Blog

Account Discovery After Death: Is It Legal? (2026)

Learn when legal account discovery after death is allowed under GLBA, FCRA, and RUFADAA, so you know what to expect.

January 28, 2026

Yes, account discovery after death can be legal when it is done for a duly authorized executor, administrator, spouse, or other approved representative. U.S. privacy and credit laws give financial institutions and credit bureaus ways to share certain information with the person handling the estate, but that authority has limits.

Sunset uses that authority to help families find accounts, debts, and assets after a death, while keeping discovery separate from account closures and transfers. This article explains the legal basis in plain English. It is informational only and is not legal advice.

The original compliance page this article is based on was last updated October 9, 2025.

Why legal authority matters before searching

After someone dies, banks, insurers, credit bureaus, retirement plan administrators, and online services do not hand account information to just anyone who asks. Most will need proof that the person asking has authority to act for the estate or has another legal right to the information.

That proof may include a death certificate and letters testamentary, letters of administration, or an equivalent court document. In some settings, a spouse or person with a legal or beneficial interest may also have access rights. The exact documents depend on the institution, the type of asset, and the state or county process.

Sunset starts with authority and identity because account discovery sits inside the larger estate settlement. Before money can be moved, debts reviewed, or heirs paid, the family needs a clear inventory of what exists and who has the right to act.

For a broader checklist before calling the court or an attorney, see Sunset's guide on what to do before you locate a probate attorney.

The GLBA rule that allows fiduciary access

The Gramm-Leach-Bliley Act, often called GLBA, protects nonpublic personal information held by financial institutions. In general, banks and other covered institutions cannot disclose that information to non-affiliated parties without a valid reason.

GLBA also includes an exception for fiduciaries and representatives. It permits disclosures 'to persons holding a legal or beneficial interest relating to the consumer' or to people 'acting in a fiduciary or representative capacity on behalf of the consumer.' The relevant citations are 15 U.S.C. § 6802(e)(3)(D) and (E), and CFPB Regulation P at 12 C.F.R. § 1016.15(a)(2)(iv) and (v). The CFPB rule is available at Regulation P § 1016.15, and the statute is available at 15 U.S.C. § 6802.

In estate terms, this is the rule that allows a bank or insurer to respond to a duly authorized personal representative, such as an executor or administrator. It does not mean every family member can get every detail. It means that when the right authority is shown, the institution has a lawful path to share information needed for estate work.

How Sunset applies this:

Sunset verifies the requester's legal authority, such as letters testamentary, letters of administration, or an equivalent document.
Sunset limits requests to information reasonably needed to identify, secure, and transfer estate assets.
Sunset follows GLBA's purpose and redisclosure limits in 12 C.F.R. Part 1016.
Sunset acts through the authority the family grants, including limited power of attorney for the specified estate.

That limited power of attorney is tied to the estate and the work being done. Discovery can be performed under that authority. Closures and transfers are different: Sunset initiates them only with your explicit approval. Timing and actions stay under the executor's or administrator's control. Sunset's Terms of Use govern those agent authorities.

FCRA and deceased credit files

The Fair Credit Reporting Act, or FCRA, limits when a consumer reporting agency may furnish a consumer report. The statutory reference is 15 U.S.C. § 1681b.

In practice, the national credit bureaus maintain deceased indicators and publish procedures for access after a death. Experian's guidance says a spouse or court-appointed representative may obtain a decedent's credit file with the required documentation. Some cases require a court order. See Experian's executor access guidance.

This matters because debts are part of the estate inventory. Families often know about a mortgage or one credit card, but not every open account, balance, or creditor. A credit file can help identify liabilities that need review.

How Sunset applies this:

Sunset's liabilities discovery uses bureau-validated data to help inventory accounts and balances.
Sunset does not open new credit.
Sunset does not settle debts without explicit user direction.
Sunset does not contact creditors by default during liabilities discovery.

If you are worried about fraud or credit misuse after a death, Sunset's guide to deceased identity theft protection explains the first accounts and agencies families often review.

