Digital legacy includes accounts, photos and passwords that remain active after a user's death. Managing them is a challenge, as legal frameworks internationally often lag behind company policies, creating obstacles to access and protection of data by legal heirs.
Lack of planning exposes digital assets to risks of fraud and financial loss. Proactively organizing access lists, designating legacy contacts on platforms, and informing relevant agencies are essential steps to safeguard digital assets and relieve those affected from additional burdens.
When someone dies, they leave behind objects, real estate, family heirlooms. But today we also leave behind something equally important: our digital "treasures" such as email accounts, photos, passwords, music playlists, social media accounts, and even smart home devices.
"The problem is that these digital assets are often 'locked' after our death, further complicating an already traumatic situation for friends and family. Worse, these accounts can become targets for fraudsters," says Phil Muncaster in WeLiveSecurity, the information platform of cybersecurity company ESET.
That's why it's important to know how you can prepare and protect your digital heritage, as well as what actions you can take in advance to reduce the emotional and practical burden on your loved ones. Equally important is knowing what to do next if you suddenly find yourself faced with such a situation, Muncaster emphasizes.
What does the law say?
One of the biggest challenges involves social media accounts and password management. While banks, tax authorities and credit card companies have established procedures for closing accounts after a person’s death, many companies that operate primarily in the digital environment still treat death as an “edge case,” according to the OpenID Foundation.
From a legal perspective, inheritance laws often do not adequately cover digital assets. At the same time, online platform policies can be unclear or opaque, while available tools and processes remain fragmented, such as points out the OpenID Foundation (PDF).
What is the situation today in the US, the UK and Europe?
- United States: The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) aims to address situations like this. However, in practice, relatives often have to contend with digital platforms’ Terms of Service (ToS), which can vary significantly and include restrictive provisions.
- United Kingdom: Experts warn that without early planning, families are often unable to access the accounts of the deceased as providers deny access. However, a proposed bill on digital asset ownership seeks to recognise such assets as personal property, ensuring they can be included in wills and subject to inheritance law.
- Europe: The European Law Institute is working to harmonize the legislative framework across Europe, with the aim of establishing clear guidelines for the inheritance of digital assets and the protection of information contained in the relevant accounts.
What is the risk?
For grieving friends and family, the emotional toll of losing a loved one can be dramatically heightened when they are unable to retrieve the digital remains. Worse, social media algorithms may display unwanted reminders, such as birthday notifications or photos tagged with the deceased’s name.
There are also financial implications. Relatives may not be able to access cryptocurrencies or other assets that are legally theirs, Muncaster explains to ESET’s WeLiveSecurity. Meanwhile, subscriptions and services that cannot be canceled may continue to charge the deceased’s account, gradually depleting available funds.
Fraudsters have also identified opportunities for financial gain
Initially, they search for personal information in obituaries and social media posts, in order to impersonate the deceased and proceed to:
- Attempts to defraud credit card companies.
- Tax fraud.
The challenge for banks and government agencies is that, when the victim is no longer actively monitoring their accounts, this type of fraud can go unnoticed for a long time.
Additionally, scammers may target the families of people who have recently died. For example, they may download videos of the deceased from the internet and create deepfakes, with the aim of extorting money or sensitive information from relatives. Alternatively, they may hack the deceased’s social media accounts and use them to commit fraud.
Sometimes scammers may pretend to represent an insurance company and demand a fee to release life insurance funds. They may also pose as “account recovery” service providers, claiming they can gain access to a loved one’s digital assets for a fee.
What can you do
The first thing you need to do is organize your estate planning or help a loved one organize theirs.
Create a digital catalog of all your important accounts, devices, and assets, including login details. This can be complicated, especially if you or your loved one uses passkeys or digital wallets to store passwords. However, it is an important first step.
It's important to know that, although most major tech companies offer the ability to set a "legacy contact," if you don't enable this feature while you're alive, it's very likely that no one will be able to access your accounts after your death.
The main services available are the following:
- Heritage Contact at Facebook and its Instagram
- Administrator Inactive Google Account
- Digital Heritage of Apple
- Password management services like 1Password, LastPass, and Keeper, which offer “emergency access” features or similar capabilities.
However, you should be aware that the permissions granted through the above functions may be limited, which may limit the information and actions you will have access to. However, it is usually possible to secure, manage or even permanently deactivate the relevant accounts. This of course assumes that these accounts are not necessary to receive one-time codes (OTPs) required to access other services.
Then, reduce the risk of financial fraud by filing the deceased’s tax return, filing a “death notice” with all credit institutions, and monitoring for any unusual activity. Revoke their driver’s license and freeze their bank accounts and credit cards, closing them permanently as soon as it’s safe to do so. Also, cancel any active subscriptions you identify.
Finally, avoid sharing too much personal information in the obituary, as scammers may be watching for it. Also, make sure friends and family members are on the lookout for potential scam attempts, warns Muncaster.
The worst moments
The above may be easier said than done, especially when you are faced with grief and the multitude of issues that need to be sorted out after the loss of a loved one.
That's why it's important to plan ahead as much as possible, by designating legacy contacts on key accounts and platforms you use. It's also helpful to understand how digital scams can manifest themselves during this emotionally charged time.
The OpenID Foundation is calling on policymakers, technology platforms, and standards bodies to take action to make the process easier, safer, and less traumatic for relatives. Until then, however, you should make do with what you can. Even talking about this issue is a step in the right direction.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
