some places unauthorized access to an account can raise legal questions.
  • Activity on the account may trigger security systems and lock it, sometimes permanently.
  • You can accidentally change or delete things that an executor or the family may later need.
  • Accounts left open and unattended can be targeted by criminals who use obituaries and public information to impersonate the person or take over their identity.

If the person left clear written instructions and a way to access their accounts, that is a different situation, and following their wishes through the tools they chose is sensible. Even then, it helps to proceed carefully.

Start with the essentials

Begin with a short list of what matters most:

  1. Email. Many other accounts depend on it, so find out which provider the person used. Do not delete it early, since you may need it to receive notices and reset messages for other services.
  2. Phone and carrier. Keep the number active for a while if you can, since verification codes may arrive there. Cancelling it too soon can lock you out of other accounts.
  3. Money-related accounts. Banks, card issuers, pensions and payment apps usually have bereavement teams who handle notification directly. Contact them using the numbers on official statements.
  4. Subscriptions and recurring charges. Review statements to find them. Statement review habits are useful here, because recurring payments show up on them even if you cannot see the account.
  5. Photos and documents. Cloud storage may hold irreplaceable family memories. Prioritize these when requesting access.

How providers typically handle requests

Large providers often have a process for deceased users. The details differ widely, and some are strict about privacy, but common features include:

  • Memorialization or closure. Social media platforms often let a family request that a profile be closed or turned into a memorial page, so it stays visible but cannot be logged into. Some let the person name a legacy contact in advance.
  • Limited data release. Email and cloud providers may decline to release contents, or may release them only after a court order or other formal documentation. A request may be approved for some data but not all.
  • Requested paperwork. You are commonly asked for a death certificate, proof of your relationship or legal authority (for example, being named executor), and identification for yourself. Requirements vary, and some providers want documents certified or sent by post.
  • Waiting periods. Reviews can take weeks. Replies may be formal and brief. Patience helps.

Look in the provider’s help center for a section on deceased users or “requests regarding a deceased person.” Use only the official page, not a link from a search advertisement or message. Scammers do exploit bereavement, so be wary of anyone who contacts you offering to “unlock” the account for a fee.

Protect the person and the family

While waiting for the formal process, you can reduce risks without logging in:

  • Notify the major credit reporting agencies in your country, if such a service exists, so the person’s identity is less likely to be misused. A credit freeze is one option some families consider; ask which options your country offers.
  • Tell the person’s close contacts if you want to avoid confusion about odd messages. If a profile begins sending strange links, the guidance on fake social profiles may explain what could be happening.
  • Report impersonation accounts to the platform through its report tools.
  • Keep a written list of the accounts you find, the requests made and the replies received.

Documents and records make it easier

A box of papers can speed everything up. Look for a will or any digital instructions, address books, past bills, a password manager emergency kit, and statements showing which services were paid for. The idea of keeping emergency document storage in an organized place is valuable for exactly this reason, and families who have gone through this often decide to do the same for themselves.

Be kind to yourself

Some accounts will not be recoverable, and some details will remain unknown. This does not mean you have failed. Prioritize what protects people and preserves memories, and let the rest go slowly. If it all feels too much, ask another family member to share the work or consult a professional who handles estates. Grief support is available too, and it is fine to take breaks.

The complete guide to hacked accounts and recovery

What to Do First When an Account Is Hacked
Read the guide

Keep exploring

Guides from other topics

All topics →