Digital assets and account access

A growing share of what people own, and nearly all of what they have recorded, exists only in online accounts protected by credentials nobody else has.

What is at stake

Assets with value. Cryptocurrency, online business accounts, domain names, monetised channels, loyalty balances and stored credit.

Records needed to administer an estate. Paperless statements, tax documents, insurance correspondence, and the account list itself.

An executor who cannot access email frequently cannot establish what accounts exist at all.

Things of personal rather than financial value. Photographs, correspondence, writing.

These are frequently what families care most about and what is most often lost.

Ongoing obligations. Subscriptions that continue billing until someone stops them.

Why access is difficult

Several barriers operate together.

Terms of service frequently prohibit sharing credentials and provide that accounts are non-transferable.

Federal computer access laws criminalise unauthorised access, and their application to a family member using a deceased person's credentials has been a subject of legal uncertainty.

Privacy legislation restricts providers from disclosing the contents of communications without lawful consent.

Two-factor authentication tied to a phone or device makes access impossible without that device, even with the password.

Most states have adopted legislation addressing fiduciary access to digital assets, which establishes a hierarchy: a provider's own online tool governs first; failing that, a direction in a will, trust or power of attorney; failing that, the provider's terms of service.

Which makes using the provider's own tool the most reliable route available.

The practical steps

Use legacy contact features. Several major providers offer mechanisms allowing a nominated person to obtain access or to manage the account after death.

These take minutes to set up and override the general terms of service.

Use a password manager with emergency access. Most reputable managers offer a feature granting a nominated person access after a waiting period.

This is the single most effective arrangement, because it covers everything rather than only the services with their own tools.

Include explicit authority in the legal documents. Powers of attorney and wills should expressly grant authority over digital assets, since general authority may not be sufficient under the relevant legislation.

Maintain an inventory, listing accounts and their purpose — not passwords, which belong in the manager.

Address two-factor authentication. Recovery codes should be stored where the nominated person can reach them, and the risk of a phone-only authentication method should be considered.

Cryptocurrency specifically

The category where loss is most permanent.

Assets held in self-custody wallets are accessible only with the private key or recovery phrase. There is no provider to appeal to and no recovery mechanism.

Substantial amounts have been permanently lost this way.

Planning requires that the recovery information exists somewhere accessible to a fiduciary, securely — which is a genuine tension between security and accessibility.

Approaches include splitting recovery information between locations, using a specialist custody service, or documenting the arrangement with an attorney holding part of the information.

Whatever is chosen, the executor needs to know the assets exist, which is the first failure point.

What to say about content

A separate question from access.

Some people want their correspondence preserved for family; others emphatically do not.

Stating the preference explicitly — in the will or in a letter of instruction — allows a fiduciary to act with confidence rather than guessing.

Instructions to delete rather than to preserve are equally valid and equally worth stating.

Business accounts

A specific risk for anyone self-employed or running a business.

Domain registrations, hosting, payment processing, social accounts and customer systems are frequently held under one person's personal credentials.

Where that person becomes unavailable, the business can be effectively paralysed within days.

Transferring these to business accounts with multiple administrators is straightforward and rarely done.

The inventory

What the document should actually contain.

Email accounts first, since they are the route to resetting almost everything else.

Financial and payment accounts. Cloud storage. Social and communication accounts. Domains and hosting. Subscriptions with recurring charges. Devices and how they are unlocked.

For each: the provider, the purpose, and whether a legacy contact or emergency access has been configured.

Passwords belong in the manager rather than the inventory, and the inventory should record how the manager itself is accessed.

Updated annually, this takes twenty minutes and it is the difference between an executor who can act and one who cannot.

General information only, not legal advice. Digital asset legislation and provider terms vary and change — consult a qualified attorney about your own circumstances.