Will a Provider Let an Executor Read the Emails?

If you are trying to get access to your dad's email account after he died, the honest answer is that it is far harder than it should be, and the reasons are partly legal and partly the way the big providers are built. An executor does not have an automatic right to walk into an inbox. Google, Microsoft and the UK internet providers almost never simply hand over a password on production of a death certificate, and the account holder being dead does not, on its own, give anyone else the authority to log in.

That feels wrong, because the inbox is where everything is — the bank statements, the insurance renewals, the subscriptions quietly taking money, the login for every account the person ever opened. It is the obvious first place to look, and for a personal representative trying to piece together an estate it can feel essential. But an email account is not treated like a drawer of paperwork you inherit. It is a service governed by a contract and by data protection law, and both outlast the person who signed up.

So there are really two questions, and it helps to keep them apart. What will a provider release to you through its own process? And what happens if you skip that and simply log in with a password you have found? The first is slow and limited but lawful. The second can be a criminal offence, even when your intentions are entirely honest.

Why the inbox is the first thing families reach for

Modern financial lives are almost entirely paperless. Statements come by email, policies renew by email, and the confirmation of every account a person ever opened is sitting somewhere in their inbox. For an executor facing the job of valuing an estate, the email account looks like the master key — reach it, and the whole picture falls into place.

That instinct is right about the value and wrong about the route. The inbox would help enormously, but it is not the only way to reach the same information, and it is the hardest way to reach it lawfully. The same job — working out what the person held — can usually be done from the outside. A careful trawl of bank statements will name most of the direct debits and card payments, which is exactly the method that helps you find bank accounts nobody knew about after a death, and it will surface the insurers and subscriptions at the same time. If you are trying to establish whether there was a life policy with no paperwork to go on, there are tracing routes that do not depend on getting into the email at all.

The short answer: no provider hands over the password

Whatever the provider, the thing you almost certainly cannot get is the simplest thing you want: the password, so you can log in and read everything as the person did. Providers treat the password as the line they will not cross, because handing it over would give you the run of the account with no control over what you do inside it, and would breach their duty to the person whose data it is.

What some providers will consider instead is a controlled release — a copy of certain data, or closure of the account — after their own review, on their own terms, and often after weeks. And a good number will simply refuse, citing their privacy obligations. That refusal is frustrating, but it is not the provider being obstructive for its own sake; it is the same principle that stops a stranger talking their way into your account while you are alive.

What Google and Microsoft actually do

Google has a formal process for a member of the family or a representative of the deceased to make a request about the account. In some cases it will close the account; in some limited cases it will provide content. It reviews each request carefully, it can take a long time, and it can decline. Crucially, if the account holder set up Google's Inactive Account Manager, the setting that decides in advance who gets your account, that route is dramatically simpler — the nominated person is given access to the data the account holder chose to share. That setting can only be created by the account holder while alive, which is exactly why it is worth knowing about before you need it.

Microsoft's position on Outlook and Hotmail accounts is broadly similar but, if anything, more restrictive. Microsoft operates a next-of-kin process and describes itself as a custodian rather than an owner of the data; it may, after review, provide a copy of the account contents or close the account, but it does not simply provide the password, and it does not guarantee release. As with Google, a court order or grant of representation may be requested, and even then the outcome is not certain.

The pattern across both is the same. There is a process. It is slow. It leans towards closing the account rather than opening it to you. And it treats the password as off-limits.

UK internet providers and older email addresses

Plenty of people, especially older account holders, use an email address tied to their broadband or phone provider — the addresses that end in a UK internet provider's own domain rather than a global service. These are handled by that provider's bereavement team, and the approach varies from firm to firm.

Some will close the account and the mailbox on notification of death and will not release its contents at all. Some tie the email to the broadband contract, so when the broadband is cancelled the mailbox disappears with it — which can mean losing access to years of email simply because the line was cancelled first. If there is an address like this in play, it is worth asking the provider what happens to the mailbox before you cancel the broadband, not after, because the order can be irreversible. Treat it as one more account to notify carefully rather than one to rush.

Logging in with a found password: the Computer Misuse Act line

This is the part families most need to hear plainly, because the temptation is obvious. The password is written in a notebook, or saved in a browser, and logging in would answer every question in five minutes. It is also the point where good intentions can cross into criminal territory.

