Digital Estate Planning: Why Passwords Aren't Enough
She found the notebook in the top drawer of her mother’s desk.
Six pages. Every account. Every password. Username, password, recovery question. Her mother had been organized her whole life, and the notebook proved it.
Then she tried to log in.
The bank account asked for a six-digit code sent to her mother’s phone. The phone was locked with a fingerprint. The email linked to several financial accounts had been set up decades ago through a provider she no longer used. The recovery phone number on one account was a landline that had been disconnected years ago.
The notebook was thorough.
It did not solve the problem.
This is the digital estate planning gap many families do not see until they are already in the middle of it.
Why the Password Is No Longer Enough
Most online accounts now require more than a password.
The first step is the password. The second step is usually a verification code, security prompt, authenticator app, trusted device, or recovery email. This is called two-factor authentication, and it has become standard for financial accounts, investment platforms, email providers, and cloud storage.
It is one of the most effective protections against fraud and identity theft.
It is also one of the reasons families can find themselves locked out after a death or incapacity.
The person handling the estate may know that an account exists. They may even have the password. But the verification code may be sent to a locked phone, an outdated email address, a disconnected number, or an authenticator app that only worked on one device.
The password is correct.
The account is still out of reach.
It is important to be clear about this: after a death, using someone else’s login credentials is usually not the right path. Most platforms prohibit it in their terms of service, and it may create legal problems. The better approach is to use the platform’s official process for a deceased or incapacitated account holder. That process may require a death certificate and proof of legal authority, such as letters testamentary, letters of administration, a trust certification, a court order, or other documentation the platform requires.
But even when a family follows the official process, outdated account information can create delays. If the platform cannot match the account, verify the user’s identity, or communicate through current contact information, the process becomes harder than it needs to be.
The bottom line: Two-factor authentication protects accounts during life, but it can complicate access after death or incapacity. A list of passwords is not enough. A digital estate plan should identify the account, the platform, the recovery method, and the person with legal authority to work through the proper process.
The Old Email Problem
Many accounts were created years ago and linked to email addresses people no longer use.
At the time, that email was the natural choice. Now it may be deactivated, forgotten, or tied to a provider that changed its policies. The phone number connected to the account may have changed several times. The recovery email may be obsolete. The authenticator app may exist only on a device that no one can unlock.
Every digital account has its own chain of access.
When one link in that chain is broken, the account may not be easily recoverable without going through the platform’s process. That process can take time, require documentation, and vary from one company to the next.
This is especially important for email accounts. Email is often the key to everything else. It may contain financial statements, tax documents, insurance notices, business records, subscription information, and recovery links for other accounts.
If the email account is inaccessible, many other accounts become harder to manage.
The bottom line: Digital accounts are only as accessible as the current information connected to them. If your estate plan does not account for linked email addresses, phone numbers, recovery settings, and trusted devices, it may already be out of date before it is ever needed.
The good news is that many of these problems can be addressed before they become someone else’s emergency.
The Accounts That Cause the Most Problems
The accounts that create the most practical trouble after a death are often the ones families depend on every day.
Online-only bank accounts may have no local branch to visit. Investment platforms and retirement accounts may have named beneficiaries, but the family still has to work through that company’s process to claim or manage the account. Email accounts may hold years of financial and tax records. Cloud storage may contain documents, photographs, business files, or legal records with no backup anywhere else.
There is also a growing category of digital-only assets: cryptocurrency, online businesses, subscription revenue, payment processors, domain names, intellectual property accounts, and licensing arrangements.
Some of these assets have real financial value. If no one knows they exist, they may be overlooked. If the private key to cryptocurrency is lost, the asset may be effectively gone. If an online business account is inaccessible, income may stop before anyone even understands how the business worked.
The bottom line: The most consequential digital assets are often financial or operational, not just personal. A more complete estate plan should identify and address them.
Your will, trust, and durable power of attorney can include express digital asset provisions. These provisions can authorize the appropriate fiduciary – such as a personal representative, trustee, or agent under a power of attorney – to request access, disclosure, management, transfer, or closure of digital assets through the platform’s official process.
Without that language, the person handling your affairs may face unnecessary delay or limitation, even if the rest of your estate plan is valid.
