This article first appeared in Digital Edge, The Edge Malaysia Weekly on January 13, 2025 - January 19, 2025

It’s common for people to financially plan for their deaths, with wills and trusts stating instructions for next of kin on how to manage and disperse assets. But in this day and age, where data is an increasingly important commodity, the posthumous management of one's data is overlooked, putting the deceased at risk of facing identity theft that can lead to fraud and other digital crimes.

While it may not directly affect the deceased, their next of kin may be preyed upon as well. On top of that, the families may lose important information — such as digital documents — and digital safekeeping of memories in the form of videos, photos and voice recordings.

Digital bank accounts and investment accounts are generally included in wills and trusts. However, other digital assets, such as e-commerce accounts like Shopee and Lazada, entertainment subscriptions like Spotify and Netflix, and social media profiles like Facebook, Instagram and TikTok, are often overlooked. The management of e-wallets, such as Touch 'n Go, also remains ambiguous, particularly as they are considered relatively new financial instruments.

If no one has been tasked to take control and manage a person’s online data after they pass on, there is a high risk that the deceased’s identity will be stolen and used for fraud and online scams. Rachel Gong, deputy director of research at Khazanah Research Institute (KRI), emphasises the importance of security to avoid this from happening, especially to prevent one’s data or finances (such as money left in e-wallets) from being stolen or used to scam others.

“As technology advances, it’s becoming possible to digitally resurrect someone with or without their consent, and that can be emotionally damaging to family and friends left behind and potentially even wider society if it’s someone influential,” she says.

“For example, there are already instances of deceased musicians whose work is remixed post-mortem without consent and new work generated by AI (artificial intelligence) based on their existing work and attributed to them as unreleased work.”

Over the last couple of years, TikTok has been inundated with videos featuring song clips of celebrities who passed away a long time ago singing current songs, with the help of generative AI (Gen AI).

For example, Freddie Mercury singing a cover of Set Fire to the Rain by Adele, even though he died in 1991, 20 years before the song came out, and Amy Winehouse doing a cover of Flowers by Miley Cyrus, which was released early last year.

From a monetary and intellectual property (IP) perspective, well-known and influential people have a lot more to lose than a regular Joe. Law Tien Soon, deputy CEO of Innov8tif Solutions Sdn Bhd, points out that while for some, digital assets have real monetary value, these assets more importantly chronicle the deceased’s journey and history on the internet, telling a story of their interests, beliefs and how they lived their lives.

These digital footprints, although intangible, are just as public as their real-life counterparts, considering that social media accounts and the items people publish are taken into consideration during recruitment processes, legal action and even used to find a dating or life partner. Hence, there will be dire consequences if there is no succession plan in mind for digital assets.

“In some cases, the rule is apparent. Take, for instance, Stan Lee the writer and publisher behind the Marvel Comics series. He sold his social media rights to an entertainment company that has been using his Instagram and other online accounts to post promotional materials long after his passing, much to the annoyance of his family,” says Law.

“But for many of us, the rights to our digital assets after our passing are not as clear-cut unless we specify them beforehand. This will affect the deceased’s legacy one way or another.”

Undoubtedly, there are repercussions if one ignores or leaves their digital footprint unmanaged after they die, especially in the era of scams and deep fakes. KRI’s Gong says this is not just a risk for the dead but those alive too in the event someone manages to log into their social accounts and impersonate them.

Even with consent, there is the risk of the next of kin experiencing deeper and lasting psychological and emotional effects if the deceased’s data is used without considerable thought.

“There are now services that [allow the impersonation of the dead] that some people might want, but it’s a new area with unknown repercussions, so best to proceed with caution,” says Gong.

One should be aware of “ghosting”, or bereavement scams, where bad actors first scrounge up details from obituaries, such as full name and date of birth, to gain access to more in-depth personal information, like employment history or details of family members.

Law explains that scams might lead to bad actors claiming public funds for funeral costs, harassing family members for non-existing outstanding debt, impersonating tax officers and accusing the deceased of tax fraud to extort funds. This can also escalate to them even opening new lines of credit, says Law.

“Unfortunately, there are not a lot of publicly available statistics on the pervasiveness of ghosting and the local news rarely covers such topics; hence, the cases are anecdotal. However, it is widespread enough for several overseas government agencies and non-governmental organisations to create regular awareness campaigns on these topics,” he says.

