What to Do Before Taking Over a Parent's Passwords and Accounts

Step 1 — Separate "locate" from "take over"

You don't need anyone's passwords to know what accounts exist. That's the documents-and-accounts checklist — a blank form the family fills in together. Passwords are only for the accounts where the parent wants active help, and only after they say so. A parent who feels ambushed will fight the system, hide accounts, or (worse) stop telling you about problems. Consent is the security feature.

Step 2 — Have the conversation, in this order

1. Name the problem you're solving. "When you had that hospital stay, we couldn't find your insurance login, and it took three weeks. I'd like to make sure we can always find things like that."
2. Ask, don't announce. "Would it help if we set up a shared way to keep account logins safe — that you control?"
3. Offer the split. "You keep your own logins in a password manager. I get access only to the accounts where you want help — say, the pharmacy and the bank app — and only with your permission each time."
4. Agree on the ground rules out loud: you will never log in without asking; you will never change passwords without telling them; they can revoke access at any time.

Step 3 — Use a password manager, not a notebook

• For the parent: set up a password manager on their devices (Apple's built-in Passwords app on iPhone, Google Password Manager on Android, or a standalone manager). One master password, and the phone's biometrics do the rest.
• For the family: the safest "in case of emergency" pattern is a shared vault or a sealed emergency kit — not a notes file, not a group chat, and never a sticky note. Several managers support emergency access that unlocks after a waiting period, which prevents misuse.
• What to record per account: service name, login (email or username), which device it's on, and where the recovery options point. Not necessarily the password — often "reset via this email" is enough.

Step 4 — Set up the recovery chain properly

The strongest setup: each account's recovery phone/email points to the parent's own devices and one family member as backup. Then a forgotten password is recoverable without anyone "taking over." Add these specifically:

• Bank, card, and investment accounts → set up the parent's online access with their own phone number, and add you as a trusted contact/beneficiary where the institution offers it (this is account-specific; call the bank).
• Email → add a recovery email the family controls, and turn on two-factor authentication. Email is the master key to everything else.
• Apple/Google accounts → add a family member via the platform's own "trusted contacts" / family sharing features rather than sharing the password.

Step 5 — What if the parent refuses?

Respect it, mostly. Refusal about a password is usually refusal about something else — control, fear of dependency, or a belief that the kids are overreacting. Keep the documents checklist going (that doesn't need passwords), keep offering the "you control it" version, and let the topic rest between offers. If there are genuine signs of cognitive decline, that's a Care & Safety conversation with professionals — not a password heist.

Related

• The documents and accounts to locate — start here, it needs no passwords
• Make their phone easier — including why you should leave their security settings alone
• When a scam already happened — including "verification code shared" response

Sources

• FTC — How To Avoid a Scam (account-takeover patterns, retrieved 2026-08-07)
• FBI IC3 — IC3 (retrieved 2026-08-07)
• General method based on standard credential-management practice (password managers, recovery chains, trusted contacts); individual institution policies vary — check with each provider.

Found an error? Report it.