Accounts Nobody Uses Any More

Why dormant accounts matter

Four reasons, and only one is obvious.

They hold data. An old scheduling system, mailing platform, or storage account still contains customer information you are responsible for, on a service nobody monitors.

They have credentials. A password set years ago, probably reused, on a service that may be breached. A dormant account is a live route in and nobody would notice its use.

They cost money. Subscriptions on a card that nobody reviews, for services abandoned long ago.

They may still be pointed at. A subdomain directed at a service you stopped using, or a link somewhere sending people to something that no longer represents you.

That last one is the least understood and the most exploitable.

The subdomain problem

Worth explaining because it is unfamiliar and genuinely serious.

Where you pointed a subdomain at a third-party service and later stopped using the service, the pointer frequently remains.

If that service releases the name you were using, somebody else can sometimes claim it and publish content that appears on your subdomain, under your domain name.

The fix is removing DNS records pointing at services you no longer use, which takes minutes and requires knowing they exist.

Reviewing your DNS records occasionally, and removing anything pointing at something you cannot identify, addresses this along with several other tidiness problems.

Closing an account properly

1. Export what you need, before anything else, since access ends when the account does.
2. Check what is connected, including anything using it to sign in.
3. Delete the data where the service offers it, rather than only closing the account.
4. Cancel the payment at the service and confirm it stops.
5. Remove references, including DNS records, links, and embeds.
6. Remove the entry from your access records, or mark it closed.

The third step matters more than people assume. Closing an account and deleting the data it held are frequently different actions, and a closed account may retain information indefinitely.

Where the service holds customer information, requesting deletion is part of your own obligations rather than an optional tidiness step.

The sign-in dependency

The step that causes trouble when skipped.

Where an old account was used to sign into other services, closing it can lock you out of those. This applies to social sign-in, and to any account used as a recovery address.

Before closing anything, check what depends on it. Moving those dependencies first turns a lockout into a routine change.

The same applies to email addresses. Closing an old mailbox that is the recovery address for something important is how businesses lose access to accounts they still use.

Where to find them

Since the difficulty is remembering they exist.

The bank and card statements, reviewed for a full year, which finds every recurring charge including the ones nobody recognises.

The password manager, which lists everything ever saved, including entries not used in years.

The email archive, searched for account confirmations and receipts.

Your DNS records, which reveal what the domain still points at.

Connected applications listed in your main accounts, which show what has been granted access.

That last one is worth doing specifically. Businesses routinely find services with ongoing access to their mail, files, or calendar, granted years ago for a trial nobody continued.

Staff who have left

The same exercise from a different angle.

Accounts belonging to former staff, personal accounts used for business purposes, and anything registered to an address that no longer exists.

The awkward version is an account registered under somebody's personal address, holding business data, where that person has left. Recovery may not be possible, which is an argument for the inventory rather than a solution to it.

The annual habit

An hour, once a year, ideally alongside something else you already do.

Review recurring charges, check connected applications, look at DNS records, and close what is no longer used properly rather than by abandonment.

Most businesses find something on the first pass: a subscription nobody uses, a service with access it should not have, or a pointer to something long gone.

All of it depends on knowing what exists in the first place, which is the inventory described in knowing who can get into what.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.