How to Secure a Deceased Family Member's Online Accounts

When someone in your family dies, their online accounts do not close themselves, and leaving them open creates a real opening for fraud. The Federal Trade Commission (FTC), the U.S. agency that protects consumers from unfair business practices and identity theft, warns that thieves specifically target the identities of people who have recently died because credit bureaus and government agencies do not update their records instantly. Acting on a short list of accounts, in a specific order, closes most of that window before it becomes a problem.

This guide covers what to secure first, which documents you will need, how Google, Apple, Meta, and Microsoft each handle a deceased user's account, and how to spot the scams that specifically target grieving families in 2026.

Why deceased accounts are a specific fraud target

Identity thieves look for records that are technically valid but temporarily unwatched, and a death creates exactly that gap. According to the Federal Trade Commission's consumer guidance, someone who obtains a deceased person's Social Security number, date of birth, and address can open credit cards, apply for loans, or file a tax return in that person's name. Fraud prevention groups commonly call this practice "ghosting." Because the account holder can't review a statement or respond to a fraud alert, the activity can go unnoticed for months, often until an executor sorts through the estate.

The same gap affects older relatives who are still living. If you're also managing accounts for an aging parent, the same order of operations, secure email first, then financial accounts, then everything else, applies to protecting elderly parents from online scams and identity theft.

Freezing credit and closing the tax exposure

A credit freeze restricts access to a credit report, which stops most lenders from approving new accounts, and it's one of the more effective steps you can take for a deceased family member's file. The process for a living person and a deceased person differs slightly, since bureaus require a death certificate and sometimes a copy of your ID as the person requesting the freeze; see how to freeze your credit to prevent identity theft for the request process at each bureau.

On the tax side, the executor or administrator of the estate is generally responsible for filing the deceased person's final federal income tax return. The Internal Revenue Service (IRS) publication that covers thisIRS Publication 559, Survivors, Executors, and Administrators, outlines the filing requirements and the documentation the IRS expects from an estate representative. Sending the IRS a copy of the death certificate as part of that process is a reasonable extra step toward reducing the chance of a fraudulent return being filed in the deceased taxpayer's name, though the agency doesn't promise it will prevent every attempt.

Documents to gather, and protecting the rest of the family's digital identity

Every provider asks for slightly different proof, but plan to gather these before you start calling: certified death certificates, your government-issued ID, and proof of legal authority such as letters testamentary (the court document naming you as executor), letters of administration, or a notarized affidavit of next of kin, depending on the state and the account. Some platforms will accept a death certificate alone to close an account; others, especially email providers, may require a court order before releasing the account's actual contents rather than simply closing it. If a provider asks for legal documentation you don't have, an estate attorney familiar with your state's probate process can tell you what's actually required. This isn't legal advice, since probate rules vary by state.

Digital assets deserve the same attention as bank accounts. Cryptocurrency held in a personal wallet generally cannot be recovered by an exchange without the private keys or seed phrase, so locate that information early; see cryptocurrency account security for how those keys should be stored. While you're handling the deceased person's accounts, it's a reasonable time to tighten your own: enable multi-factor authentication, review basic cyber hygiene habits, review how to protect your digital identity, and consider dark web monitoring if any of the deceased person's credentials might have appeared in a past breach, since reused passwords across a family's accounts are a common way one compromise spreads to another.