Privacy Fix: How to Find Old Online Accounts
Consumer Reports has no financial relationship with advertisers on this site.
Consumer Reports has no financial relationship with advertisers on this site.
It's easy to forget about old accounts you've signed up for, including everything from photo-hosting sites to apps for household budgeting.
But even if you stopped using a service years ago, experts say it's important to find and delete it. Otherwise, the lingering data poses a risk to your digital privacy and security.
“Understanding what's out there about yourself on the internet, even those things in the past that we've left behind, is very important,” says Micah Hoffman, principal investigator at Spotlight Infosec, a cybersecurity consulting company that often works with individuals worried about their security.
“When there's a data breach or some other compromise of a system, attackers can grab usernames, passwords, and email addresses, and reuse those credentials to break into other accounts,” he explains.
In addition, once you give an app or website permission to access your calendar, contacts, or even bank accounts, it can continue doing that for years, whether you still use the service or not. You may be supplying a steady stream of personal data to online companies you've forgotten about.
Experts like Hoffman use advanced tools and techniques to help clients dig up old accounts and other digital breadcrumbs.
“But you don't necessarily have to engage somebody like me,” Hoffman says. You can do a lot of the work on your own.
I've been a heavy internet user for a long time. And even though I like to think my security practices are better than average, I used the steps below and found more than six dozen forgotten accounts of my own, spanning 15 years.
Most of those were accounts I opened once and never used again, while others were platforms I frequented for years before leaving them behind. Some of my old accounts had been hit by a data breach after I stopped using them, and many of the others displayed information about me that could be used for identity theft or other nefarious purposes.
You can start by just scrolling through lists of popular apps and services to jog your memory. A site called Justdelete.me maintains a list, and you can find a list of social platforms, along with directions on how to delete them quickly, elsewhere on Consumer Reports.
However, the targeted approach outlined below could be faster and more effective.
Search Your Username
Typing your favorite username into Google is a great way to find old accounts. Try old usernames, as well—you may have abandoned beatlesfan84 for a better handle, but your forum posts under that name may still be public.
Next, search for your name and email addresses—old and new. And don’t forget to put quotation marks around your search term when you’re looking for multiword keywords, like your name.
When you’re done with Google, repeat the process with other search engines, such as Bing and DuckDuckGo.
“Each one indexes different pages at different times, and has different cached content,” Hoffman says, so the results could vary.
Look for Old Emails
Hunting for old communications from websites, apps, and services is a good method for uncovering forgotten accounts.
“Start by focusing on the emails companies first send you when you sign up,” says Bobby Richter, who heads privacy and security testing for Consumer Reports. “Search your inbox for variations on phrases like ‘welcome to,’ ‘new account,’ ‘password,’ or ‘confirm your email.’”
Search for your favorite usernames, as well. If you’ve used multiple email addresses over the years, log in to them and look through their inboxes, as well.
Go Through Your Saved Logins
When your browser saves your usernames and passwords, it creates an easily accessible log of sites where you have accounts.
To see your saved logins in Chrome, click on the three dots in the upper right-hand corner, and open > Settings > Passwords.
In Firefox, open the menu from the top right > Preferences > Privacy & Security > Saved Logins.
In Safari, click the “Safari” tab at the top of the screen > Preferences > Passwords.
In Internet Explorer, open the menu in the top right > Settings > View Advanced Settings > Manage passwords.
The instructions above are for a computer, but the steps are similar on a phone. If you have multiple devices or old computers lying around, check their browsers as well. Consumers who use password managers should check those apps, too.
Check Your Google and Facebook Accounts
Many services let you log in using Facebook or Google credentials. Both platforms document every time you’ve done this, and those records are easy to find—a handy way to rediscover your Words With Friends account, if the app didn't make the cut last time you got a new phone.
To find this list on Facebook using a computer browser, click the downward arrow in the top right > Settings > Apps and Websites. Be sure to look through all three tabs (Active, Expired, and Removed) for a complete list.
For Google, go to any Google page (such as search or Gmail) > click the grid icon near the top right corner > Account > Security > Signing in with Google.
You can revoke apps' access to your Google and Facebook profiles, but this won't delete your account. First, log in to those services directly and take steps to get rid of them for good.
Other social media platforms, such as Instagram and Twitter, allow you to use your account to log in to other services, as well. Check their privacy settings for details.
Try Username, Privacy, and Security Sites
Some tools designed for other purposes can also help you locate old accounts.
For instance, sites such as Checkusernames.com, Knowem.com, and Namecheck.com let you type in a username to see whether it’s available on popular services. These sites exist mainly to help business people reserve brand and product names, but they can also help on your account hunt. If your usual username isn't available on a given service, that may indicate that you have an account with it.
Hoffman cautions that the results aren't always accurate but says the services are still valuable tools for your account search toolbox.
Next, go to HaveIBeenPwned, a website that can tell you whether your email address has been associated with a data breach. If it has, the culprit may happen to be a service you’ve forgotten about. Be sure to check your old or alternative email addresses, as well.
Last, try typing your name, usernames, and email addresses into a people search engine. These sites scrape social media websites, public records, and other sources of information, and aggregates the data in reports about individual people.
Privacy experts have raised a number of concerns about these services, but this is a case where you can use them to your advantage. Some of the search engines require payments, but a few, including Pipl.com, have free options. These may point you to forgotten social media accounts.
Avoid Search-and-Delete Services
Some companies promise to find and delete accounts for you. Typically, you need to give these apps access to your email account by entering your username and password so that they can search through your messages, find accounts, and delete them.
That might sound like a good way to save time, but experts say there are privacy concerns to consider.
“I would hesitate giving anything access to your email, because your inbox is incredibly sensitive,” CR’s Richter says.
The contents of your messages aside, email is what many services use to confirm your identity and operate two-factor authentication.
“Using one of these services is trading convenience for the risk of privacy invasions," Richter adds. "Even if a company has a really good privacy policy, you’re exposing yourself to other potential privacy and security problems.”
There are other reasons to steer clear as well. For consultants like Hoffman, a big part of the job is educating clients about privacy and security. He recommends against outsourcing the process to any company that won't work closely with you to provide a clear understanding of the steps being taken.
“You want to know which sites you’ve removed yourself from, so you have a better understanding of what information you’ve exposed in the first place, and make sure the job gets done right,” Hoffman says.
More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples
Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2019, Consumer Reports, Inc.
