Digital Estate Planning: Why Passwords Aren't Enough
She found the notebook in the top drawer of her mom’s desk in Crestview Hills. Six pages. Every account. Every password. Usernames, passwords, recovery questions—all written in her mother’s neat handwriting. Her mom had always been organized, and the notebook proved it.
Then she tried to log in.
The bank asked for a six‑digit code sent to her mother’s phone. The phone was locked with a fingerprint. The email tied to the bank had been set up decades ago with an old provider that doesn’t exist anymore. The “backup” phone number was a landline that had been disconnected years ago.
The notebook was thorough. It did not help.
This is the digital estate planning gap most families don’t see until it’s already too late—and we are seeing it more and more in Northern Kentucky and Cincinnati.
Why Passwords Don’t Get Your Family In
Most online accounts now require two steps to log in. First is the password. Second is a verification code sent to a phone, email, or app at the moment someone tries to access the account.
This added layer, called two‑factor authentication, is now standard for bank accounts, investment platforms, email providers, and cloud storage, because it helps prevent fraud and identity theft.
It’s also one of the most common reasons families can’t get into critical accounts after a death. The person trying to help has the password, but the verification code goes to a locked phone, a dead phone number, or an email address that no longer exists.
The password is right. The account is still blocked.
It’s also important to understand that, after a death, using someone’s personal login credentials is usually not the “official” or legally appropriate path. Most platforms prohibit it in their terms of service. The proper approach is to go through the platform’s deceased account process—typically with a death certificate, a copy of the will, and documents proving legal authority such as letters of appointment.
Even then, some platforms still send verification codes to the old linked phone or email during that process. If that phone is locked and that email no longer exists, the code has nowhere to go, and your legal authority hits a brick wall.
This is why a real digital estate plan has to address where each verification code goes—not just whether the password is correct.
Bottom line: Two‑factor authentication blocks access at the second step, even when the password is right. A password list alone does not fix this. Your plan has to include how your executor or trustee can receive those verification codes.
The “Old Email” and “Old Phone” Problem
Think about how many accounts you opened years ago using an email address you don’t use anymore. Maybe it was your first “@yahoo” email, or an address from an internet provider you’ve since changed.
At the time, that email felt like the obvious choice. Today, it may be deactivated, moved to a different provider, or forgotten entirely. The same thing happens with phone numbers. We change carriers, get new numbers, and sometimes never update what’s linked to our accounts.
Authenticator apps can create another barrier. If the app is only installed on one phone—and that phone is locked, damaged, or unavailable—your second factor goes nowhere, and your family is stuck.
Every account has its own chain of access: login, email, phone number, and device. When one link breaks, the account becomes unreachable without going through the platform’s recovery process, which can take weeks, requires documentation, and doesn’t always work.
Bottom line: Your digital accounts are only as accessible as the current versions of every linked email, phone number, and device. If your estate plan doesn’t track those, it’s already out of date before anyone needs it.
The good news: all of these gaps can be fixed now, while you’re here and able to make changes, instead of leaving your family to fight through them later.
The Accounts That Cause the Biggest Headaches
The accounts that create the biggest problems after a death are the ones families rely on every day in Northern Kentucky and Cincinnati.
Online‑only bank and financial accounts, with no local branch to visit, often require very specific documentation and verification that is hard to provide without clear legal authority.
Investment platforms and retirement accounts may have beneficiaries listed, but someone still has to navigate each company’s process to actually manage or move the assets.
Email accounts can hold years of financial statements, tax documents, and recovery information for other accounts.
Cloud storage may contain important business records, legal documents, or irreplaceable family photos with no backup elsewhere.
On top of that, we’re seeing more digital‑only assets: cryptocurrency, online business accounts, subscription revenue, and licensing agreements. These can represent real money and real value that disappears entirely if no one knows they exist or how to access them.
Bottom line: Your most consequential digital assets are often financial and operational, not just sentimental. An estate plan that doesn’t inventory and address those accounts is incomplete.
Your will should include clear language giving your executor authority over digital assets and specifying where access information is stored. Without that, your executor may run into avoidable legal and practical obstacles, even with a valid will.
What Your Will Can—and Cannot—Do
A common “DIY” idea we hear from local families is: “I’ll just put all my account logins in my will so my kids can get in.” It sounds practical. Unfortunately, it is not safe.
