Digital Estates, Unguarded: The Cybersecurity Crisis No One Plans For

American families spend considerable time and money preparing for the transfer of physical assets after death. Wills are drafted. Trusts are established. Beneficiaries are named on retirement accounts and life insurance policies. Yet for the vast majority of households, the digital dimension of an estate receives no planning whatsoever — and the consequences of that omission are increasingly severe.

A person who passes away in 2025 leaves behind a remarkably complex digital footprint. Email accounts spanning decades of personal and financial correspondence. Cloud storage containing sensitive documents, photographs, and scanned identification. Online banking portals with linked payment methods. Social media profiles with years of behavioral data. And in a growing number of cases, cryptocurrency wallets holding assets that may be permanently inaccessible — or worse, permanently vulnerable.

Cybercriminals have recognized this gap. The digital accounts of deceased individuals represent a particularly attractive target: they are often left unmonitored for extended periods, the legitimate account holders cannot report unauthorized access, and grieving family members navigating unfamiliar systems are susceptible to social engineering tactics that might not succeed against a more alert target.

How Attackers Identify and Exploit Deceased Accounts

The process begins, in many cases, with publicly available information. Obituaries published online — on funeral home websites, local news platforms, and social media — frequently contain enough biographical detail to answer common account security questions. A person's full name, date of birth, hometown, surviving family members' names, and prior employer are often included as a matter of tradition. For a criminal, that is a ready-made social engineering profile.

Armed with this information, attackers may attempt account recovery on email platforms, financial institutions, or social media networks, using the deceased's personal details to bypass security challenges. They may also target surviving family members directly, impersonating banks, government agencies, or estate attorneys to extract account credentials or sensitive financial information.

In more sophisticated operations, criminals monitor obituary postings specifically to time their attacks during the window between a person's death and the moment when family members or estate executors gain formal control of digital accounts. That window — which can span weeks or even months in the absence of proper documentation — is when exposure is greatest.

The Executor's Dilemma

Legal executors of a deceased person's estate face a genuinely difficult situation when it comes to digital assets. The laws governing access to a deceased person's digital accounts vary significantly by state and by platform. Federal statutes, including the Stored Communications Act, have historically complicated the ability of even authorized family members to access email accounts or cloud storage without specific legal authorization.

Many executors, lacking technical expertise, turn to family members or friends for help navigating these systems. This informal process creates its own vulnerabilities. Shared passwords communicated verbally or via text message, account credentials written on physical notes and passed between multiple parties, and the use of personal devices to access sensitive accounts all introduce risk that a more structured process would eliminate.

Cryptocurrency presents a unique and potentially irreversible problem. Unlike traditional bank accounts, which can be accessed by authorized parties through proper legal channels, cryptocurrency wallets are secured by private keys that exist outside any institutional framework. If those keys are not documented and stored securely before death, the assets they protect may be permanently inaccessible. Conversely, if they are documented carelessly, they become an extraordinarily valuable target.

The Social Engineering Dimension

Grieving family members are not only targets for technical attacks. They are prime targets for manipulation. Scammers routinely monitor obituaries to identify surviving spouses and adult children, then contact them posing as creditors, government representatives, or financial advisors. The emotional vulnerability associated with bereavement makes these individuals more susceptible to urgency-based pressure tactics.

A common scheme involves a fraudulent call or email claiming that the deceased held an outstanding debt or unpaid tax liability, and that immediate payment is required to prevent legal action against the estate. Another variant involves fake notifications from financial institutions claiming that account access must be verified immediately to prevent asset freezing. In both cases, the goal is to extract account credentials, financial information, or direct payment.

Preparing a Digital Estate Before Crisis Strikes

The most effective protection against these threats is advance preparation — specifically, the creation of a comprehensive digital estate plan that addresses cybersecurity as seriously as it addresses legal and financial concerns.

Create a secure digital asset inventory. Document every account that holds financial value or sensitive personal information: email addresses, cloud storage services, financial platforms, social media accounts, and any cryptocurrency holdings. Include usernames, associated email addresses, and instructions for account access or recovery. This document should be stored securely — encrypted, and accessible only to a trusted designee.

Designate a digital executor. Some states now formally recognize the role of a digital executor — a person specifically authorized to manage digital assets after death. Even where formal recognition does not exist, naming a trusted individual and providing them with the documentation necessary to act on your behalf is a meaningful protective measure.

Use platform-provided legacy tools. Google's Inactive Account Manager, Apple's Digital Legacy program, and Facebook's Memorialization Settings all provide mechanisms for designating what happens to your accounts after death. These tools are underutilized but represent a direct line of defense against unauthorized access.

Store cryptocurrency recovery information with appropriate security. Private keys and seed phrases should be documented and stored using the same rigor applied to a physical will — ideally in a secure location with limited access, and with clear instructions provided to a designated trustee.

Brief your family on common post-death scams. Awareness is a meaningful deterrent. Family members who know that obituary-based fraud exists are better equipped to recognize and resist it during a period when their defenses are naturally lowered.

Norton's identity protection and monitoring services can play a meaningful role in this context, providing ongoing surveillance of personal information and alerting designated contacts when sensitive data associated with an estate appears in unauthorized contexts.

A Gap That Demands Attention

The legal and financial professions have spent decades refining their approach to estate planning. The cybersecurity profession has only recently begun to engage with the same questions. The gap between those two disciplines is where criminals currently operate.

Preparing a digital estate is not a morbid exercise. It is an act of protection — for the assets you have accumulated, for the people you leave behind, and for the privacy of a lifetime's worth of personal information. The planning that most Americans have deferred is exactly the planning that cybercriminals are counting on never happening.