What Your Will Cannot Do
One mistake people make is putting usernames, passwords, and account numbers directly in a will.
It feels practical.
It is not secure.
When a will is filed with the probate court, it generally becomes part of the public record. Anyone may be able to request a copy. Listing passwords, usernames, account numbers, or private keys in a will can expose exactly the information that should remain confidential.
What belongs in a will is authority and direction: who should serve, what powers that person should have, and where confidential information is stored outside the public probate file.
The passwords themselves do not belong in the will.
The bottom line: A will can name authority, but it should not publish access credentials. Confidential account information should be stored securely somewhere else.
This is not just a technical problem. It is a family problem.
It is the surviving spouse who cannot find the bill-pay account. It is the adult child trying to locate tax records before a filing deadline. It is the trustee who knows an online account exists but cannot identify the platform’s process. It is the family, already grieving, trying to manage funeral expenses, mortgage payments, medical bills, and estate administration while locked out of the accounts they need.
That burden can often be reduced with planning.
What a Real Digital Estate Plan Looks Like
A thoughtful digital estate plan is not just a list.
It is a system.
It includes an inventory of accounts that hold financial, sentimental, business, or legal value. It identifies the platform or custodian for each account. It notes the recovery method connected to the account: which phone number, email address, authenticator app, trusted device, or legacy-contact setting is used.
It also addresses legal authority. In many states, including Missouri and Illinois, a version of the Revised Uniform Fiduciary Access to Digital Assets Act governs when a fiduciary may request access to digital assets and what a platform may disclose. The details matter. Some information, especially the contents of email or private messages, may require more specific authorization than basic account information.
That is why generic language may not be enough.
A good digital estate plan may include express provisions in a will, revocable trust, durable power of attorney, and related estate planning documents. It may also include a separate confidential memorandum or inventory that is kept outside the will and updated over time.
Some platforms also allow users to set a legacy contact, inactive account manager, beneficiary designation, or other online tool. Those settings should be reviewed as part of the plan because, in some cases, they may control what the platform will disclose and to whom.
And the plan has to stay current.
When a phone number changes, the plan should reflect it. When a new account is created, it should be added. When an old email address is retired, the accounts connected to that email should be updated. When a trusted device changes, the recovery information should be reviewed.
The bottom line: A real digital estate plan is a current, organized system with clear legal authority. A password list alone usually is not enough.
What You Can Do Right Now
Start with an inventory.
Go through your important accounts: financial accounts, email, cloud storage, insurance, tax, business platforms, payment processors, subscription revenue, cryptocurrency, and any platform that holds legal or financial records.
For each one, write down:
the name of the platform;
the type of account;
the email address connected to it;
the phone number connected to it;
whether two-factor authentication is turned on;
how verification codes are received;
whether there is a legacy contact, beneficiary setting, or inactive-account option; and
where important records relating to the account are stored.
Next, check your recovery contacts.
Many people have backup email addresses and phone numbers that were set up years ago and never reviewed again. If those recovery contacts are outdated, the accounts attached to them may be difficult to access when it matters most.
Then review backup and recovery options.
Some platforms allow backup codes, trusted contacts, legacy contacts, or account recovery instructions. Any confidential access information should be stored securely. It should not be placed in a will, and a fiduciary should not use it to impersonate the account holder or bypass a platform’s rules. But accurate recovery information can help identify accounts, preserve continuity during life if an authorized agent is acting under a power of attorney, and support the fiduciary in working through the official process when the time comes.
Finally, make sure your estate planning documents match the reality of your digital life.
If your will, trust, or durable power of attorney does not mention digital assets, online accounts, electronic communications, or authority to work with custodians, it may be time to update them.
Or, if you would like guidance on organizing your digital accounts as part of your estate plan, reach out.
Schedule a complimentary 15-minute discovery call and let's find out where you stand:
This article is a service of Schroer Legacy Law LLC. We don’t just draft documents; we support you to make informed and empowered decisions about life and death, for yourself and the people you love.
This material was created for educational and informational purposes only and is not intended as legal advice or services. Receipt or review of this article does not create an attorney-client relationship with Schroer Legacy Law LLC. If you seek legal advice specific to your needs, such advice and services must be obtained on your own, separate from this educational material.
The choice of a lawyer is an important decision and should not be based solely upon advertisements.
