Checklist · Wills and Estates

Inventorying and Transferring Digital Assets After Death: A Practical Checklist

18 U.S.C. § 1030

Type: Checklist
Jurisdiction: National
Date: 2024-03-26
Topic: Wills and Estates

This checklist takes an executor, trustee, or agent from the first hours after a death or incapacity through the recovery, preservation, and transfer of digital assets, in eight phases. Phase 1 covers the three preservation steps that must happen immediately and are irreversible if missed — keep the phone number, preserve the devices, and stop any deletion timers — and Phase 2 builds the inventory from the records actually available, including the bank-statement review that reveals accounts nobody remembered. Phase 3 determines the governing authority by working the three-tier hierarchy in which a platform's own online tool outranks the will. Phase 4 assembles the documentation custodians require and submits requests that use the statute's own vocabulary, and Phase 5 covers the court petition needed for content where no direction exists, including the specificity that separates granted petitions from denied ones. Phase 6 addresses cryptocurrency, where legal authority is irrelevant to self-custodied assets. Phases 7 and 8 cover valuation, transfer, closure, and protecting the decedent's identity after death. Model request and petition language, an authorities table, and a ranked failure-mode list are included.

Inventorying and Transferring Digital Assets After Death: A Practical Checklist

Wills and Estates > Digital Assets | Published 26 March 2024 - Updated 10 March 2025 | UpLaw - uplaw.us

Three things in the first week are irreversible if missed: the phone number, the devices, and the deletion timers. Everything else in this checklist can be done later; those cannot.

Keywords: preservation, inventory, three-tier hierarchy, custodian requests, court order for content, private keys, domains, deceased alert

How to use this checklist

Phases run in order, and Phase 1 runs immediately. Under each are - [ ] items and a Why it matters, and the traps note. A running hypothetical — Theo Achterberg (fictional), executor for his mother's largely digital estate — makes it concrete.

Doctrine is in Digital Assets in Estate Planning and Administration: A Comprehensive Guide to RUFADAA and Beyond. The narrative introduction is Who Gets the Password? Digital Assets, Online Accounts, and the Estate You Left in the Cloud. The resource map is The Digital Estate and Online Account Toolkit.

Phase 1 — Preserve, in the first week

[ ] Do not cancel the mobile service. Keep the number active for at least six months.
[ ] Do not reset any device. Collect phones, tablets, and computers and store them charged.
[ ] Do not factory-reset, wipe, or return leased devices to a carrier.
[ ] Locate two-factor backup codes — usually printed and filed with important papers.
[ ] Identify any password manager and whether an emergency contact was designated.
[ ] Check for inactive-account timers on major platforms and stop them where possible.
[ ] Photograph or export anything already accessible on an unlocked device.
[ ] Secure physical items that store keys: hardware wallets, printed seed phrases, safe deposit contents.
[ ] Do not log in using the decedent's saved credentials.

Why it matters, and the traps. The phone number is the recovery channel for a large share of accounts; cancelling it converts solvable problems into permanent ones. A factory reset destroys authenticator applications and saved credentials irretrievably.

The instruction not to log in is genuine, not defensive. Unauthorized access implicates 18 U.S.C. § 1030 and 18 U.S.C. § 2701 and breaches the terms of service. It rarely matters in a harmonious family; it matters a great deal where relatives are in conflict, where the account is a business account, or where anything is used to move money.

Worked example. Theo keeps his mother's phone line active, collects her laptop and phone without resetting either, and finds her two-factor backup codes in the folder with her passport.

Phase 2 — Build the inventory

[ ] Check for an existing inventory or letter of instruction.
[ ] Review paper and electronic mail for account confirmations and renewal notices.
[ ] Review the last two years of bank and card statements for recurring charges — every subscription is an account.
[ ] Review tax returns for income sources that imply accounts.
[ ] List: email, cloud storage, financial portals, business platforms, social accounts, subscriptions, domains, cryptocurrency, loyalty programs.
[ ] Note the provider, the login identifier, and the apparent significance of each.
[ ] Identify accounts that are licences and will simply terminate.
[ ] Identify accounts holding owned files worth preserving.
[ ] Identify the accounts that are the index to the estate.
[ ] Note domain renewal dates.

Why it matters, and the traps. In a paperless household the email account is the index to everything, and the fiduciary who cannot read it frequently cannot identify the assets at all.

