The Accounts You Forgot You Opened

Think about the last time you signed up for something you used exactly once. A food delivery app for one order during a trip. A forum account to ask a single question. A “create an account to view this recipe” site you closed the tab on and never opened again. Multiply that by fifteen years of being online and you probably have somewhere between fifty and a few hundred accounts you can’t name from memory.

None of that feels urgent, because none of it feels like anything. The accounts sit there, unused, generating no notifications, doing nothing visible. That’s exactly the problem. An account you’ve forgotten isn’t dormant from a security standpoint, it’s just unmonitored.

Why a forgotten account is still a liability

Every account you create is a small database entry somewhere: your email, probably a password, sometimes a phone number, a shipping address, a partial payment method, answers to security questions. That data doesn’t expire when you stop logging in. It sits on the company’s servers for as long as the company exists, under whatever security practices that company had at the time you signed up, which for a lot of smaller or older services was not much.

The risk isn’t that someone breaks into your account directly. It’s that the company behind it gets breached, and your data leaves in bulk along with everyone else’s. You don’t need to be targeted for this to happen to you. You just need to have had an account.

How an old breach becomes a current problem

Here’s the mechanical chain that actually matters, without any of the vague “hackers could get your info” framing.

A company you signed up for in 2016 gets breached in 2019. The breach dataset, containing emails and password hashes (or in the worst cases, plaintext passwords), gets traded and eventually dumped publicly. That dump sits around indefinitely. Automated tools take these dumps and try the email-password pairs against other services, a technique called credential stuffing. It works because a huge number of people reuse passwords across sites.

So the actual risk isn’t “that old forum gets hacked again.” It’s “that old forum’s 2019 breach data gets used against your current email or bank login in 2026,” if you ever reused the password. This is also why security questions matter more than people think. If an old account has “what street did you grow up on” tied to your real answer, and that leaks, the answer doesn’t change. You can rotate a password. You can’t rotate your childhood street.

There’s a second, quieter mechanism too: aggregation. Individually, your old accounts don’t reveal much. But a data broker or anyone doing reconnaissance on a specific person can combine leaked fragments from multiple old breaches, an address here, a phone number there, a real name tied to a pseudonymous account somewhere else, into a fuller profile than any single service ever had on you. This is how “harmless” old accounts contribute to something that does matter, like being findable, or having your patterns of behavior mapped, even though no single leak was dramatic on its own.

Finding accounts you don’t remember

You can’t close what you can’t find, and most people genuinely don’t remember the majority of what they’ve signed up for. A few practical ways to reconstruct the list:

Search your email for the words “welcome,” “verify your email,” “confirm your account,” and “password reset.” Signup confirmations and password reset emails are two of the most consistent footprints an account leaves behind, and most people never delete them.

Check your password manager, if you use one, for saved logins you don’t recognize by name. If you don’t use one, check your browser’s built in saved passwords list, which fills the same role by default in Chrome, Firefox, Edge, and Safari.

Look at your bank and card statements for small or one time charges. A lot of forgotten accounts are tied to a purchase, and the merchant name on the statement is often the fastest way to identify a service you’d otherwise never place.

If you strongly suspect you had an account on a specific site but can’t remember, try the “forgot password” flow. If the site confirms an account exists for your email (even without telling you the password), that confirms the account without needing you to log in first.

What to check before you close anything

Before closing an old account, it’s worth a quick look at what leaving might cost you, since deletion is sometimes not reversible.

Check whether the account is your login for other services. Plenty of sites let you sign in “with Google” or “with Facebook.” If you close the parent account, everything chained to it can break at once, sometimes without warning.

Check for anything of value tied to the account: loyalty points, stored files, purchase history you might need for a warranty claim, a subscription you’re still paying for. If there’s a subscription attached, cancel that first and confirm it separately, since account deletion doesn’t always stop billing on its own.

If there’s data you want to keep, most services with any real privacy maturity have a data export option, often under account settings or a “download your data” link. Grab that before you delete, because once the account is gone, that copy is usually gone with it.

Actually closing it

Account deletion is rarely a single obvious button. Most services bury it a few menus deep in account or privacy settings, sometimes labeled “deactivate” instead of “delete,” which are not the same thing. Deactivation usually just hides the account and can often be reversed by logging back in. Deletion is meant to actually remove it, though the depth of that removal varies a lot by company.

If you can’t find a deletion option in settings, search “[service name] delete account” and check the company’s own support pages rather than random forum posts, since the process changes over time. Some services only offer account deletion through a support request or email, rather than a self-serve button, which is worth knowing so you’re not stuck hunting for a setting that doesn’t exist.

There are third party services that offer to automate finding and requesting deletion of your accounts. If you use one, understand what you’re trading: you’re handing a third party your email and, in many cases, temporary access to your inbox or accounts to act on your behalf. That’s a real tradeoff, not a shortcut around one, and it’s worth weighing against just doing the handful of important ones yourself.

What closing the account doesn’t undo

It’s worth being honest about the limits here. Deleting an account today doesn’t retroactively remove your data from breaches that already happened, or from data broker sites that scraped and copied information before you closed anything. If your email and an old password were already in a breach dump, closing the original account doesn’t pull that dump back. What it does do is stop the account from being a live target going forward and reduce how much new data that company can associate with you.

No single step here makes you invisible or untraceable, and that’s not really the goal. The goal is reducing the number of places your data sits with security you’re not managing, and cutting down how much old, stale information is available to be combined against you later.

A simple ongoing habit

Rather than trying to solve this once, it helps to treat it as light maintenance. Twice a year, do the email search for signup and reset emails, skim your saved passwords list, and close or check anything you genuinely don’t use. Going forward, using a unique password per site (which is what a password manager is actually for) means that even if one old account you forgot about does get breached, it can’t be used to walk into anything else.

Closing old accounts isn’t a dramatic fix, and nobody’s claiming it should be. It’s ordinary upkeep for the same reason you’d clean out a junk drawer. You have no idea what’s actually in it until you look.

If you want more explainers like this on the practical side of staying private online, without the hype, head back to the homepage.