Passkeys: The Password Replacement Problem
Passkeys are the future of login security — and a new headache for estate planning.
Apple, Google, and Microsoft are all pushing passkeys as the default way to sign in.
What Is a Passkey?
A passkey is a cryptographic key pair stored on your device. Instead of typing a password,
your device proves your identity using biometrics (fingerprint, face) or a PIN.
It's more secure than passwords and immune to phishing.
The Estate Planning Problem
- Device-bound: Passkeys are tied to the device where they were created. You can't write them down.
- No "master password": Unlike a password manager, there's no single key that unlocks everything.
- Platform-specific: Apple passkeys live in iCloud Keychain. Google passkeys live in Google Password Manager. They're not interchangeable.
- Executor confusion: Your digital executor may not understand why the password list doesn't work anymore.
What You Can Do
- Use a password manager that supports passkeys. Bitwarden and 1Password can store and sync passkeys across devices. Your executor only needs access to the password manager.
- Keep a hardware security key as backup. YubiKeys and similar devices can store passkeys and work across platforms. Leave one in your safe with instructions.
- Don't rely solely on device-bound passkeys. If your passkeys only exist on your iPhone and your executor can't unlock it, they're stuck.
- Document which accounts use passkeys. Your inventory should note "passkey login" so your executor knows not to look for a password.
If you use passkeys today, ask yourself: If I died tomorrow and my phone was locked,
could my executor access my bank account? If the answer is no, you need a backup plan.
AI Accounts: The New Asset Class
Six months ago, AI accounts barely registered as an estate planning concern.
Now millions of people have paid subscriptions, custom projects, and years of conversation history
with ChatGPT, Claude, Gemini, and others.
What's at Stake
- Paid subscriptions — ChatGPT Plus, Claude Pro, Copilot Pro — ongoing monthly charges
- Custom GPTs and projects — AI tools you've built or customized for personal or business use
- Conversation history — years of personal questions, health concerns, financial discussions, and creative work
- API keys and integrations — if you've connected AI services to other apps or workflows
The Problem: No Legacy Policies
As of 2026, most AI platforms have no formal policy for deceased users:
- OpenAI (ChatGPT): No legacy or inheritance feature. Account closure requires contacting support; data access is unclear.
- Anthropic (Claude): No legacy feature. Standard account recovery processes apply.
- Google (Gemini): Covered under Google's Inactive Account Manager, but AI-specific data (conversations, custom models) may not be fully included.
- Microsoft (Copilot): Falls under Microsoft's Next of Kin process, which is slow and requires a death certificate.
What You Can Do
- Include AI accounts in your inventory. List the service, subscription level, and what it contains.
- Decide what you want done. Should conversation history be preserved, deleted, or transferred?
- Export important conversations. Most AI services let you export chat history — do this periodically for anything you want preserved.
- Cancel subscriptions promptly. Make sure your executor knows to cancel paid AI services to avoid ongoing charges.
- Don't store sensitive information in AI chats. Treat AI conversations like unencrypted email — assume someone else may eventually read them.
Smart Home & IoT: Digital Keys to Physical Spaces
Smart home devices were an afterthought in older estate planning guides.
Now they're critical — your executor may literally need digital access to enter your home.
Devices That Matter
- Smart locks — August, Yale, Schlage. Without the app or account, no one can unlock the door.
- Security systems — Ring, Nest Secure, SimpliSafe. Monitoring, cameras, and alarms may need to be transferred or shut down.
- WiFi router — Every other device depends on this. If your executor can't access the router, they can't reset or manage anything else.
- Smart thermostats, lights, garage doors — May seem minor, but they affect property maintenance and utility costs.
- Voice assistants — Alexa, Google Home. Contain shopping history, recordings, and smart home controls.
What You Can Do
- List every smart device in your inventory, including the app and account used to control it.
- Keep a physical backup. Many smart locks still have a physical key override. Keep a key in your safe.
- Share WiFi credentials. Your executor needs the WiFi password to connect devices or set up new ones.
- Document how to reset devices. If account access fails, a factory reset may be the only option. Write down the process.
- Consider a "smart home will." A separate document listing devices, accounts, and reset procedures.
Real scenario: A family member passes away. The house has a smart lock and Ring doorbell.
The executor doesn't have the app passwords. They can't enter the house to secure it,
and the Ring cameras keep recording and billing the deceased's credit card.
Don't let this happen to your family.
Ghost Scams: Post-Mortem Identity Theft
Scammers increasingly target the identities of deceased people.
It's easier than you might think — death records are public, and dormant accounts are vulnerable.
How It Works
- Scammers monitor obituaries, social media, and public death records
- They use the deceased's information to take over dormant social media accounts
- They apply for credit cards, loans, or tax refunds in the deceased's name
- They clone social media profiles to scam the deceased's friends and family
- They exploit accounts that were never closed — especially those without legacy contacts
How to Protect Against It
- Close or memorialize accounts promptly. The longer an account sits dormant, the more vulnerable it is.
- Notify credit bureaus. Experian, Equifax, and TransUnion can flag the deceased's credit file to prevent new accounts.
- Cancel driver's license and voter registration. Reduces opportunities for identity misuse.
- Monitor for unexpected bills or collection notices. These can be early signs of post-mortem fraud.
- Limit personal details in obituaries. Avoid full birth dates, addresses, or mother's maiden name.
The best defense: A complete inventory and a tech-savvy digital executor who can
start closing accounts within days, not months.
RUFADAA: What the Law Actually Covers
The Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) has been adopted by nearly all U.S. states.
It sounds helpful — and it is — but the protections are more limited than most people realize.
What RUFADAA Does
- Gives your executor legal authority to access your digital assets
- Requires tech companies to comply with valid requests from fiduciaries
- Provides a legal framework that didn't exist before
What RUFADAA Does NOT Do
- Does not guarantee access to content. In most cases, your executor gets a "catalog" (list of accounts and dates) but not the actual emails, messages, or photos.
- Does not override platform terms of service. If a platform's policy says no access, RUFADAA may not help.
- Does not apply if you haven't named a digital executor. Your regular estate executor may have limited authority without explicit documentation.
- Does not speed up the process. Death certificates, court orders, and platform reviews still take weeks or months.
What This Means for You
RUFADAA is a safety net, not a solution. The best approach is still:
- Use platform legacy tools (Google Inactive Account Manager, Apple Legacy Contact, etc.)
- Give your executor direct access through a password manager or secure document
- Name a digital executor explicitly in your will
- Don't rely on the law alone — it's too slow and too limited