The bank-statement review is the single most productive step for a fiduciary with no inventory: recurring charges reveal accounts nobody remembered, including the ones still billing.

Phase 3 — Determine the governing authority

[ ] Check each platform for an online tool direction — legacy contact, inactive account manager. Tier 1 controls.
[ ] Read the will, trust, and power of attorney for a digital-asset provision. Tier 2.
[ ] Read the platform's terms of service. Tier 3, and the default limits you to catalogue.
[ ] Determine whether the instrument authorizes content or only catalogue.
[ ] Note any conflict between a tool direction and the instrument — the tool wins.
[ ] Identify the state's RUFADAA enactment and its section numbers.
[ ] Note the custodian's compliance period, commonly sixty days.

Why it matters, and the traps. The hierarchy is counterintuitive and decisive: a checkbox set years ago in a settings page overrides a professionally drafted will. A decedent whose will grants full access and whose inactive-account setting directs deletion has instructed the platform to delete.

Determine this before submitting requests, because it dictates what you ask for and whether a court order will be necessary.

Worked example. Theo's mother designated a legacy contact on her photo service — Tier 1, and it controls. Her will is silent on digital assets, so for email he is limited to the catalogue and will need a court order for content.

Phase 4 — Submit custodian requests

[ ] Obtain certified death certificates — order ten.
[ ] Obtain certified letters testamentary or letters of administration, or a certified copy of the trust or power.
[ ] Use each platform's dedicated deceased-user process, not general support.
[ ] In each request: cite the state RUFADAA section; specify catalogue or content; and state the basis for content.
[ ] Attach the instrument, quoted, where it authorizes content.
[ ] Ask the closed question: what documentation would suffice, and would an order in this form satisfy you?
[ ] Diary the compliance period and escalate in writing if it passes.
[ ] Request an archive download where offered — frequently the fastest route to the material families actually want.

Why it matters, and the traps. General support channels loop for months; the dedicated processes work. Citing the statute by section reaches a compliance team; a general request reaches a script whose default is refusal.

The closed question is the technique that changes outcomes. "Will you give me access" invites a no; "will an order in the attached form satisfy your requirements" invites a checklist.

Phase 5 — Petition for content where required

[ ] Confirm no Tier 1 or Tier 2 direction supplies consent.
[ ] Draft a petition establishing appointment, the account's existence, and the specific necessity.
[ ] Quantify the necessity: unidentified receivables, unlocatable assets, unknown creditors, tax records.
[ ] State the absence of a contrary direction by the decedent.
[ ] Attach the custodian's correspondence identifying what it requires.
[ ] Serve the custodian if the statute or the court requires it.
[ ] Deliver the entered order to the custodian promptly.

Why it matters, and the traps. RUFADAA permits a court to order content disclosure where the user consented or where disclosure is reasonably necessary for administration. A conclusory petition seeking "access to the decedent's email" is frequently denied; one stating that approximately $14,000 in receivables is recorded nowhere else is usually granted.

Phase 6 — Cryptocurrency

[ ] Determine whether holdings are custodial (an exchange) or self-custodied (a private key).
[ ] For custodial: use the exchange's estate process, which resembles a brokerage transfer.
[ ] For self-custodied: locate the seed phrase or hardware wallet — safe deposit box, safe, filing cabinet, password manager.
[ ] Do not transfer anything until a receiving wallet is secured and controlled by the fiduciary.
[ ] Value holdings at date of death for estate purposes — 26 U.S.C. § 2031.
[ ] Document the chain of custody of any key material.
[ ] If no key can be found, document the search and report the asset as unrecoverable.

Why it matters, and the traps. For self-custodied assets, the fiduciary's legal authority is irrelevant. No order moves a blockchain, and a lost key is a permanently lost asset. Exchanges are custodians subject to financial-institution definitions at 31 U.S.C. § 5312 and will process an estate request.

Document the search thoroughly. A beneficiary who later believes the fiduciary was careless with a six-figure asset will ask what was done.

Phase 7 — Value, transfer, and close

[ ] Value assets with economic worth: domains, monetized accounts, code repositories, catalogues of original work.
[ ] Identify copyright in original works, which is itself an estate asset — 17 U.S.C. § 201, 17 U.S.C. § 106.
[ ] Transfer domains through the registrar's process; renew before expiry.
[ ] Preserve archives to at least two independent locations before deleting anything.
[ ] Cancel subscriptions to stop recurring charges.
[ ] Memorialize or close social accounts per the family's wishes and any direction by the decedent.
[ ] Distribute copies of sentimental material to beneficiaries.
[ ] Retain the estate's own records of what was accessed and transferred.