Accessing a computer account without authorisation is an offence under the Computer Misuse Act 1990. The Act is about authority, not ownership, and the authority does not automatically pass to you because the account holder has died or because you are their executor. The provider's terms say the account is personal and non-transferable; logging in as the account holder is, on a strict reading, unauthorised access even when you are the closest relative acting in good faith.

In reality, a grieving family quietly checking a parent's inbox is not what prosecutors are looking for. But the risk is real enough that it should stop you, particularly where other people have an interest in the estate and a dispute is possible, or where the inbox contains a third party's private correspondence. It is the same category of instinct that makes people carry on using a dad's bank card after he died because the PIN still works — understandable, convenient, and not something the law actually permits. And there is a practical trap on top of the legal one: unusual logins can trigger a provider's security systems and lock the account for good, so an attempt to get in can be the very thing that shuts the door.

The lawful routes that actually get you somewhere

The good news is that you usually do not need the inbox at all — you need the information inside it, and there are cleaner ways to reach that.

• Go direct to each organisation. Rather than hunting through emails for the insurer or the bank, contact each one as the personal representative, with the death certificate and your proof of authority. They will tell you what they hold. This is slower per organisation but it is lawful, it is reliable, and it puts you on the record as the person dealing with the estate.
• Use the provider's own bereavement or data process. Google, Microsoft and the ISPs each have one. It may not give you everything, but it is the sanctioned route and it will not get the account frozen against you.
• Work from the paper trail. Post still arrives, statements still come, and the physical paperwork in the house often answers most of the questions the inbox would have.
• Redirect the future, not the past. A Royal Mail redirection catches the post going forward, which for an executor is frequently more useful than reading old email.

Who counts as the personal representative matters here, because it is the authority you will be asked to prove at every turn. Where there is a will, it is the executor named in it. Where there is not — where, say, a father died without a will and the house is in his name — it is whoever is entitled to administer the estate under the intestacy rules, and they will need a grant of letters of administration before most organisations engage. Sorting that out is the foundation that makes every other request stick.

Setting it up in advance, and Scotland and Northern Ireland

The version of this problem that is genuinely solvable is the one you deal with before it happens. Google's Inactive Account Manager and an Apple Legacy Contact both let the account holder decide, in advance, who is allowed in and what they can see. Facebook and Instagram have their own equivalent, which is why it is worth reading how a Facebook account is memorialised or deleted after a death and setting your own preference while you can. After death, none of these can be added — the window closes with the person.

The Computer Misuse Act applies across the whole of the United Kingdom, so the line on logging in without authority is the same in England, Wales, Scotland and Northern Ireland. What differs is only the proof of authority you present to a provider: in Scotland, the personal representative's authority comes through confirmation rather than a grant of probate, and in Northern Ireland through the local Probate Office. The provider's process is the same wherever you are; the document you attach to it is the regional one.

For the wider picture of which accounts, bills and subscriptions need dealing with in these first weeks, our guide to bereavement admin, assets and contracts sets out the whole list in one place.

Where this leaves your own family

If reading this has shown you how hard it is to reconstruct someone's finances from the outside, the practical lesson points inward. The kindest thing you can do for the people who will one day sort out your own affairs is to make the information findable — a list of accounts and policies they can actually reach, kept somewhere they know to look, rather than locked behind an inbox they may never be allowed into.

Part of that is making sure the cover itself exists and is known about, so nobody has to go hunting for a policy that may or may not be there. If that has prompted you to check your own position, you can get life insurance quotes and have an FCA-authorised broker set it out clearly. Whether an insurer offers cover, and on what terms, always depends on the individual and on underwriting — but a policy your family knows about is one they never have to break into an email account to find.

Frequently asked questions

Will Google or Microsoft give an executor access to an inbox?

Rarely full access. Both have processes for a next of kin or personal representative to request content or account closure, and both may release limited data after review, but they can and often do refuse. Neither will simply hand over the password on production of a death certificate, and both lean towards closing an account rather than opening it up to someone else.

Can I just log in using a password I found?

It is risky. Accessing a computer account without authorisation can be an offence under the Computer Misuse Act 1990, and the fact that the account holder has died does not automatically give you that authority. Providers may also lock the account permanently once they detect an unusual login, so an attempt to get in can be the very thing that shuts you out for good.

What are the lawful alternatives?

Use the provider's own bereavement or data request process, and ask each bank, insurer or subscription firm directly rather than hunting through the inbox for them. Work from paper records, statements and redirected post. In advance, an account holder can set up Google Inactive Account Manager or an Apple Legacy Contact, which is the one route that reliably gives a nominated person access later.