Vacant accounts can be impersonated because they still contain trusted identity cues, relationship networks, and old messages that attackers can exploit. In the source article, so called ghost hackers monitor obituaries and death notices, then use compromised profiles to solicit money or lure contacts into scams. The risk is not only account abuse, but also emotional manipulation of grieving relatives.
Why dormant accounts become a fraud target after death
Vacant social media and email accounts remain valuable because they preserve trust signals that are hard for a scammer to manufacture from scratch: known names, long message histories, contact lists, and the social context that makes a request seem normal. That is why post-death account abuse is often less about technical intrusion than about using a legitimate-looking identity surface to reach people who are already inclined to trust the sender.
The risk is magnified when the account still appears active to friends, relatives, or service providers. A fraudulent message sent from a familiar inbox or profile can bypass the scepticism that would greet an unknown sender. In practice, many security teams encounter this kind of trust abuse only after a real-world life event has already created an unmonitored account and a ready-made audience.
How the fraud works in practice
Fraudsters do not need to invent a convincing backstory if the account already contains one. Old photos, prior conversations, birthday reminders, comments, and mutual connections provide enough context to support impersonation or account take-over. Once access is gained, the attacker can exploit the account in several ways: request urgent payments, redirect conversations to a private channel, harvest additional personal information, or pressure contacts with emotionally charged messages.
This pattern works because ordinary account controls are usually designed for living users, not for accounts that have become inactive through death. A mailbox may still accept password resets. A social profile may still be able to message contacts. Two-factor authentication may slow opportunistic abuse, but it does not remove the trust created by the account itself. The issue is not only whether the attacker can log in; it is whether the account still has enough residual authority to persuade others.
- Fresh messages from a familiar account can look more credible than a message from a newly created impersonation profile.
- Old threads can reveal relationships, travel plans, family details, and payment habits that make a scam more targeted.
- Contacts may override normal caution because the sender appears to be a known person in a sensitive situation.
For that reason, the operational problem is as much about trust decay and account lifecycle as it is about password strength. A relevant reference for lifecycle and control design is the NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organisations need structured account review, access revocation, and monitoring discipline. Where the account itself is the trust anchor, the fraud risk persists until the account is disabled, memorialised, or formally handed over under the platform’s rules.
Where this guidance breaks down is when organisations assume that account compromise is the only problem; in post-death fraud, the bigger failure is often continued social trust in an account that no longer has a legitimate owner.
What changes when the account is no longer managed
Tighter account controls often reduce the chance of takeover, but they can also create friction for families and platform operators who need to preserve memories, access records, or close accounts properly. The balance is between convenience for legitimate estate handling and reducing the chance that a dormant account becomes an open-ended fraud channel.
There are a few important edge cases. Some platforms memorialise accounts and limit new activity, which can reduce abuse but may not eliminate visible trust cues. Other services allow recovery requests that may be misused if the attacker can assemble enough personal details. Email accounts are especially sensitive because they often act as a reset path for other services, so a vacant mailbox can become a gateway to wider compromise rather than a standalone fraud target. Industry practice is not fully uniform here, so policy and platform behaviour matter more than assumptions.
In this setting, the most overlooked issue is that a dormant account can remain socially authoritative even after it has lost administrative ownership. That makes the fraud opportunity unusually durable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1586 — Compromise Accounts | Fraudsters abuse or take over existing accounts to impersonate the owner. |
| Recommendation — Map suspicious post-mortem account activity to T1586 and hunt for login abuse and impersonation behavior. | ||
| CIS Controls v8 | 5 — Account Management | Dormant accounts need lifecycle control, disablement, and ownership review. |
| Recommendation — Apply Control 5 to revoke or memorialise inactive accounts before they become trust channels. | ||
| NIST CSF 2.0 | ID.AM — Asset Management | Email and social accounts are assets whose ownership and lifecycle must be tracked. |
| Recommendation — Inventory high-trust accounts so dormant services can be identified and dispositioned promptly. | ||
| NIST SP 800-63 | IAL2 — Identity Assurance Level 2 | Post-death recovery and access requests require stronger identity proofing than casual support flows. |
| Recommendation — Use stronger identity proofing for recovery or disposition requests involving an account holder's death. | ||
Practitioner Guidance
What to prioritise: Treat account closure, memorialisation, and mailbox access as part of post-bereavement security handling, not as a purely administrative task. The highest-value control is removing the account’s ability to speak as the person while preserving any legitimate record-keeping needs.
What to verify: Confirm which accounts can still send messages, request resets, or expose contact networks after the owner’s death. The key question is not simply whether login is possible, but whether the account can still influence others or unlock other services.
Common mistake: Relying on a single password reset or inactivity check. Fraud often succeeds because the account remains trusted by the audience, even if the original owner is gone.
Escalation / exception: Escalate immediately if the account is public, widely connected, or linked to financial, recovery, or business services. Those accounts have the highest chance of becoming a secondary fraud path.
Practitioner takeaway: The decisive issue is residual trust, not residual access alone; if the account still looks socially valid, it can still be used as a fraud instrument.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