RUFADAA and digital assets

Digital accounts are not treated the same way as bank accounts. Most states have enacted the Revised Uniform Fiduciary Access to Digital Assets Act, known as RUFADAA. The Uniform Law Commission's overview is here: ULC, RUFADAA. The Financial Planning Association also has a practitioner explainer on estate planning and digital assets under RUFADAA.

RUFADAA extends traditional fiduciary powers to certain digital property, but it draws a hard line around the content of electronic communications. That means an executor may be able to manage some digital assets, such as files, domains, or wallets, but cannot access the content of emails or direct messages unless the user gave explicit consent or a qualifying court order allows it.

Sunset follows these RUFADAA mechanics:

The provider's online tool controls first, if the provider offers one and the deceased person used it.
If there is no online tool instruction, the will, trust, or power of attorney may control.
If neither applies, the provider's terms of service and the default statute apply.
Sunset does not read the decedent's emails or social messages to look for accounts.
Sunset uses document evidence, metadata, and provider-approved mechanisms where permitted.

This is why digital asset discovery after death often looks different from financial account discovery. Finding signs that an account exists is one thing. Reading private message content is another.

For more on online accounts, see Sunset's guide to digital assets after death.

Discovery is different from closing or transferring accounts

A search is not the same as an account closure. Sunset separates discovery, direct confirmation, and closure or transfer so the family can decide what happens next.

Phase	What Sunset does	Who is notified	Legal basis	Family control
Discovery by default	Searches, matches, and validates assets and debts across institutions	No routine notifications; insurers may be contacted for policy confirmation	GLBA permits fiduciary access; FCRA allows bureau data for representatives; RUFADAA governs digital assets	You approve next steps; no closures happen without consent
Direct confirmation as needed	Presents your legal authority to confirm holdings or balances	Only the relevant custodian	GLBA and Regulation P fiduciary exception	You decide what to request and when
Closure or transfer	Closes accounts, moves funds to an FDIC-insured estate account, and helps document distributions	Notified custodians and required agencies only	Your court authority plus GLBA	Nothing happens without your explicit approval

Sunset's default discovery is non-alerting. That means Sunset searches, matches, and validates indirectly so institutions are not routinely notified of the death during the search. This helps the family avoid premature account freezes while they are still trying to understand what exists.

Life insurance is the routine exception because confirming and processing a claim may require insurer outreach. Sunset's How it works, Bank Account Search, and Life Insurance Search pages describe the related services.

How the NAIC Life Insurance Policy Locator works

The NAIC Life Insurance Policy Locator is often misunderstood. It is not a database that a family can search, and it does not give the requester a match or no-match answer.

Here is how it works: you submit a request with the decedent's information. NAIC forwards that death information to participating insurance carriers. It is a notification to carriers, not a searchable database.

Each carrier checks its own records. If a carrier finds a matching policy, the carrier contacts the listed beneficiary directly at the address that carrier has on file for that beneficiary. NAIC never tells the person who submitted the request whether a match was found. There is no results page, no match or no-match response, and no confirmation either way.

That means hearing nothing does not prove there was no policy. If the requester is not the listed beneficiary, if the beneficiary address on file is old, or if the beneficiary has moved or died, the notice can go nowhere and the requester may never learn that a policy existed.

This is one of the differences between a notification-based locator and Sunset's life insurance work. Sunset tells the family where a policy was found and helps them claim it, instead of leaving them waiting on a notice that may never reach the right person.

If you already know there is a policy and need to file a claim, Sunset's guide on how to claim life insurance after death covers the claim process.

Primary sources families may see during estate work

The original Sunset workflow page listed government and regulator sources used in estate discovery. These sources cover taxes, unclaimed property, insurance, pensions, deposit insurance, Social Security, federal employees, and military retirees.

