digital

What to Do With Someone's Email Account

By Jason Su · Updated October 1, 2026

Email is the account that resets all the others. Whoever can read the inbox can reset the bank, the insurance portal, and the password manager — which is exactly why providers guard it harder than anything else you own.

So here is the honest position. You will almost certainly not get the password. What you can do depends on two things: whether the person set something up in advance, and how much paperwork you are willing to file. This guide covers both, plus the deadline most families discover too late.

Why the email account comes first

Every other account you might need to reach — utilities, insurance, subscriptions, the pharmacy — sends its “reset your password” link to one address. That address is the master key.

There is a second reason it comes first: the inbox is the map. Bank statements, policy numbers, renewal notices, and receipts all arrive there. Families who cannot get into the email spend weeks reconstructing an inventory they could have read in an hour.

And a third, which surprises people: if the account had two-factor authentication turned on, the codes are going to a phone that may now be in a drawer, cancelled, or locked. See how to back up two-factor codes for why that wall exists and how it is meant to be pre-empted.

You will not get the password

Say it plainly, because most families start by expecting the opposite: no major provider hands a password to a relative. There are two technical reasons and one policy reason.

The device lock is not recoverable. Apple states that a device with a passcode is protected in a way Apple cannot undo without erasing it — so a locked phone stays locked.

Some of the data is sealed. Apple notes that even when access is granted, some of what is stored cannot be read by Apple at all, and you may still need the device passcode to open it.

The policy is privacy-first by design. Microsoft says plainly that for privacy and legal reasons it generally does not give information to anyone who is not the account holder. (Microsoft Support)

That is not a wall built to frustrate you. It is the same protection that stops a stranger who knows your name from reading your mail. It just means the useful path is the one set up in advance.

The path that works: set it up beforehand

Two providers have a tool for this, and both are worth twenty minutes. Apple calls its version “the easiest, most secure way” to give someone access.

Google — Inactive Account Manager. You choose an inactivity period of up to 18 months, then tell Google what to do when it lapses: send specific files to trusted contacts, turn on a Gmail auto-reply, or delete the account. (Google’s inactive account policy)

Apple — Legacy Contact. You name a person in advance. Apple issues an access key that may sit in your account settings, on a printed sheet, or inside your estate documents. That person later starts a request at Apple’s Digital Legacy site. (Apple Support)

Notice what makes these work: someone decided in advance. No court, no subpoena, no waiting.

So the practical instruction is short. If you are the one organizing things — for yourself or for a parent — set one of these up today, then write down that it exists and where the access key is. The Password Log Sheet is the place for where things are, never for the passwords themselves, and our guide to leaving digital passwords to family covers the conversation around it.

If nothing was set up: what each provider does

This is the harder road, and it differs sharply by company. The table below is drawn from each provider’s own published policy.

Provider	What you can request	What they ask for
Google	The account itself may eventually be deleted for inactivity — see the deadline below. Access to contents is limited.	Google’s published policy centres on its account tools, not on a family request route; the reliable mechanism is Inactive Account Manager, set up in advance
Apple	Access to some data in the account — or permanent deletion of the account	Usually a death certificate, and possibly a court order; requirements vary by country. The court order must name you as the person’s legal inheritor, and only one person can be granted access
Microsoft	Closing the account if you have the sign-in details; contents only through legal process	A valid subpoena or court order — Microsoft must be formally served, and says it cannot respond to requests sent by fax or email. It also says serving a request does not guarantee help

Two details worth pulling out of that table.

Apple’s court order must say who you are. It has to name the person who passed, identify you as the close relative requesting access, and make clear that you are the legal representative or inheritor, so that your consent is lawful consent. Apple also warns that only one person can request access — families who file separately slow themselves down.

Microsoft requires legal process for content, not just a death certificate. In the United States the request goes to Microsoft’s registered agent in your state, and only non-criminal matters are considered.

Google sits between the two. Its published guidance on inactivity is written for the account holder rather than for the family: set a plan up in advance, keep a recovery address current, and export what you want to keep while you still can. Read that as a family member and it tells you something useful — for Google, the route that does not involve a court is the plan set up in advance.

