She found the notebook in the top drawer of her mother’s desk. Six pages. Every account. Every password. Every username and security question, written in neat, careful handwriting. Her mother had been organized her whole life — and the notebook proved it.

Then she tried to log in. The bank account asked for a six-digit code sent to her mother’s phone. The phone was locked with a fingerprint. The email linked to her financial accounts was from a provider that had shut down years ago. The recovery phone number on that account was a landline that had been disconnected long before her mother passed. The notebook was thorough and thoughtful. And it didn’t help. 

This is one of the most common planning gaps I see families run into, and it almost never appears in anyone’s plan. If you’ve been meaning to get your digital life organized for the people you’ll leave behind, this is the piece most people are missing.

Why a Password List Isn’t Enough Anymore

Most online accounts now require two steps to log in. The first is the password. The second is a verification code — sent to a trusted phone number or device at the exact moment someone tries to access the account.

This is called two-factor authentication, and it has become the standard for financial accounts, investment platforms, email providers, and cloud storage. It’s one of the most effective protections against fraud. It’s also one of the most common reasons families get locked out after a death.

The family has the password. But the verification code goes to a phone that’s locked, a number that no longer works, or an email address that ceased to exist years ago.

The password is correct. The account is inaccessible.

And just to be clear about something: logging into someone’s accounts using their credentials after they die isn’t actually the right path. Most platforms prohibit it in their terms of service, and it may not be legally appropriate. The right approach is to go through each platform’s official process for deceased account holders — presenting a death certificate, legal documentation, and letters establishing authority.

But here’s the problem: even during the official process, some platforms still send a verification code to the linked phone or email. If that phone is locked and that email no longer exists, the code has nowhere to go. The legal authority is in hand. The verification step is still a wall.

A real digital estate plan has to account for where each code goes, not just whether the password is correct.

The Problem with Old Emails and Changed Phone Numbers

Many accounts were set up years ago and linked to emails people no longer use. Phone numbers change. Authenticator apps live on specific devices, and if that device is locked or unavailable, the second factor goes nowhere. Every account has its own chain of linked access. When one link breaks, the account becomes unreachable without going through the platform’s own recovery process — which can take weeks, requires documentation, and doesn’t always succeed.

Your digital accounts are only as accessible as the most current version of every linked email, phone number, and device. If your estate plan doesn’t track those, it’s already out of date before it’s ever needed.

The good news is that every one of these gaps can be fixed before they become someone else’s crisis to solve.

The Accounts That Cause the Most Problems

The ones that create the biggest practical problems after a death are exactly the ones families depend on most.

Financial accounts held exclusively online require documentation and verification that can be nearly impossible to provide without proper legal authority in place. Investment and retirement accounts may have named beneficiaries, but accessing those assets still requires navigating each platform’s own process. Email accounts often contain years of financial statements, tax documents, and recovery information for other platforms. Cloud storage may hold documents, photos, or records with no backup anywhere else.

And there’s a growing category of digital-only assets that most traditional estate plans don’t even address: cryptocurrency, online business accounts, subscription revenue, licensing agreements. These can represent real financial value that disappears entirely if no one knows they exist.

Any estate plan that doesn’t inventory and address digital assets is incomplete.

What Your Will Cannot Do

One approach people try is to put account credentials directly in their will. It feels practical. It’s actually the opposite of secure.

When a will is filed for probate, it becomes a public record. Anyone can request a copy. Listing passwords, usernames, or account numbers in a will is the equivalent of publishing them — and it’s one of the things I specifically advise clients against.

What belongs in a will is an instruction: who has authority over digital assets, and where to find the access information that has been stored safely and privately elsewhere. The will names the authority. The credentials live somewhere secure.

A will is a public document after death. Passwords don’t belong in it.

Think about what this means for a grieving family: locked out of the accounts holding the money needed to pay for the funeral, the rent, the medical bills. That practical crisis lands on top of the loss. It’s preventable, and it’s exactly what a real plan is designed to address.

What a Real Digital Estate Plan Looks Like

A proper digital estate plan isn’t a list. It’s a system.

It includes an inventory of every account that holds financial, sentimental, or legal value. It documents the two-factor authentication method for each one — which phone number, email address, or app receives the verification code. It includes backup authentication codes, which most platforms allow users to generate and store offline. And it names a person with explicit legal authority to act on those accounts under applicable state law.

It also gets updated. When a phone number changes, the plan reflects it. When a new account is added, it’s documented. When an old email is retired, every account linked to it is updated in both the platform and the plan.

Many states also have a legal framework — the Revised Uniform Fiduciary Access to Digital Assets Act — that governs what a fiduciary can access after a death, and under what conditions. A will or trust can include explicit digital estate provisions that name your executor and give them specific authority to access, manage, transfer, and close digital accounts. Without that language, even a valid will may leave your executor with less authority than they actually need.

Digital estate laws vary by state, and every financial institution maintains its own documentation requirements. What one bank requires may differ entirely from what a brokerage, a cloud storage provider, or a cryptocurrency exchange requires. A real plan accounts for both the legal authority and the platform-specific process for every account that matters.

What You Can Do Right Now

Start with an inventory. Go through your accounts — financial, email, cloud storage, and anything that holds business or legal records — and for each one, write down which phone number, email address, or app receives the two-factor verification code. That chain of linked access is what your family will need, and right now it’s probably completely undocumented.

Check the recovery contacts on your email accounts. Many people have phone numbers or backup addresses tied to accounts they set up years ago and have since forgotten about. If those contacts are out of date, the accounts linked to them are already unreachable.

Generate backup codes. Most platforms with two-factor authentication let you create one-time backup codes. Print them, store them securely offline, and make sure the person who will manage your estate knows where to find them. If this feels like more than you want to sort through on your own — that’s exactly where I come in.

When I work with clients on estate planning, the digital component is now one of the first things I address, because I’ve seen what happens when families are left to figure this out themselves, in the worst week of their lives, one locked account at a time. Every family’s digital footprint is different. I take the time to understand yours — including the accounts, the devices, and the linked phone numbers and email addresses — so the plan we build together actually works for the people who will need to use it.

Your Next Step

If you’ve been putting this off because it felt overwhelming, or because you assumed a list of passwords would be enough — now you know there’s more to it, and there’s a way to get it right.

Schedule your complimentary 15-minute discovery call today. We’ll talk through your specific situation, I’ll answer your questions, and you’ll leave with a clear picture of what protecting your digital life actually looks like for your family. No pressure. No jargon. Just clarity.

Book your call HERE today!