Your Old Accounts Are a Liability. Close the Dead Ones.

That MySpace-era email. The shopping site you used once in 2019. The free trial you swore you’d cancel. The forum you posted on twice in college. Every one of them is still out there, holding a copy of your data, waiting. You forgot about them. The internet didn’t.

Every dead account is a door you left unlocked. Let’s go close them. One afternoon, done.

Why old accounts are a liability

It’s tempting to think an account you never touch can’t hurt you. The opposite is true. The ones you’ve forgotten are exactly the ones that bite, because nobody is watching them.

Breach exposure. Companies get breached constantly, and old services running on no budget are the softest targets. When they leak, your email and password leak with them.
Password reuse. Be honest: you reused a password. Everyone did. One old leak hands attackers a key they will try on your email, your bank, everything. It’s called credential stuffing, and it’s fully automated.
Data sprawl. Every account holds a slice of you: name, email, phone, maybe a saved card or an old address. The more copies floating around, the bigger your attack surface.
Identity risk. Enough scattered details and someone can impersonate you, reset a password, or talk their way into an account that actually matters.

Fewer accounts means a smaller target. That’s the entire logic.

The cleanup, step by step

You don’t need a whole weekend. You need a list and a couple of hours.

Pull your list. Your password manager already has it, if you use one. If you don’t, search your email for “welcome,” “verify your account,” “your receipt,” and “free trial.” It’s confronting. Lean in anyway.
Sort into three piles: keep, kill, not sure. Be ruthless. “Not sure” almost always means kill. If you can’t remember signing up, you won’t miss it.
Kill the dead ones. Log in, find account settings, delete. Not “deactivate,” delete. Deactivation just turns the lights off while your data keeps living in the building.
Lock down the keepers. For everything on the keep pile: a fresh unique password and two-factor authentication. Non-negotiable. These are the accounts worth protecting, so protect them.

Before you hit delete

Two quick checks so you don’t fix an old problem by creating a new one:

Cancel anything you pay for. Don’t just delete it. Deleting an account doesn’t always stop the billing, and it can strand you mid-contract. Cancel first, confirm the charge is actually dead, then delete.
Export anything you’d miss. Photos, order history, saved documents, that one playlist. Once the account is gone, so is its data. Grab your copy before you pull the plug.
Unlink connected logins. If you ever used “Sign in with Google” or “Sign in with Facebook,” that dead account may still be a live door into your main one. Revoke the connection from your Google or Facebook security settings.

When there’s no delete button

Some sites bury the delete option on purpose. They want your account to linger. When you can’t find it, check JustDeleteMe, a directory that links straight to the deletion page for hundreds of services and rates how hard each one makes it.

If a service genuinely won’t let you delete, do the next best thing: strip the account bare. Wipe the saved card, clear the address, change the name to something generic, swap in a throwaway email. You can’t always close the door, but you can empty the room behind it.

The one that gets everyone: your old primary email

Here’s the account people never think of as dangerous. Your old primary email, the one from high school you barely open anymore. It’s still the recovery address for a dozen other accounts, which means you can’t just delete it. Do that and you’ll lock yourself out of everything it unlocks.

Migrate first. Go through your important accounts, update each one to your current email, then retire the old address. Tedious? Yes. But this is the account that, if it gets compromised, hands an attacker the reset keys to everything else. It earns the extra hour.

Let a password manager do the heavy lifting

If this whole exercise feels overwhelming, that’s a symptom, not a character flaw. Human memory was never built to track 200 logins. A password manager is.

It stores every account, so you finally have the list. It generates a unique password for each one, so a single leak stays contained. And it fills them in for you, so you’re never tempted to reuse “Fluffy123” for the tenth time. Pick one, spend an evening importing, and every future cleanup takes minutes instead of afternoons. It’s the highest-leverage move in your entire digital life.

What “handled” looks like

When you’re done, you should be able to say all of this:

Every account you still use has a unique password and two-factor turned on.
The dead ones are deleted, not just abandoned.
Your recovery email is current and locked down.
One place (your password manager) knows the full list.

That’s a clean digital footprint. Not perfect, not paranoid. Just handled.

Make it a habit

Do a five-account sweep twice a year. Pin it to something you already remember, like the clocks changing, so it never needs its own reminder. A standing 30-minute cleanup beats a heroic all-day purge you will never repeat. The goal isn’t a perfect one-time scrub. It’s keeping the pile small enough that it never becomes a project again.

Start today

Set a timer for one hour. Pull the list, kill five dead accounts, turn on two-factor for the one that would scare you most if it got hacked. You won’t finish everything today, and you don’t need to. You need momentum and a smaller target than you had this morning.

Your old accounts have been sitting there for years, quietly collecting risk. Give them one afternoon, get your ducks in a row, and move on.