How to purge zombie accounts from your online footprint

Thursday, 18 October, 2018

It’s a fact that the internet is riddled with long-forgotten zombie accounts. These are the dormant accounts on social media, dating sites, shopping sites and such that you set up and used just once or twice, before promptly forgetting all about them. And while you never use them anymore, they are still out there – along with your unused logins, passwords and personal info.

With the constant threat of hackers seeking to exploit your data, it might be time to do a little spring cleaning and finally get slay those zombies.

This might, on the face of it, seem a trivial issue but consider the notorious Yahoo breach. Among those three billion accounts hacked many were dormant and proved a goldmine for would-be cybercriminals.

The trouble is that getting rid of those zombie accounts is not as easy as it ought to be.

Firstly, we would all find it difficult to remember all those old accounts. Every shopping site you’ve been on, every social site invited to or event ticketing sites you’ve bought from.

Tracking down a zombie account then involves remembering passwords, email addresses and answering those annoying security questions even if you do still know your favourite movie or pet.

And then this is no guarantee that you can delete the account. For instance, Yahoo refused users to delete their accounts or change identifying data until pressurised to do so following the breach.

A better and more manageable approach is to prioritise the most sensitive accounts. While you can probably safely ignore places where you’ve never entered personal or payment details, there are those others where the information could be damaging to you if it fell into the wrong hands. Dating sites in particular can be a minefield of sensitive data – so perhaps now you’ve found the love of your life, make sure the account is deleted.

Of course, real life tends to get in the way of cyber housekeeping. So, it is a good idea to set aside a time each year to tidy up your zombie presence. Perhaps after a holiday or the end of the tax year.

There are a number of sites that can help. It is always worth regularly visiting ‘Have I Been Pwned’, a free service which allows you to check whether your email address has been compromised in a data breach. Supposedly, the attacked company should have notified you but that is not always the case.

Another useful site is JustDeleteMe – a site which contains a list of common services. Scrolling through them will help identify long-forgotten sites you’d once used.

Some sites though will not let you go. Sometimes this was simply due to a start-up site prioritising other features rather than the ability to delete your account. Others might well be intentional to keep you coming back time and again. Sadly, there is not much you can do with these other than deleting as many posts, photos and other personal data as is possible.

The death of a loved one

Good cyber housekeeping becomes important when it involves someone who has died. Alongside the difficult time of arranging funerals and dealing with their paperwork such as taxes, credit cards and bank accounts there is also their online presence that needs to be dealt with.

For instance, dealing with their social network profiles. If you ignore them then they will continue to be considered active even when the user has passed away. To tackle this growing trend most of the major social networks have implemented policies for dealing with a deceased user’s account.


Facebook offers two standard options. Firstly, you can choose to turn the user’s account in to a memorial page. Doing this Facebook places a Remembering label on it which prevents it showing as an active profile.

To memorialise an account a friend or family member must fill out a Memorialisation Request. You will need to provide proof of the user’s death so that Facebook can investigate and then approve the request.

The other option offered by Facebook is a request to close the account. Facebook will only agree to such requests if they come from a direct family member and asking them to fill out a Special Request for Deceased Person’s Account.

Google and Gmail

There are three options available to you with Google. You can either close the account, submit a request for funds from the account or obtain data from the account. This does not guarantee they will shut down the account, but Google says that they will always carefully review all requests.

Upon request Google will ask you to fill out a form and you will need to send valid proof. Google will then get in touch with you via email to let you know what decision they have arrived at in order to move on to the next step in the process.

In 2013 Google introduced the Inactive Account Manager to help users plan their digital afterlife and is worth checking out.


Twitter currently does not allow access to a deceased user’s account whatever their relationship. But it will accept requests to deactivate the user’s account. To do this Twitter asks for the deceased person’s username and a copy of the death certificate, a copy of a government-issued ID and any other additional data about their death.

To begin the process, you will need to visit the Twitter help page and select ‘I want to request deactivation of a deceased or incapacitated person’s account’ and fill out the form.


To close a PayPal account of a deceased relative will require different documentation depending on whether the person had a will or not. To close down the account, you will need to provide a copy of the will, contact details of the Executor, a copy of government-issued ID, a copy of the death certificate and a copy of the Grant of Probate or letters of Administration if you have it.

Once this is done you then call PayPal to close the account. If there are funds still in the account PayPal may request further paperwork to get at the funds.

Image: CGP Grey

Tim Bamford author picture


Tim is a veteran freelance journalist writing extensively on internet news and cybersecurity.