Passwords, Phones, and Two-Factor Access After a Parent Dies: A Family Checklist

After a parent dies, families often think first about death certificates, funeral arrangements, banks, benefits, and the house. Then a practical problem appears: the phone is locked, the email account receives bills and verification codes, the password manager is unknown, and two-factor authentication blocks access to important accounts. A calm digital-access plan can help the family protect information, close what should be closed, preserve memories, and avoid making legal or security mistakes during a stressful week.

This guide is educational only. It is not legal, tax, financial, technology-security, or estate advice. State laws, platform rules, probate requirements, and family authority vary. Use this as an organizing checklist, then confirm account access, estate authority, tax questions, and legal decisions with the appropriate institution, platform, professional, or court process.

Start with authority, not the password

The safest first question is not "What was the password?" It is "Who has authority to act?" A surviving spouse, executor, administrator, trustee, court-appointed personal representative, or agent named in a valid document may have different rights and limits. A helpful adult child may be able to gather paperwork and make calls, but that does not automatically mean the child can open private messages, move money, delete files, or sign into accounts.

For government and benefit records, use official channels first. USAGov's guide to reporting a death points families to agencies that may need notice. The Social Security Administration explains what to do when someone dies, including how deaths are often reported through funeral homes and when survivors should contact SSA. Those steps do not unlock a phone or email account, but they reduce fraud risk and prevent benefit problems.

Before anyone tries to reset passwords, create a simple authority folder. Include certified death certificates, the will or trust contact page if available, letters testamentary or letters of administration if the court has issued them, photo ID for the person acting, proof of relationship when needed, and a call log. Many companies will ask for some version of those documents before discussing a deceased customer's account.

Secure the devices without erasing evidence

A phone, tablet, or laptop may hold photos, contacts, notes, saved bills, medical portal messages, password-manager prompts, and two-factor codes. It may also contain private conversations that other relatives should not browse casually. The immediate goal is to preserve the device and prevent misuse, not to explore everything on it.

• Keep the phone charged and connected to its usual number if possible until important two-factor and service-transfer questions are resolved.
• Do not factory reset a phone, wipe a computer, or discard a SIM card before the family knows what accounts depend on it.
• Store devices in one agreed location and write down who has physical custody.
• If the device is unlocked, avoid opening private apps unless the authorized person decides the information is needed for estate administration or safety.
• Photograph device labels, charger types, and carrier information, but do not photograph passwords or private messages for casual sharing.

A practical example: a daughter finds that her father's phone still receives text codes for his utility, email, pharmacy, and bank alerts. She should not reset the phone to "clean it up." A better first move is to keep it powered, identify the mobile carrier, tell the executor what the phone is being used for, and preserve it while accounts are transferred or closed through official channels.

Make an account inventory from bills and email clues

Families rarely find a perfect list of accounts. Build one from reliable clues: paper mail, bank statements, credit card statements, check registers, browser bookmarks, password-manager icons, app names on the phone, email sender names, medical portal notices, insurance cards, and subscription charges. Keep the list practical. The purpose is not to invade privacy. It is to find accounts that affect money, property, benefits, taxes, health records, identity, photos, and recurring charges.

Use columns such as account name, category, known username or email, phone number tied to two-factor authentication, bill or renewal date, whether money is involved, whether the account should be preserved or closed, and who is responsible for follow-up. Mark accounts that may need urgent attention: mortgage, rent, utilities, insurance, banking, credit cards, phone service, email, cloud storage, password manager, tax software, medical portals, Social Security, Medicare, pension, and funeral or cemetery accounts.

Do not forget small recurring charges. Streaming services, cloud storage, domain names, storage units, monitoring services, phone apps, and annual subscriptions can continue billing after death. A low-dollar subscription may also be the clue that photos, documents, or business records are stored somewhere.

Handle two-factor authentication carefully

Two-factor authentication protects accounts by requiring something beyond a password, often a text message, authenticator app, security key, or recovery code. After a death, that protection can become a barrier. Families should treat two-factor access as part of the authority process, not as a puzzle to defeat.

If an account belongs to the estate or affects bills, ask the company how it handles deceased customers. If a phone number is the only way to receive codes, call the carrier before canceling the line. Ask what documentation is needed to transfer billing responsibility, keep the number active temporarily, or close the account later. If an authenticator app is on the phone, do not remove it until important accounts have been handled. If physical security keys exist, place them with estate documents.

Decision point: if the account contains only personal memories, the family may choose to preserve, download, memorialize, or delete. If the account controls money, taxes, insurance, property, or medical billing, the authorized person should use the provider's death or estate process. If relatives disagree about access, pause and get qualified help rather than sharing passwords in a group text.

Email is usually the center of the map

Email often connects everything else. It receives password resets, account notices, receipts, appointment reminders, cloud-storage messages, tax documents, and alerts about suspicious sign-ins. That makes email valuable and sensitive. It may also contain private conversations, attorney messages, medical information, or family communications that are not relevant to estate work.

Google's official page for a deceased user's account says Google may work with immediate family members and representatives to close an account and, in some circumstances, provide content, but it does not provide passwords or login details. Apple's support page on requesting access to a deceased family member's Apple Account explains that Apple provides ways to request access to or delete an Apple Account and related data. Apple also has a Legacy Contact process when the person set that up before death. Microsoft's page on Outlook.com, OneDrive, and other Microsoft services after death describes its process and inactivity handling.

