Your old online accounts pose a risk, so you should start by deleting the oldest ones. Here's a website that can delete them.
We all have an online presence, in one way or another. A Gmail account, an Instagram account, a TikTok account, a Twitter account (or what's now known as X), a YouTube account, a Netflix account, a Disney+ account... We spend most of our time online through apps, websites, or platforms that require us to create user accounts. Whether these services are paid or because having a user account allows us to customize our online experience, these accounts remain stored, whether we use them or not. And this can cause problems in the long run.
What happens to forgotten, abandoned, or unused user accounts? If you use a password manager, you'll likely find accounts and passwords that are years old. You don't use them all daily, perhaps because the website or platform is no longer available, or because you're simply tired of them. But these forgotten accounts still exist online, and if they fall into the wrong hands, they can cause you a lot of trouble for a number of reasons.
Cybercriminals exploit data to carry out scams and fraud. They can obtain this data in various ways: by impersonating individuals, companies, or public institutions; by searching social networks and platforms like LinkedIn; or by accessing user accounts. Therefore, leaving your old accounts inactive is not a trivial matter, as it could allow someone to discover how to access your current email, make fraudulent calls, or send you misleading messages.
- Risk of abandoning your user accounts
Remember that a user account is more than just an email address and password. These are the essential credentials for accessing any online service that requires creating a profile or user account. When creating a profile for any website or platform, you will always find several fields to fill in. Some are mandatory: address (both online and physical), date of birth, bank account information for making payments, and your real first and last name...
When you register and create a new user account, you trust that your data will be kept safe. Currently, this is often the case. However, this shouldn't be taken lightly. Unfortunately, we've become accustomed to data breaches involving thousands of user accounts. That's why modern password managers include a section to notify you if your passwords or email addresses have appeared in any such breaches.
But what happens to all that remaining data? When a forum, blog, website, or application becomes unavailable, that data is supposed to disappear. In other words, if you haven't used a user account for a year or more, it should be automatically deactivated. But reality isn't that simple. There are few examples of this actually happening. For instance, Google and Microsoft deactivate your account if you haven't used it for two years. Proton does the same after three months of inactivity.
Forgotten information that could be used against you
Many things can happen with abandoned user accounts. If the website or platform is still active, your account will remain even after you stop using it. Not all of these platforms have adequate security measures in place to protect data. Another possibility is that a company might be acquired, potentially leading to user account data being accessed and sold by third parties. The problem lies in the potential for data leaks, whether accidental or the result of cyberattacks.
Furthermore, old user accounts on services like email and social media often contain contact lists. This information is extremely valuable to cybercriminals, as they can use it to send fraudulent emails or text messages to trick your contacts and steal your information, making you a direct or indirect victim of fraud and phishing.
What do we do with accounts that cannot be disabled?
We now know that we need to review and delete abandoned user accounts to protect our security. However, this isn't always possible. If you can't access those accounts because the platform has disappeared or changed its name, there's nothing you can do. Let's hope the data doesn't end up on the dark web. But there might be apps or websites that don't allow account deletion. In that case, you'll have to clean up the data. However, before doing so, you can check the " Just Delete Me " website, just in case.
While deactivating and deleting old accounts is the safest and most effective solution, if that's not an option, you can always delete any data that might be leaked online. This means accessing that forgotten account and reviewing all the information you shared with it, whether in your public profile or in more sensitive sections like payment details, alternative email addresses, or any other personal data that could be used against you or your contacts. If that user account included contact lists, be sure to delete them to prevent email addresses or phone numbers from being used in phishing attempts. You can always keep them securely in your current address book.