Most people have far more online accounts than they actively use. There is the old shopping site you joined for one purchase, the social platform you abandoned years ago, a forgotten photo service, an email address from another phase of life, and perhaps a handful of apps you cannot even remember downloading.
Those accounts may feel irrelevant because you stopped using them. To a cybercriminal, however, an old account can still contain useful information, saved payment details, personal messages, recovery information, or a password that was reused somewhere more important. The bigger problem is that dormant accounts are easy to forget and therefore easy to stop monitoring.
Cleaning up those digital leftovers is not about assuming every abandoned account is under attack. It is about reducing the number of doors you have to keep secured.
Why Forgotten Accounts Can Become Attractive Targets
A dormant account is simply an account that has gone unused for a long period. There is no universal definition of "dormant." A service may consider an account inactive after months or years, while another may keep it available indefinitely.
Google, for example, says a personal Google Account may be considered inactive after two years without use and may eventually have its data deleted under its Inactive Google Account Policy. Microsoft likewise says most personal accounts must generally be used at least once within a two-year period to remain active under its account activity policy.
Those policies can reduce the number of forgotten accounts lingering forever, but users should not assume every company automatically removes inactive profiles.
An old account may still have weaknesses that make it worth attempting to access:
- A reused password that later appeared in another breach
- An outdated or inaccessible recovery email
- No multifactor authentication
- Old personal details that could help with impersonation
- Saved addresses or payment information
- Private messages or photographs
- Connections to other accounts
- A lack of recent login monitoring
The absence of activity is part of the appeal. If you check an account every week, an unfamiliar login or changed email address may stand out quickly. If you have not signed in since 2021, an attacker may have considerably more time before you notice.
The account you forgot still remembers things about you, and that alone can make it worth protecting or deleting.
Stolen Passwords Give Old Accounts a Second Life
One of the clearest risks involves credential reuse.
Imagine that five years ago you joined an online store using the same email address and password you later used for several other websites. You stopped shopping there and forgot the account existed.
Then credentials from another breach circulate online.
Attackers can use automated tools to test those username-and-password combinations against unrelated services. OWASP describes credential stuffing as the process of trying credentials obtained from one breach against other websites, exploiting the fact that people often reuse passwords.
A dormant account may be especially useful in that scenario because its password has not been changed for years.
The attack also does not have to end with the forgotten account. Once inside, someone might find an old shipping address, phone number, date of birth, saved payment details, messages, or clues about other services you use.
Have I Been Pwned's breach data illustrates how large the credential ecosystem has become. One credential-stuffing dataset added to the service in 2025 contained two billion unique email addresses aggregated from malicious sources, with stolen credentials intended for attempts against unrelated accounts. Its guidance on breached passwords recommends replacing exposed passwords anywhere they were reused.
That is why one of the first questions to ask about any old account is not simply, "Do I still use this?"
It is, "Did I ever reuse this password somewhere else?"
Dormant Does Not Mean Empty
Old accounts often hold more useful information than people remember.
A shopping profile may contain addresses and order history. A social account may contain private messages, old photos, friend connections, and personal details. An abandoned cloud account might still store documents. An old email inbox can be particularly valuable because email is often connected to password resets for other services.
Consider a simple scenario.
You created an old email address during university and eventually moved to another provider. The inbox remains accessible, but you rarely check it. Years later, several forgotten accounts still list that address for password recovery.
If someone gains control of the old inbox, they may not care about the messages from ten years ago. They care about which current accounts still trust that email address.
That turns a forgotten account into part of your present-day security.
The same principle applies to phone numbers. If an old account still relies on a number you no longer control, recovery may become more complicated. Someone else could eventually receive that reassigned number, depending on the carrier and country.
Dormant accounts therefore deserve attention not because every old profile contains something dramatic, but because digital relationships persist long after we stop thinking about them.
How Cybercriminals Can Exploit an Abandoned Account
Attackers do not need one special technique reserved for dormant accounts. They use familiar account-takeover methods against a target that may receive less scrutiny.
Credential stuffing is one route. Password spraying and phishing can provide others. Stolen session tokens, compromised recovery channels, malicious software, or passwords obtained from previous breaches may also be involved.
The UK's National Cyber Security Centre has documented cases in which sophisticated threat actors specifically targeted dormant organizational accounts belonging to people who had left a company. Its advisory on dormant account targeting describes attackers using inactive accounts to regain or maintain access to cloud environments.
A consumer's abandoned shopping profile is obviously not equivalent to a privileged corporate cloud account. The underlying lesson is still useful: unused access can remain valuable access.
Cybercriminals do not care whether you still value an account. They care whether the account still opens something.
Once someone gets in, what happens depends on the service.
An attacker might:
- Read stored private information
- Change the recovery email or password
- Use the account to impersonate you
- Send scams to existing contacts
- Make purchases with stored payment methods
- Search messages for useful personal details
- Use the account as a stepping stone toward other services
They may also do very little immediately. Access itself can have value.
Find the Accounts You Have Forgotten
The hardest part of cleaning up dormant accounts is remembering where they are.
Do not rely entirely on memory. Instead, work backward through the places that already contain clues.
Search your main email inbox for phrases such as:
- "Welcome"
- "Verify your email"
- "Confirm your account"
- "Password reset"
- "Thanks for signing up"
- "Your account"
- "Security alert"
You will probably find services you had completely forgotten.