Why it matters, and the traps. A lapsed domain is gone and immediately re-registrable by anyone; renewal is the cheapest preservation step available. Preserve before deleting: a deletion request is irreversible and archives sometimes fail to download completely.

Phase 8 — Protect the identity

[ ] Notify the three credit bureaus and request a deceased alert.
[ ] Notify the Social Security Administration and any benefit-paying agency.
[ ] Close or freeze credit accounts.
[ ] Notify the state motor vehicle agency and voter registration.
[ ] Monitor for new accounts opened in the decedent's name.
[ ] Retain documentation of every notification.

Why it matters, and the traps. A decedent's identity is attractive precisely because nobody is monitoring it. Consumer-report access rules are at 15 U.S.C. § 1681b and the dispute machinery at 15 U.S.C. § 1681i. See Disputing a Credit Report Error and Defending a Debt Collection Suit: A Practical Checklist.

Model language

A. Custodian request

"I am the duly appointed [Executor] of the Estate of [Decedent], who died [date]. Enclosed: certified death certificate, certified Letters, and my identification. The account is [identifier].

Pursuant to [State RUFADAA citation], I request (1) the catalogue of electronic communications and (2) the content of electronic communications. As to content, [the decedent expressly consented in Article [x] of the Will, a certified copy of which is enclosed / no online tool direction exists and I request that you identify the documentation you require].

Please confirm receipt and advise whether a court order finding disclosure reasonably necessary for administration would satisfy your requirements."

B. Petition allegations for content

"The decedent operated a consulting practice invoiced exclusively through the subject email account. Approximately $14,000 in receivables remains outstanding, and the identities of the debtors are recorded nowhere else in the decedent's records. The custodian has advised that it will disclose content upon an order under [statute]. The decedent gave no direction through an online tool and no contrary direction in any instrument. Disclosure of content is reasonably necessary for administration of the estate."

C. Instruction to the family

"Please do not cancel [decedent]'s phone number, reset any device, or delete any account. Please gather any printed codes, written passwords, or hardware devices and give them to me. I will be requesting access through each company's own process, which takes time but avoids problems later."

Authorities at a glance

Authority	What it supplies
18 U.S.C. § 2701	Disclosure prohibition; lawful-consent exception
18 U.S.C. § 2510	Definitions; interception
18 U.S.C. § 1030	Unauthorized access
hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985 (9th Cir. 2019)	Authorization analysis
17 U.S.C. § 201 · § 106 · § 101	Copyright as an estate asset
26 U.S.C. § 2031	Date-of-death valuation
31 U.S.C. § 5312	Exchanges as financial institutions
15 U.S.C. § 1681b · § 1681i	Consumer report access and disputes
45 C.F.R. part 164	Health information in patient portals
15 U.S.C. § 7001	Electronic records generally

Failure modes, ranked

Cancelling the mobile number in the first month.
Resetting a device, destroying authenticator apps and credentials.
Missing an inactive-account timer that deletes material during administration.
Logging in with the decedent's password instead of using the platform process.
Submitting to general support rather than the deceased-user process.
Not citing the statute, so the request never reaches a compliance team.
A conclusory court petition, denied for want of specific necessity.
Deleting before preserving, irreversibly.
Letting a domain lapse.
Failing to document the search for a private key.
Skipping the deceased alert, leaving the identity unmonitored.
Never reviewing bank statements for recurring charges, and missing half the accounts.

Three administrations, worked

The paperless consultant

Twenty-two years of photographs in a cloud service, a practice invoiced entirely by email with $14,000 outstanding, a domain six weeks from expiry, $60,000 at a cryptocurrency exchange, and tax records in a portal.

What worked: the phone line kept active; devices collected unreset; the photo archive released immediately because a legacy contact had been designated; the exchange processed the crypto like a brokerage transfer; the domain renewed in week two.

What required a court order: the email content, because the will was silent. Granted in eleven weeks on an affidavit quantifying the receivables. Cost: about $2,400.

What could not be recovered: the digital media library, a non-transferable licence.

