The email account is the master key

If an executor has access to the deceased's primary email account, a great deal becomes possible. If they do not, a great deal becomes very difficult.

This follows from how account recovery works: nearly every service allows a password reset by email, which means whoever controls the email controls almost everything else.

What the email account provides

Password resets for most other services.

A record of what exists. Searching an inbox for receipts, statements, renewals and welcome messages reveals accounts nobody knew about, frequently including financial ones.

This is the most reliable method of building an inventory of someone's affairs.

Correspondence, including with professionals — the solicitor who holds the will, the accountant, the financial adviser.

Ongoing notifications that reveal subscriptions, insurance renewals, and obligations.

The two-factor complication

An email password alone is frequently insufficient. Providers commonly require a second factor — a code to a phone, an authenticator app, or a security key.

Which means access to the email may depend on access to a phone, which may be locked.

This is the practical chain that most often breaks: locked phone, no phone access, no second factor, no email, no anything else.

What to arrange in advance

The phone passcode, recorded somewhere your executor can find. This single item unlocks more than anything else.

Backup codes for two-factor authentication, stored in a password manager or with your other documents. Most services generate a set of one-time codes for exactly this situation and almost nobody saves them.

An inactive account or legacy contact setting, where the provider offers one. Several major email providers do, allowing you to nominate someone to receive access or specified data after a defined period of inactivity.

This is the properly sanctioned route and it takes ten minutes to configure.

The email password in a password manager with emergency access configured.

The legal position on accessing someone's email

Genuinely uncertain, and it varies.

Provider terms generally prohibit sharing credentials and account transfer. Executors requesting access are frequently refused, and providers cite user privacy and their terms.

Some jurisdictions have legislation addressing fiduciary access to digital assets, which typically gives executors access to some categories subject to the deceased's expressed wishes.

Data protection law adds complexity, since the account contains correspondence with living people.

In practice, families with the credentials log in, and this happens constantly. It is worth knowing that it may breach terms of service and, in some jurisdictions, may raise questions under computer misuse legislation — particularly for financial accounts.

The sanctioned routes — legacy contact settings, provider bereavement processes — are slower and are legally cleaner.

The privacy question nobody wants to discuss

An email account is the most complete record of a person that exists.

It contains correspondence they would not have shown anyone, financial details, medical information, and things about other people.

Families who gain access read it. Sometimes they find things they wish they had not — affairs, debts, opinions about them, arrangements they knew nothing about.

Two implications.

If there is material in your accounts you would not want read, deal with it now. Delete it, or accept that it will be seen.

If you are an executor with access, consider limiting yourself to what the estate requires. Reading a decade of personal correspondence is not part of the job, and people have been damaged by what they found.

Practical steps for an executor

Do not close the account early. Keep it active for at least a year. Notifications arrive over months — annual renewals, tax correspondence, dividend statements.

Search systematically. Terms like statement, invoice, receipt, renewal, policy, account, welcome, subscription, and the names of major institutions.

Set up forwarding to your own address if the provider permits it, so that anything arriving later is captured.

Note what you find in a single document, so that the inventory is in one place.

Watch for fraud. Deceased people's identities are targeted, and a compromised email account is the route in. Change the password if you can, enable two-factor authentication, and be alert to unusual activity.

Registering the death with services that reduce identity fraud risk is worth doing where such services exist.

The one-line summary

Record your phone passcode and your email credentials somewhere your executor can find them, and set up the legacy contact feature on your email account.

That takes twenty minutes and it is the highest-value digital preparation available.

Legal rights of executors to access email accounts differ by jurisdiction and by provider terms. Consult a qualified adviser about your specific situation.