Your password manager is another useful inventory. Scroll through saved logins and look for sites you no longer recognize or use. Browsers may also contain old saved credentials.
Check Apple, Google, Microsoft, Facebook, and other accounts you use for "Sign in with" connections. Third-party apps may still be linked even after you stop actively using them.
Old devices can provide clues too. An unused phone or tablet may contain apps representing accounts that are still active somewhere.
You do not have to track down every website you have visited since adolescence. Concentrate first on accounts likely to contain personal information, financial details, communications, or access to something else.
Decide: Keep It or Delete It
Once you find an old account, make a deliberate decision instead of automatically leaving it in place.
If you no longer need the service and it offers proper account deletion, closing it can reduce the number of credentials and datasets you have to protect.
Before deleting anything, check whether you need to:
- Download photographs or files
- Save receipts or purchase records
- Cancel subscriptions
- Transfer digital purchases
- Remove connected accounts
- Update another service that uses the account for recovery
Also distinguish between deleting an app and deleting an account. Removing an app from your phone usually does not erase the profile or information stored by the company.
If you want to keep an old account, secure it as though you were actively using it.
Give it a unique password if passwords are still required. Enable multifactor authentication or a passkey where available. Update recovery email addresses and phone numbers. Remove outdated payment information and check recent login activity.
An account can be inactive without being neglected.
Every dormant account deserves one clear decision: secure it because it still matters, or close it because it does not.
Your Old Email Accounts Deserve Extra Attention
Email should move toward the top of your cleanup list because it often functions as the control center for other accounts.
If you discover an old email address you want to retain, sign in and inspect its settings carefully.
Check:
- Recovery email addresses
- Recovery phone numbers
- Active sessions or devices
- App passwords
- Connected applications
- Forwarding rules
- Filters you did not create
- Multifactor authentication
- Recent login activity
Email forwarding deserves particular attention after any suspected compromise. The NCSC warns that criminals sometimes create forwarding rules in hacked accounts so they can continue receiving copies of incoming messages and potentially use them for account recovery.
If an old email address is still listed as the recovery address for important services, either secure it properly or replace it with an account you actively monitor.
Do not leave your current financial or social accounts dependent on an inbox you check twice a decade.
You Do Not Need to Change Every Old Password on a Schedule
Account cleanup should not turn into an annual ritual of changing hundreds of perfectly good passwords for no reason.
The higher-value changes are more specific.
Replace passwords that were reused, exposed in a breach, entered into a phishing page, or connected to suspicious account activity. For accounts you keep, make sure each password is unique.
A password manager makes this substantially easier because it lets each service have an independent credential without forcing you to memorize all of them.
Where passkeys are available, they can further reduce the risk associated with reusable passwords.
The goal is not constant password motion. It is eliminating old credentials that can unlock several places at once.
Businesses Have Dormant Accounts Too
Dormant accounts are not just a consumer problem.
Organizations accumulate accounts belonging to former employees, contractors, vendors, test users, and people who changed roles. If those identities retain unnecessary access, they increase the number of credentials an organization has to defend.
NCSC guidance for smaller organizations specifically recommends removing or disabling unnecessary accounts when staff, contractors, or suppliers no longer require them because those accounts can retain outdated passwords and security settings.
Good organizational hygiene includes:
- Quickly disabling access when someone leaves
- Reviewing inactive accounts periodically
- Removing unnecessary privileges
- Monitoring unusual logins
- Requiring stronger authentication
- Maintaining accurate account ownership
- Avoiding shared accounts where individual accounts are more appropriate
The consumer version follows essentially the same principle.
If access no longer serves a purpose, ask why it still exists.
Make Account Cleanup a Manageable Habit
You do not need to audit your digital life every month.
A better approach is to clean things up at natural transition points: when you replace a phone, change your main email address, switch jobs, stop using a major service, or review your password manager.
Spend 20 minutes looking at stored logins. Delete accounts you clearly no longer need. Secure the ones you recognize and want to keep. Pay extra attention to accounts containing payment information or acting as recovery channels.
If you receive a security alert from a service you had forgotten, do not dismiss it because the account is "old." That is exactly when it deserves attention.
And if you decide to abandon a service permanently, close the account properly when the provider offers that option rather than simply deleting the app and hoping the profile quietly disappears.
The Wise Wrap-Up
Forgotten accounts become much easier to manage once you stop treating them as harmless digital clutter.
- Inventory what still exists. Search old emails, saved passwords, connected apps, and old devices for accounts you no longer remember using.
- Prioritize email and financial accounts. They can provide access to other services or contain particularly useful information.
- Eliminate password reuse. An old breach should not provide a working credential for anything you still depend on.
- Secure what you keep. Update recovery information and use stronger authentication wherever possible.
- Delete what no longer serves a purpose. Removing an app is not the same as closing the underlying account.
- Review connections as well as accounts. An old service may still have permission to access a current Google, Apple, Microsoft, or social account.
Close the Doors You No Longer Use
Your digital life inevitably accumulates leftovers. Trying a new service should not require a lifelong commitment to remembering that account exists.
The problem begins when forgotten access remains active, tied to old passwords, outdated recovery information, and personal data you no longer need the company to hold.
You do not have to eliminate every account from your past. Just give the important ones a decision. Secure what still has value, close what does not, and make sure an account you forgot years ago cannot become the easiest route into something you still care about today.
