Year-End Cleanup: Close or Lock Accounts You No Longer Use
Old email, shopping and social accounts can be taken over and used to impersonate you. Find them, choose keep, lock or close, and back up data before deleting.
Somewhere there is a shopping account from 2014, an email address you used for one job, and a social profile you forgot existed. None of them watch themselves. A quiet December evening is a good time to decide, account by account, what stays open.
A forgotten account is useful to a scammer in a way an active one is not: nobody notices the takeover. An old email address may still be the recovery address for a bank. A dormant social profile with your real name and photo can message your old contacts as you. The cleanup below is not about deleting your whole history. It is about making sure every account that still exists is one you would notice going wrong.
Step 1: Build the list (20 minutes)
You will not remember everything, so use records rather than memory:
- Your password manager or browser’s saved passwords. Export nothing; just scroll the list and write down every site you no longer use. Our 20-minute password manager cleanup pairs well with this step.
- Your email inbox. Search for phrases such as “welcome to,” “verify your email” and “your account.” Sort by oldest.
- “Sign in with Google / Apple / Facebook” lists. Each of these services shows which apps you have signed in to with it.
- Breach notifications. If you have received breach letters, the company named is on your list. Have I Been Pwned, a free third-party service, lets you check where an email address has appeared in known data breaches.
Step 2: Decide keep, lock or close
| Situation | Decision | What that means |
|---|---|---|
| You use it, or it holds money, purchases or records you need | Keep and secure | Unique password, two-step verification, current recovery email and phone |
| Rarely used but tied to something important, such as an old email that is a bank’s recovery address | Keep, then move the dependency | Change the bank’s contact address first, then decide whether to close |
| You might want it someday, but it holds nothing sensitive | Lock down | Unique password, two-step verification, remove saved cards and your address |
| You will never use it again | Close | Download anything you want, remove payment details, then delete through the site’s own settings |
| You can’t sign in and can’t recover it | Report and monitor | Use the site’s account recovery or support form; watch for messages sent in your name |
What happens if you just leave accounts alone
Some providers will eventually close inactive accounts for you, but not quickly, and not everywhere.
An account not used within a 2-year period may be deleted; December 1, 2023 was the earliest date for such deletions (Google).
You must sign in at least once in a two-year period to keep the account active (Microsoft).
A mailbox not accessed for 12 months becomes inactive and its contents are permanently deleted (Yahoo).
Inactivity rules are a safety net, not a plan. Two years is a long time for an unwatched account, many smaller sites have no such policy, and the rules have exceptions: Google’s policy lists cases such as an account holding a gift card balance. A deliberate decision beats waiting.
Step 3: Back up before you close
Deleting is usually permanent. For a Google account, Google Takeout exports your data as a download link or to cloud storage. Google notes that downloading “doesn’t delete it from Google’s servers,” that archives expire after about a week, and that an export can take from minutes to days. Most large services have a similar “download your data” option in their privacy settings; start the export a day before you plan to delete.
Remove saved payment cards and your home address before you close any shopping account. If the closure fails or takes weeks, there is less exposed in the meantime.
Step 4: Close through the site, not a link
Close accounts from inside the site’s own settings, reached by typing the address. Ignore emails offering to “close your account” or “confirm deletion” that you did not request; account-closure notices are an easy phishing story. If a site makes deletion hard to find, its help center usually has a page on deleting your account.
Step 5: Secure what you keep
For every account that survives the cleanup, the FTC’s advice on protecting your personal information applies: passwords of “at least 15 characters,” and multi-factor authentication, because “a hacker who steals your password can’t log in to your account without the second authentication factor.” The FTC notes that authenticator apps and security keys are more secure than codes sent by text.
Update the recovery options at the same time. If your recovery phone number is from two phones ago, a lost device will lock you out. Our guide to preparing account recovery before you need it walks through that.
Step 6: Decide what happens after you
A year-end cleanup is also the moment to name who can reach your accounts if something happens to you. Google’s Inactive Account Manager lets you choose up to 10 people to be notified or receive data if your account is inactive for a period you choose. Apple’s Legacy Contact lets a chosen person access your data after your death with an access key and a death certificate; Apple says it does not include purchased media or iCloud Keychain passwords. With a named contact in place, your family has an official route to your accounts and no reason to pay a stranger who offers to “recover” them.
A short version for a parent’s accounts
If you are helping an older relative, keep it simpler: list the accounts they actually use, make sure each has a working recovery phone and email they control, and close obvious leftovers such as an old internet provider’s email address only after moving anything that depends on it. If their details have appeared in a breach, our 30-minute lock-down plan sets the priorities.
Sources
- Google Account Help: Inactive account policy
- Google Account Help: Inactive Account Manager
- Google Account Help: Download your Google data
- Microsoft: Microsoft account activity policy
- Yahoo Help: Inactive Yahoo Mail mailboxes
- Apple: How to add a Legacy Contact
- FTC: Protect your personal information from hackers and scammers
- Have I Been Pwned: FAQs (third-party service)