Topic	What it covers	Official source
Executor tax duties	IRS guidance for survivors and executors, including Form 56, SS-4/EIN, 1041, 706, and 709	IRS Publication 559
Unclaimed property	State unclaimed property programs and a multi-state search hub	NAUPA
Life insurance locating	A request process where NAIC forwards death information to participating insurance carriers	NAIC Policy Locator
Unclaimed pensions	Search for unclaimed or trusteed pension benefits	PBGC, Unclaimed Retirement
FDIC insurance rules	Deposit insurance categories, including estate, or decedent, accounts	FDIC, Single/Decedent Accounts
Report a death to SSA	How to notify Social Security and survivor benefit basics	Social Security Administration
Federal employees	Report a federal employee or annuitant death; FEGLI claims	OPM, Report a death and OPM, FEGLI
Military retiree	Report retiree death; AOP; SBP annuity	Military retiree death reporting resources

FDIC insurance is generally $250,000 per depositor, per insured bank, per ownership category. Estate accounts, also called decedent accounts, are insured as the decedent's single-owner funds and are added together with any other single accounts at the same bank. Naming heirs on an estate account does not increase FDIC coverage. See FDIC Single/Decedent Accounts and the FDIC's deposit insurance overview.

How Sunset turns the rules into a process

Sunset has helped 15,000+ families settle estates. The process starts with an assets-and-liabilities-first view: find what exists, confirm what authority is needed, then decide what to close, transfer, claim, or report.

Here is how the legal rules map to the work:

Verify authority and identity

Sunset collects the death certificate and letters testamentary, letters of administration, or equivalent authority. When appropriate, the estate EIN is established using IRS resources in Publication 559, including SS-4/EIN guidance.

Discover without routine custodian alerts

Sunset searches 2,300+ financial institutions to find accounts and assets. Discovery may use document intelligence, data integrations, public records, and credit-file indicators to create an asset and liability inventory. Banks and creditors are not routinely notified during search unless the law or the claim process requires it, as with some life insurance work.

Request data under the GLBA fiduciary exception

When direct confirmation is needed, Sunset presents the family's legal authority and asks only for the information needed to secure or transfer estate assets. The legal basis is GLBA and Regulation P.

Handle debts with executor control

Sunset provides bureau-validated liabilities information so the executor or administrator can review the estate's debts. Sunset does not settle, close, or contact creditors unless instructed.

Respect RUFADAA limits

Sunset uses provider online tools and estate documents where they permit access. Sunset does not access the content of communications without explicit user consent or a qualifying court order.

Prepare paperwork and help with transfers

Sunset generates state- and county-specific probate packets. When counsel is needed, Sunset refers families to a local probate attorney. Sunset can also help move funds into an FDIC-insured estate account and document transfers to beneficiaries and heirs.

Sunset's family product is funded through our bank partnership. The estate does not pay Sunset, and all assets go to the beneficiaries and heirs.

Data collection and sharing follow Sunset's Privacy Policy, including categories of data, purposes, sharing, choices, and state-specific rights. Required e-signatures and electronic delivery are governed by Sunset's Electronic Communications Policy.

FAQ

Is it legal for Sunset to ask banks about a deceased person's accounts?

Yes, when Sunset is acting for a duly authorized fiduciary or representative. GLBA permits disclosures to people holding a legal or beneficial interest or acting in a fiduciary or representative capacity. The key citations are 15 U.S.C. § 6802(e)(3)(D) and (E), and Regulation P § 1016.15.

Can an executor get a deceased person's credit report?

Yes, in many cases. Credit bureaus maintain deceased indicators and may provide a report to a spouse or court-appointed representative with required documentation. Some situations require a court order. The statutory reference is 15 U.S.C. § 1681b, and Experian publishes guidance for executor access.

Can Sunset read a deceased person's emails or messages to find accounts?

No. Under RUFADAA, the content of electronic communications is restricted unless the user gave explicit consent or a qualifying court order allows access. Sunset relies on document evidence, metadata, and provider-approved processes.

Do banks get alerted during Sunset's discovery search?

Not by default. Sunset's discovery process is non-alerting, so banks and creditors are not routinely told about the death during search. Life insurance is the routine exception because a claim may require insurer outreach.

How does Sunset get paid if the estate does not pay Sunset?