If you are unsure whether an account matters legally, our guide to what actually gives someone access to your accounts explains why a provider’s own settings outrank anything a will says — and what happens to your online accounts covers the wider picture, including which accounts can be memorialised instead of closed.

The deadline nobody notices

Here is the part that costs families real data, and it is entirely avoidable.

Google may delete an account, and everything in it, after two years of inactivity. That includes Gmail, Drive, Docs, Calendar, Meet, and Photos. Google notifies in advance, but only to the account address and the recovery address — both of which may be unreachable.

Microsoft is stricter on a shorter clock. Its published policy says Outlook.com and OneDrive are frozen after one year of inactivity, with email and files deleted soon after, and the account itself expiring after two years.

Neither company is being unkind about this. An account nobody signs into is an account nobody is watching, and Google’s own reasoning is that an abandoned account is at least ten times less likely to have two-factor protection turned on than an active one. That makes it a more attractive target, which is exactly what a family does not need.

So “we will deal with it when things settle down” has a countdown attached. Two things follow:

• Signing in counts as activity. Google counts reading or sending mail, using Drive, using Search, watching YouTube, and even having a paid subscription as activity — and says that Google Photos needs a sign-in specifically to Photos every two years.
• If you want the contents, download them. Google has offered Takeout for exporting your data for over a decade; ask for everything, not just the mail.

If you are the person handling an estate, put a reminder in your calendar now. Opening the account once every few months keeps the data alive long enough to sort it out properly.

What to do in the first two weeks

1. Find out whether anything was set up in advance. Ask about a Legacy Contact, an access key, or an Inactive Account Manager plan. Check the person’s own documents first.
2. Write down the email address and which provider runs it, if you are not sure. On your Digital Account Inventory, one line each.
3. Do not close the account yet. Closing deletes data. Get what you need out first — with an Inactive Account Manager plan, that may mean letting the plan run.
4. Keep the phone number alive if you can. It receives the recovery codes for this and every other account.
5. Download what matters. Statements, policy numbers, tax documents, and any letters the person kept.
6. Tell the other accounts. Once you know what the inbox holds, you know which companies need to be contacted and in what order.
7. Ask the provider which route applies — an advance plan, a family request, or legal process — before you pay anyone to help. The answer decides everything that follows.
8. Record what you learned. Which provider, what you asked for, what they said, and the date. Families often need to ask twice.

What not to do

• Do not expect the password. No provider releases it, for the reasons above.
• Do not close the account in the first week. It feels decisive and it destroys exactly what you came for.
• Do not let it sit for a year. The freeze and deletion clocks are real.
• Do not send a court order by fax or email to Microsoft. It must be formally served.
• Do not file as two relatives at once with Apple. Only one person can be granted access.
• Do not assume the will settles it. Provider terms and their own tools come first — see what actually grants access to an account.

Frequently asked

Can I get into a Gmail or Outlook inbox if the person did not set anything up?

Practically, only in limited situations. Google’s family route is narrow, and Microsoft requires a subpoena or court order for contents in the US. Apple grants access to some data with a death certificate and possibly a court order. In all three cases, the advance setup is the difference between a form and a legal proceeding.

What if I just want the account closed?

That is usually easier than getting the contents — and if you have the sign-in details, both Google and Microsoft let you close the account yourself. Note that Microsoft keeps a 60-day recovery window before permanent deletion, and that closing removes the mailbox other accounts still point at.

Do I need a lawyer?

For access to contents in the United States, often yes — because the path runs through a court order. For closing an account, or for an Inactive Account Manager plan already in place, usually no.

How long do I have?

Less than families assume. One year before Outlook.com and OneDrive freeze, two years before the Google account may be deleted, and a payment or a sign-in can reset both clocks.

Should I keep paying for a subscription on the account?

If the account is otherwise idle, a paid subscription counts as activity for Google — but do not rely on it as your whole plan. Signing in now and then is simpler, and it is free.

Next step

Set up one of the two advance tools today — Inactive Account Manager for a Google account, or a Legacy Contact for an Apple account — and print the access key or write down where it is. Then record the email address and the provider on your Master Checklist so nobody has to guess which inbox was the important one.

This is general information, not legal advice. Provider policies differ by company and by country and change over time — please confirm the current process on the provider’s own help pages and talk with a licensed attorney about your situation.