The self-custodied wallet with no plan

A decedent held roughly $180,000 in a hardware wallet. No seed phrase was found in the safe, the safe deposit box, the filing cabinet, or the password manager. The family searched for eight months.

The asset is gone. Not difficult — gone. The fiduciary's remaining obligation is to document the search thoroughly, report the asset as unrecoverable, and address the estate tax treatment of an asset that exists on a public ledger and cannot be reached. This is the single most consequential planning failure in the field and it has no legal remedy.

The small estate with no will

A parent dies intestate with modest assets and a phone full of photographs. The adult child, acting without counsel, does three things right and one thing wrong.

Right: keeps the phone number; does not reset the device; uses each platform's deceased-user process with a death certificate.

Wrong: logs into the email account with a saved password to look for insurance policies. Harmless in this family and technically a problem under 18 U.S.C. § 2701 and 18 U.S.C. § 1030 — and a genuine risk had a sibling objected.

The better route: where the state offers a small-estate affidavit procedure, that affidavit frequently satisfies a custodian's documentation requirement in place of formal letters. Ask before assuming a full probate is necessary. Self-representation resources: Representing Yourself in Civil Court: A Comprehensive Guide for Self-Represented Litigants.

A one-page brief for the family

Give this to relatives in the first week; it prevents most of the irreversible mistakes.

Do not cancel the phone. It is the key to almost every account. Six months minimum.

Do not reset or wipe any device, and do not return a leased phone to the carrier.

Do not delete anything, including accounts that seem trivial. Deletion is irreversible and some accounts hold the only copy of something.

Do not log in as the deceased person. Use each company's own process for a deceased user. It is slower and it avoids a real legal problem.

Do gather any printed passwords, backup codes, hardware wallets, or written notes, and give them to the executor.

Do tell the executor about accounts you know of — a subscription, a storage unit portal, a photo-sharing group. The executor cannot request what they do not know exists.

Do be patient. Platform requests take weeks to months, and a court order takes longer. Nothing is lost by the delay so long as the first four instructions are followed.

The parallel checklist: doing this before it is needed

Every phase above is a response to a failure of planning. The prevention takes an afternoon.

[ ] Set a legacy contact or inactive-account manager on email, cloud storage, and the main social account. This is Tier 1 and it outranks a will.
[ ] Confirm what each tool actually does — release an archive, delete the account, or notify a person — because a deletion setting will be honored over a contrary will provision.
[ ] Add a digital-asset authorization to the will, the trust, and the power of attorney, expressly covering the content of electronic communications.
[ ] Write the inventory: accounts and login identifiers by category, no passwords.
[ ] Note whether an online tool has been set on each, and to what.
[ ] Record the mobile carrier and account, the devices and how to unlock them, and where the two-factor backup codes are.
[ ] Record domain renewal dates.
[ ] Put credentials in a password manager with a tested emergency-access feature, or a sealed record in a safe deposit box with documented access authority.
[ ] Never put a password or seed phrase in a will, which becomes a public record.
[ ] For self-custodied cryptocurrency, design a recovery mechanism and test it with a trivial amount.
[ ] Write a short note of wishes: what to delete, what to preserve, who should receive the photographs.
[ ] Tell one person where the inventory is.
[ ] Update annually, alongside the beneficiary-designation review.

Why the annual update matters. Accounts multiply, providers change their tools, and a three-year-old inventory is roughly half an inventory. Pairing the review with an existing annual task is the only version of this that actually happens.

The drafting side is covered in Drafting a Will: A Practical Checklist and Executing a Durable Power of Attorney and Advance Directive: A Practical Checklist.

Inventorying and Transferring Digital Assets After Death: A Practical Checklist

How to use this checklist

Phase 1 — Preserve, in the first week

Phase 2 — Build the inventory

Phase 3 — Determine the governing authority

Phase 4 — Submit custodian requests

Phase 5 — Petition for content where required

Phase 6 — Cryptocurrency

Phase 7 — Value, transfer, and close

Phase 8 — Protect the identity

Model language

A. Custodian request

B. Petition allegations for content

C. Instruction to the family

Authorities at a glance

Failure modes, ranked

Three administrations, worked

The paperless consultant

The self-custodied wallet with no plan

The small estate with no will

A one-page brief for the family

The parallel checklist: doing this before it is needed

Related Documents