Overall, it also boils down to bad digital hygiene. It is entirely possible for bad actors to conduct scams if personal information is widely available and the friends and family are susceptible to scams in the first place. In most cases, the death of the deceased will mainly serve as the catalyst, says Law.

It is important to note that digital assets that are inaccessible by family members are outside the family’s control. For instance, while it is tempting to use the deceased’s social media account as an archive of their digital footprint, the family ultimately has no control over the data.

“An online platform may choose to manipulate or remove account data depending on the policies and terms upon the account’s registration, which is also subject to changes across the account’s lifespan,” says Law.

“If not careful, precious data will be lost entirely and the deceased’s account may not be managed according to the family’s needs.”

Similar to offline assets, awareness of digital assets (for example finstas or fake Instagrams and other “secret” accounts) and access to them are the two big challenges most next of kin face, says Gong, followed by knowledge of what the deceased would want done with them.

“Do they just delete everything? Preserve the whole account as a record for future generations? Or a bit of both?”

Next of kin might face roadblocks and barriers when wanting to access accounts, remove digital liabilities and preserve the legacy of the deceased. Family members might not have passwords or two-factor authentication (2FA) access to the deceased’s accounts.

“They may not be properly informed of the full picture of the deceased’s liabilities. Or perhaps the family members may not have the technical know-how to properly preserve and back up digital assets for long-term use,” says Law.

“Most importantly, there are data privacy laws governing how posthumous data is managed. In the European Union, GDPR (General Data Protection Regulation) laws state that personal data cannot be used without the consent of the person, complicating matters when that person is deceased. Some states in the US adopt the Fiduciary Access to Digital Assets Act, which has clear guidelines and instructions.

“Such laws have not been made aware in Malaysia; hence, it is imperative that the deceased has made instructions and preparations beforehand.”

While there are wills and trusts to take care of the distribution of tangible assets, there is a demand for a similar instrument for posthumous digital account management or making it compulsory for one to appoint a manager for one’s digital presence.

This is probably more useful for people with influence and a significant online following, says Gong, adding that one shouldn’t just focus on managing the existing information but determining how much existing information can or should be used to generate new content or information, such as to create a posthumous chatbot.

“One possibility to facilitate this process is to encourage people to use a password manager, because then with one master password, the next of kin will have access to all the existing accounts in use and if there are instructions on what to do with each of them, so much the better. It’s also good security practice in the here and now,” she says.

Meanwhile, Law recommends including digital assets in our will and appointing an executor or trustee for online accounts. It does not have to be overly comprehensive, but some of the most important accounts or identities that a person should plan for their continuous access by trusted transferees are the mobile number (SIM), the primary email account used for account registration and the smartphone used primarily for the account's device binding.

“Your will should define and identify important digital assets and provide executors and trustees with appropriate directions and powers to deal with them. It would be preferable to assign trustees who are familiar with technology with the role of managing your digital affairs after death according to the will's instructions,” he says.

Law also recommends recording our afterlife technology instructions regarding each account separately to ensure these instructions are secure but accessible to the technology custodian.

“Like any estate, your trustees (or fiduciaries) would be more confident if you had your wishes and instructions clearly laid out in writing. Also never disclose your passwords within the will, but this should not be a problem if it is drafted by a professional,” he adds.

In terms of mobile number transfer, telecommunication service providers do have an established process in place. As an example, Maxis has published FAQs on life events, including ownership transfer due to deceased owners.

For primary email account access, ensure that your trusted transferees can accomplish a password reset by using their verifiable credentials, such as one-time password (OTP) verification to the transferee's mobile number or alternative email address.

“Depending on the context, the trustee may not be empowered to manage these affairs, even though they are willing. For example, Facebook's general policy is to discourage third parties from managing personal accounts, as they may act as impersonators. However, Facebook does have a legacy contact tool to allow the next of kin to memorialise or terminate the account,” Law shares.

“Google has a similar Inactive Account Manager service that allows a designated person to extract remaining funds, retrieve data or close the deceased user's account entirely. These instructions are not just limited to the person's death. Do also consider events such as the person being incapacitated or encountering total permanent disability.”

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.