Two-Factor Authentication After Death: What Families Need
Two-factor authentication is one of the best things you can do for account security. It protects email, banking alerts, cloud storage, social media, business tools, and password managers from the oldest account takeover problem: someone gets the password and walks in.
That protection matters. CISA describes multifactor authentication as a layered approach that requires two or more credentials before access is granted. In plain terms, the password alone should not be enough.
But digital estate planning adds a second question: what happens when the person who controls the second factor dies, loses capacity, or cannot respond?
This is where two-factor authentication after death becomes practical, not theoretical. The problem is usually not that MFA is bad. The problem is that the second factor often lives in one person's pocket, on one phone number, inside one authenticator app, or on one hardware key.
If nobody knows the recovery path, a secure account can become a locked account.
Keep MFA On, But Plan The Recovery
The wrong lesson is "turn off two-factor authentication so my family can get in later."
That makes accounts easier for criminals, scammers, and opportunistic relatives to reach during life. It also increases risk during illness, travel, and the early weeks after death, when identity theft and account confusion can rise.
The better lesson is: keep MFA on, but document the second factors that matter.
Your plan should tell a trusted person which accounts use MFA, which method each account uses, where fallback codes or devices are stored, and what legal authority or provider process may be required.
That does not mean handing over live access today. It means creating a controlled path for the right person at the right time.
The Accounts To Review First
Do not begin with every app on your phone. Start with accounts that unlock other systems or carry major value.
Priority accounts usually include:
- primary email
- mobile phone and carrier account
- password manager
- cloud storage and photo libraries
- banking, brokerage, tax, and payment portals
- device accounts such as Apple, Google, and Microsoft
- domain registrars, hosting, and business tools
- accounts that receive billing, legal, or insurance notices
These are the accounts where MFA failure can slow down everything else. If the executor cannot reach the primary email, they may not see financial notices. If the family cannot reach the phone account, text-message codes may disappear. If nobody can unlock the password manager, every other account becomes harder.
Recovery Codes Are Not Junk Mail
Many services let users create backup or recovery codes. They are easy to ignore because they look like technical clutter. In estate planning, they can be the difference between a clear recovery path and a long provider dispute.
Google says backup codes can be used when someone cannot sign in with normal 2-Step Verification. Google also says each used backup code becomes inactive and that creating a new set makes old codes inactive.
Microsoft uses a different model. Its recovery code is a 25-digit code intended to help regain access if a password is forgotten or an account is compromised. Microsoft says creating a new recovery code makes previous codes stop working.
The planning lesson is simple: recovery codes are sensitive, perishable, and account-specific.
Store them as carefully as you would store a master password or important legal document. A secure estate binder, safe, attorney-held packet, or password manager emergency plan can work. A loose screenshot in a photo library is weaker because the person who needs it may not know it exists, and the person who should not have it may find it too early.
Trusted Devices Can Be The Real Key
For many families, the most important second factor is not a code printed on paper. It is the account owner's phone or laptop.
Apple says Apple Account two-factor authentication can require both the password and a verification code from a trusted device or trusted phone number. It also explains that account recovery can take several days or longer when a user cannot sign in or reset a password.
That delay may be reasonable for security, but it can be painful during estate administration. A family may need photos, insurance records, email, subscription details, or billing information quickly.
Your plan should identify trusted devices. It should say where the main phone, tablet, laptop, hardware security keys, and recovery paperwork are kept. If device access is appropriate under your estate plan and local law, explain the practical steps. If some devices or accounts should remain private, say that too.
Do not assume "my spouse knows my phone" is enough. Phones are replaced, passcodes change, and biometric unlock may not work after death. The plan needs to survive ordinary device churn.
Authenticator Apps Need Their Own Notes
Authenticator apps are easy to forget because they feel invisible. You open an app, read a six-digit code, and move on.
After death, that app may be the only second factor for important accounts. If it is locked to one phone, and the phone cannot be unlocked, a helper may need to use recovery codes or provider recovery. If the authenticator app supports cloud backup or multi-device use, the plan should say which account controls that backup.
Record the app name and where it lives. Examples include Google Authenticator, Microsoft Authenticator, Authy, Duo, a password manager's built-in authenticator, or a workplace-managed app. For business accounts, document who the administrator is and whether there are emergency admin accounts or break-glass procedures.
This matters especially for founders, creators, and small business owners. One lost authenticator app can block payment systems, ad accounts, hosting, domain renewals, social media pages, and customer support tools.
Phone Numbers Are Fragile
Text-message codes are common, but phone numbers are not permanent estate assets. A number can be cancelled, transferred, ported, suspended, or locked behind the carrier account.
If a key account depends on SMS codes, document the phone number, the carrier, the account holder, and what should happen to the phone line after death. Families often rush to cancel mobile service to stop bills. That can accidentally destroy the only second factor for email, banking alerts, or cloud access.
This does not mean SMS is the strongest MFA method. It means that if your accounts rely on SMS, your estate plan should acknowledge the dependency and avoid cancelling the number too early.
Legal Authority Still Matters
Technical access is not the same thing as permission.
An executor may need death certificates, letters testamentary, a court order, provider forms, or proof of authority. A spouse may know the phone passcode but still need to respect privacy, terms of service, and the limits of estate law. A business partner may need administrator access without entering personal accounts.
Your digital estate instructions should connect technical recovery to lawful purpose. Name the person who should act, explain which accounts are urgent, and describe what they may do: preserve, download records, transfer, memorialize, close, or leave private.
For the broader access framework, pair this article with /en/blog/emergency-access-plan-for-digital-accounts.
A Practical MFA Estate Checklist
Use this checklist as a focused review:
- list priority accounts with MFA enabled
- note the second factor for each account
- store backup or recovery codes securely
- identify trusted devices and security keys
- document authenticator app locations and backups
- keep recovery email and phone numbers current
- avoid cancelling the primary phone line too early
- explain which accounts are private, urgent, or business-critical
- review everything after a new phone, new number, divorce, marriage, move, or password manager change
This is not about making your accounts easier to break into. It is about making them recoverable by the right person when you are no longer available.
Conclusion
Two-factor authentication after death is a solvable problem if you plan before a crisis.
Keep MFA on. Document the second factors. Store recovery codes securely. Identify trusted devices. Explain phone number dependencies. Connect the technical plan to legal authority and account-specific instructions.
Then your accounts can stay protected during life without leaving your family or executor stuck outside the systems they need to handle with care.