The Credential Graveyard: How Identity Thieves Mine Obituaries and Exploit the Accounts of the Deceased

Death, it turns out, is not the end of one's digital life. For the estimated 2.9 million Americans who die each year, the accounts, passwords, and personal data they accumulated over decades of online activity do not simply dissolve. They persist — on servers, in databases, across platforms — often for years after a person's final breath. And increasingly, that persistence is being exploited by a category of criminal that operates with particular cynicism: the identity thief who targets the dead.

The practice has a clinical name in fraud-prevention circles: ghosting or synthetic post-mortem identity fraud. But the mechanics are straightforward and, in many cases, disturbingly easy to execute.

The Obituary as an Attack Vector

For fraudsters, a published obituary is not a notice of mourning — it is a data package. A well-written death notice typically contains a subject's full legal name, date of birth, hometown, surviving family members, former employers, and sometimes a military branch or church affiliation. That combination of identifiers is precisely what is required to clear the first hurdles of identity verification at financial institutions, government agencies, and account-recovery portals.

Automated scraping tools — the same category of software used by data brokers to harvest publicly available personal information — are routinely deployed against obituary aggregators and local newspaper archives. Researchers at the Identity Theft Resource Center have documented cases in which fraudulent credit applications were filed within 24 to 48 hours of a death notice appearing online. The window between a family's public announcement of a loss and a criminal's first attempt at exploitation can be measured in hours.

The Social Security Administration maintains the Death Master File, a federal database intended to flag deceased individuals and prevent benefits fraud. Financial institutions and credit bureaus are supposed to cross-reference this file, but the process is neither instantaneous nor comprehensive. Smaller creditors, subscription services, and online retailers rarely check it at all. That gap gives fraudsters a workable runway.

What the Underground Marketplace Does With Dead Men's Credentials

Beyond targeted obituary scraping, a more passive pipeline feeds criminal activity: the vast archives of previously stolen credentials that circulate on dark web forums and automated shops. When a major data breach exposes millions of username-and-password combinations, those records do not expire. They are indexed, resold, and tested indefinitely.

For a deceased person, the irony is particularly grim. A living account holder may notice a suspicious login and reset their password. A dead one never will. Credentials belonging to deceased individuals are therefore considered higher-value inventory in certain underground communities, because the account owner will never generate a fraud alert, file a complaint, or answer a verification call. Dormant accounts with no living custodian are, from a criminal's perspective, permanently undefended.

The categories of accounts most commonly exploited post-mortem include:

• Email accounts, which can be used to initiate password resets on linked services
• Loyalty and rewards programs, where accumulated points represent real monetary value redeemable for travel, merchandise, or gift cards
• Online retail accounts with stored payment methods or gift card balances
• Government benefit portals, including Social Security and Medicare accounts, which can be manipulated to redirect payments
• Brokerage and banking accounts, particularly those held at institutions with weak identity-verification protocols

A 2023 report from AARP's Fraud Watch Network noted that tax return fraud in the name of deceased individuals remains one of the most persistent and underreported forms of identity theft in the United States, with the IRS flagging hundreds of thousands of suspicious returns filed using decedents' Social Security numbers annually.

The Notification Gap That Criminals Depend On

One of the structural vulnerabilities that enables post-mortem identity fraud is the absence of any centralized, real-time mechanism for notifying digital service providers of a customer's death. Families are expected to contact each platform individually — a process that can involve dozens of accounts, varying documentation requirements, and response timelines that stretch from days to months.

Major platforms have made incremental progress. Facebook introduced its Memorialization and Legacy Contact features to allow families to designate a trusted individual to manage or memorialize a deceased user's account. Google's Inactive Account Manager permits users to pre-authorize a trusted contact to access or delete their data after a period of inactivity. Apple, following legal pressure, now offers a Digital Legacy program that allows designated contacts to request access to a deceased user's iCloud data.

But these tools are opt-in, rarely configured in advance, and entirely absent from the vast majority of accounts a person holds — financial platforms, subscription services, healthcare portals, and the sprawling ecosystem of smaller accounts that accumulate over a lifetime of internet use.

What Families Can Do: A Practical Framework

The most effective defense against post-mortem identity fraud is preemptive action — taken by the account holder while living, or by family members as quickly as possible following a death.

Before death — digital estate planning:

Individuals should maintain a secure, documented inventory of their accounts, usernames, and passwords, stored in a reputable password manager with a designated emergency-access contact. Several major password managers, including Bitwarden and 1Password, offer emergency-access features that allow a trusted person to request access after a configurable waiting period. This inventory should be referenced in estate planning documents alongside traditional assets.

Immediately following a death:

Families should notify the three major credit bureaus — Equifax, Experian, and TransUnion — and request that a deceased alert be placed on the decedent's credit file. This flags the file and should trigger rejection of new credit applications. A credit freeze can also be applied, which is a stronger form of protection.

The Social Security Administration should be notified as soon as practicable. Funeral homes are legally authorized to report deaths directly to the SSA, and many do so as standard practice — but families should confirm this has occurred.

For financial accounts, direct contact with each institution is required to close or transfer accounts. Executors and estate administrators with appropriate legal documentation — typically Letters Testamentary issued by a probate court — are the authorized parties to make these requests.

Platform-by-platform account management:

Families should work through the deceased's email inbox to identify active accounts and initiate closure or memorialization requests. Most major platforms have a dedicated process for handling deceased-user accounts, accessible through their help centers. Prioritize accounts with stored financial data, active subscriptions, or accumulated rewards balances.

For email accounts specifically, gaining access to the inbox is often the single most important step, as it enables password resets on linked services and prevents criminals from using it as a launchpad for account takeover.

A Vulnerability That Will Only Grow

As the generation of Americans who came of age with the internet moves through its later decades, the scale of post-mortem digital vulnerability will expand substantially. The average American adult today maintains dozens of online accounts. Many of those will outlast their owners by years or decades if no action is taken.

The criminal infrastructure that exploits this vulnerability — automated scrapers, underground credential markets, and fraud rings that specialize in tax and benefits theft — is already mature and well-organized. Awareness, advance planning, and prompt action by surviving family members remain the most reliable countermeasures available. The alternative is leaving a digital door ajar for people who have made a business of walking through it.