The lesson is simple: each platform has its own rules. A death certificate alone may not give access. A password may not be enough if two-factor authentication is missing. A court document may be required. Families should read the provider's current page, gather the requested documents, and save confirmation numbers.

Photos, cloud storage, and social accounts need a different conversation

Not every digital account is a bill or legal record. Some accounts hold family photos, videos, messages, recipes, genealogy notes, or creative work. Others are public-facing social profiles that friends may visit after the death. Families should decide what they are trying to do before they contact a platform: preserve memories, download data, memorialize a profile, remove a profile, stop billing, or prevent impersonation.

Meta's Facebook Help Center describes options for managing a deceased person's account, including memorialization. It also explains legacy contacts and separate requests to remove a deceased family member's account. Instagram has related deceased-person profile request pages. Because platform pages and required documents can change, use the current help center page rather than relying on old advice from friends or forums.

A family example: one sibling wants the account deleted immediately because reminders are painful. Another sibling wants photos preserved for grandchildren. A calmer approach is to list what needs saving, check whether a legacy contact exists, download or request available memories through the proper channel if permitted, then decide whether memorialization or removal fits the family's wishes and the platform's rules.

Protect identity and financial records

Digital cleanup is also fraud prevention. The FTC's IdentityTheft.gov provides step-by-step help for reporting and recovering from identity theft at IdentityTheft.gov, and FTC consumer guidance explains credit freezes, fraud alerts, and safe handling of personal documents. The IRS identity theft guide includes a section on deceased person identity theft and recommends filing final returns when due, sending credit bureaus a death certificate so reports can be marked with a deceased alert, watching for unusual activity, and avoiding too much personal information in an obituary.

Families should also be cautious with debt calls, emails, texts, and payment requests. The FTC's page on debts and deceased relatives explains that debt collectors may discuss a deceased person's debts only with certain people, such as a spouse, executor, administrator, lawyer, or other authorized representative. Do not give account numbers, Social Security numbers, payment information, or login codes to someone who contacts the family unexpectedly.

A first-week checklist

• Get several certified death certificates and start an authority folder.
• Confirm who is acting for the estate or who will ask the court for authority.
• Keep the phone, laptop, tablet, SIM card, security keys, and chargers safe and charged.
• Do not cancel the mobile number until two-factor and account-transfer needs are understood.
• Create an account inventory from mail, statements, apps, subscriptions, and email clues.
• Separate urgent accounts from memory accounts: money, housing, utilities, insurance, tax, benefits, medical, email, cloud, photos, and social profiles.
• Use official platform pages for Google, Apple, Microsoft, Meta, banks, carriers, and other providers.
• Write down every call date, case number, requested document, and next step.

A 30-day digital cleanup checklist

• Ask the mobile carrier about temporary continuation, transfer, or closure of the line.
• Stop or transfer recurring subscriptions after the authorized person confirms what should be preserved.
• Download or request important photos and documents only through permitted processes.
• Notify financial institutions, insurers, pension administrators, and benefit programs through their death-notice process.
• Watch mail and email for unfamiliar bills, password-reset notices, or suspicious account activity.
• Ask credit reporting agencies to mark the person as deceased when appropriate and keep proof of the request.
• Review whether tax software, IRS records, and final-return documents are needed by the executor or tax preparer.
• Update family records so surviving relatives do not face the same access problem later.

What to avoid

A few shortcuts can create more problems than they solve. Avoid sharing passwords broadly among relatives. Avoid posting a death announcement with a full birth date, address, mother's maiden name, or other identity clues. Avoid clicking links in unexpected texts or emails about benefits, funeral bills, bank alerts, or inheritances. Avoid paying a debt collector from personal funds before confirming who owes the debt. Avoid deleting accounts before photos, tax documents, bills, and estate records are reviewed by the authorized person.

Also avoid assuming that a power of attorney still works after death. Many powers of attorney end when the person dies, while the executor or court-appointed representative may take over estate matters. If that distinction affects an account, ask a qualified professional instead of relying on the account's password screen.

Next steps for families

Digital access after death is less about technology skill than orderly decision-making. Preserve devices. Identify authority. Keep the phone number alive long enough to understand two-factor dependencies. Build an account inventory. Use official platform and provider processes. Protect the person's identity. Document every request. When a choice involves privacy, money, taxes, estate authority, or family disagreement, slow down and get the right help.

The best future fix is planning before a crisis: a password manager with emergency access, written instructions for trusted people, updated beneficiary and legacy-contact settings, and a short list of critical accounts. But even when no plan exists, families can still move step by step without guessing, wiping devices, or sharing sensitive information unnecessarily.

Sources

• USAGov: Report a death to government programs and agencies
• Social Security Administration: When someone dies
• FTC: IdentityTheft.gov
• FTC: Debts and deceased relatives
• IRS: Identity theft guide for individuals
• Google Account Help: Submit a request regarding a deceased user's account
• Apple Support: Request access to a deceased family member's Apple Account
• Apple Support: How to add a Legacy Contact
• Microsoft Support: Accessing Outlook.com, OneDrive, and other services when someone has died
• Facebook Help Center: Managing a deceased person's account
• Facebook Help Center: About legacy contacts