Once a will is filed for probate in Kentucky or Ohio, it becomes a public record. Anyone can request a copy. Listing usernames, passwords, or account numbers in your will is essentially publishing them to the world.
We specifically advise against putting any sensitive access credentials in the will for this reason.
What does belong in the will is instruction and authority: who is in charge of your digital assets, and where the access information has been securely stored outside the public record
Bottom line: Your will is a public document after death. Passwords don’t belong in it. Your will should name who has authority; your access information should live somewhere private and secure.
This isn’t just an “account access” problem on paper. This is your family, already grieving, locked out of the very accounts that hold the money they need for the funeral, the mortgage, and medical bills. We see that stress layered on top of grief, and it’s exactly what we want to help families avoid.
What a Real Digital Estate Plan Looks Like
A proper digital estate plan is not just a list of passwords. It is a system built to work when your family needs it most.
A strong digital estate plan usually includes:
An inventory of every account that holds financial, sentimental, or legal value.
Documentation of the two‑factor method for each account: which phone number, email address, or app receives the verification codes.
Backup authentication codes, which most platforms allow you to generate and print, stored securely offline.
Named individuals with explicit legal authority to act on those accounts under applicable law.
And it doesn’t sit on a shelf and go stale. When you change phone numbers, the plan is updated. When you open a new account, it gets added. When you retire an old email address, you update every account connected to it—in both the platform and your plan.
In many states, including our region, a legal framework called the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) governs what a fiduciary—like your executor or trustee—can access and under what conditions. What your family can reach after a death, and how they go about it, depends heavily on whether you properly granted that authority in advance.
Under this framework, your will or trust can include specific digital estate provisions that name your fiduciary and grant them clear authority to access, manage, transfer, and close digital assets. Without that language, even a valid will might leave your executor with less authority than they actually need.
Digital‑asset laws vary by state, and each financial institution, cloud provider, and cryptocurrency exchange has its own forms and procedures. What your local bank requires may be different from what your brokerage, online business platform, or storage provider requires. A good plan accounts for both the legal authority and the platform‑specific process for every account that matters.
When we build this with families here in Northern Kentucky and Cincinnati, we walk through each account, each linked contact, and each point of legal authority so that the system exists before anyone needs it—not pieced together during the hardest week of your family’s life.
Bottom line: A real digital estate plan is a living system, kept current, with clear legal authority built in. A simple password list is not enough.
Three Steps You Can Take Right Now
If you’re feeling a little overwhelmed, you’re not alone. The good news is you can start with a few simple, practical steps:
Make an account inventory.
List your financial accounts, email accounts, cloud storage, and any platforms that hold business or legal records. For each one, note which phone number, email address, or app receives the two‑factor verification code. That “chain of access” is what your family will need—and right now, it’s probably not written down anywhere.Update recovery contacts.
Check the recovery phone numbers and backup email addresses on your main email accounts. If they point to old numbers or dead email addresses, those accounts—and the accounts connected to them—may already be unreachable.Generate and store backup codes.
Many platforms that use two‑factor authentication allow you to create one‑time backup codes. Generate them, print them, and store them securely offline. Make sure the person who will manage your estate knows where those codes are kept.
If this feels like more than you want to tackle on your own, that’s exactly where we come in as your Northern Kentucky elder law and estate planning team. When families work with us on Life & Legacy Planning, the digital component is now one of the first things we address, because we’ve seen what happens when loved ones are left to figure this out themselves—one locked account at a time.
Every family’s digital footprint is different. We take the time to understand yours specifically—the accounts, devices, phone numbers, and emails—so the plan we build actually works for the people who will rely on it.
Schedule Your Life & Legacy Planning Session
Schedule a complimentary 15‑minute discovery call and let’s find out where you stand with your digital estate planning and overall Life & Legacy Plan:
This article is a service of Freedom Law Services, a Personal Family Lawyer® Firm. We don’t just draft documents; we ensure you make informed and empowered decisions about life and death, for yourself and the people you love. That’s why we offer a Life & Legacy Planning® Session, during which you will get more financially organized than you’ve ever been before and make all the best choices for the people you love. You can begin by calling our office today to schedule a Life & Legacy Planning Session
The content is sourced from Personal Family Lawyer for use by Personal Family Lawyer firms, a source believed to be providing accurate information. This material was created for educational and informational purposes only and is not intended as ERISA, tax, legal, or investment advice. If you are seeking legal advice specific to your needs, such advice services must be obtained on your own, separate from this educational material.
© 2026
