A client came to me after her mother’s death with a notebook her mother had kept for years – six pages, every account listed, every password recorded. Her mother had been meticulous. The notebook, on paper, solved the problem.

It didn’t. The bank required a six-digit verification code sent to her mother’s phone, which was locked. The email linked to the account had been opened through a provider that no longer existed. The recovery number on file was a landline, disconnected for years.

The password was correct. The account remained inaccessible.

This is a gap that appears in almost no estate plan, and it is one of the most common reasons families are unable to access accounts after a death.

Two-factor authentication is now standard across financial institutions, investment platforms, email providers, and cloud storage. It is also, absent proper planning, one of the most reliable ways to lock a family out of exactly the accounts they need. A verification code is sent to a linked phone or email at the moment of login, and if that phone is locked, that number disconnected, or that email defunct, the code has nowhere to go. Legal authority does not resolve this. The credentials are correct. The verification step is still a wall.

It’s worth clarifying the correct approach. Using a decedent’s login credentials directly is not the intended path, and most platforms prohibit it under their terms of service. The proper route is each platform’s official deceased-account process, which typically requires a death certificate, a copy of the will, and documentation establishing legal authority. Even then, some platforms still route verification through a linked device or address that no longer functions, leaving an authorized executor unable to complete a step the platform itself requires.

I advise against including account credentials in a will. Once filed for probate, a will becomes a public record, and anything listed in it is effectively published. A will should name the party with authority over digital assets and direct them to where access information is stored securely, not disclose that information itself.

A properly constructed digital estate plan addresses this systematically: a full inventory of accounts holding financial, legal, or sentimental value; the verification method tied to each one; backup authentication codes generated and stored offline; and explicit legal authority granted to an executor under the relevant state framework — in many states, the Revised Uniform Fiduciary Access to Digital Assets Act. It also requires maintenance, as phone numbers, email addresses, and devices change over time.

Clients can take three immediate steps: inventory accounts and record which phone or email receives each verification code; review and update recovery contacts on primary email accounts, which are often years out of date; and generate backup authentication codes where platforms allow it.

Start Your Planning

We can help! Start by booking a Legacy Planning Session. In this working meeting, we’ll answer your questions, review your options, and outline flat fees. If we’re a good fit, we’ll take the next steps. If not, that’s fine too! BOOK HERE