How big is the problem?
The headline figure is that 94% of Americans have at least one dormant account. to use different passwords for different accounts, so that a stolen password for one can't unlock the others. It also recommends multi-factor authentication. The FTC separately advises choosing security-question answers that others can't find online, such as birthplace or mother's maiden name. An old forum profile holding that sort of detail is a small but real liability.
Method 1: Search your inboxes
Nearly every sign-up leaves an email behind, so start there. How-To Geek's Diana Todea suggests searching your mail for phrases like "welcome," "sign up," "verify your email," "account ready" and "free trial." For accounts you tried to recover, try "forgotten password" and "account reset." Use your mail service's date filters to narrow results to older messages.
Practical tips:
- Repeat the search in every address you've ever used, including old ISP, school or work addresses you can still reach.
- Keep a list of service names, but never passwords, in your notes or spreadsheet.
- Remember that deleted, filtered or spam-trapped mail won't show up. An empty search is not proof that no account exists.
Method 2: Mine your saved logins
Browsers and password managers are often accurate records of your past. Open your browser's saved-passwords or password-manager page and read the list. You'll see sites you've forgotten, along with weak or reused passwords that need replacing. Browsers may also store payment cards and addresses, which are worth reviewing and pruning.
A saved login can be stale, and an account can exist without one, so this is a lead list and not a complete inventory. Dedicated password managers often flag breached credentials, but as the source notes, those checks aren't foolproof. A manual review is still worthwhile.
Method 3: Check social sign-in connections
"Sign in with Google" is convenient, and it makes it easy to collect accounts you never think about again. Google's help documentation says your Google Account's linked-apps page can show several kinds of connection: Sign in with Google, linked accounts, and third-party access to your account data.
The key warning is that removing a Sign in with Google link stops automatic sign-in but does not delete your data in the app. So unlinking only reveals the account. To get rid of it, you still have to sign in to that service, or contact it, and delete the account there. Removing a data-access link can also break features that rely on it. How-To Geek also points to Facebook's "Apps and websites" section. Menu names change, so check the platform's current settings instead of relying on a fixed path.
Method 4: Use breach and footprint checks as clues
Breach reports can name services you'd forgotten.
- Malwarebytes Digital Footprint Scan. Malwarebytes describes it as a free tool. You verify your email address and sign in to a Malwarebytes account to run it. It reports exposure such as social accounts, stolen old passwords and where the data leaked from. How-To Geek also says it covers phone numbers and shows the beginning of exposed passwords. I couldn't confirm those two details in Malwarebytes' own documentation, so check them in the tool.
- Have I Been Pwned. It's useful when you've lost access to an address, since on-demand searches don't require ownership. Its FAQ cautions that it holds only a small subset of all breached records, so a clean result proves nothing. Sensitive breaches are only visible to the verified owner of the address, and notifications can't be set up for addresses you can't access.
HIBP also says your address can appear against a site you don't recall for several reasons. The data may have been acquired by another service, the site may have rebranded, or someone else may have signed you up. A hit is a prompt to investigate, not proof you opened that account.
Method 5: Search your old usernames
If you reuse handles, tools like WhatsMyName and IDCrawl can search public sources for matching profiles. WhatsMyName's own documentation says a username match should not be treated as confirmed identity, and that sources may block or rate-limit requests. "Not found" can also be a temporary failure. Open each result and check it yourself, and use these tools only on your own handles. I didn't verify IDCrawl's accuracy or privacy practices.
Cleaning up what you find
Finding accounts is only step one. How-To Geek's advice, with some refinements:
- If you can still sign in, delete the account in its settings, or ask support to do it.
- If you're keeping it, set a unique password in a password manager, remove stored payment details and turn on multi-factor authentication.
- If deletion isn't possible, reduce the data held. Be careful with the advice to strip your email and phone number and use a burner address. Those details may be needed for recovery and security notices, so only remove them after you've secured the account and confirmed another way back in.
- If you're locked out, check older devices for a live session. Otherwise contact support about ownership verification. Success isn't guaranteed.
Information Security Buzz also quotes Black Duck's Boris Cipot warning that emails from services you no longer use may be phishing. His advice is to go to the site directly instead of clicking the link.
The Microsoft angle: don't forget your own clock
Microsoft's activity policy says you must sign in to your Microsoft account at least once in a two-year period to keep it active, and otherwise Microsoft will consider the account inactive. There are exceptions, including accounts with purchases, and an inactive account that has granted consent for an active minor's account won't be closed for inactivity. Forbes reported the two-year window took effect on August 30, 2019, replacing a five-year period.
This cuts both ways. An old Outlook, Xbox or Minecraft login you want to keep needs a sign-in before closure, since Microsoft Q&A answers say closed accounts can't be recovered. One in that thread also says accounts with purchases may be exempt, but check the policy for your specific case. Equally, an old Microsoft account you never want back is better closed on purpose than left to lapse with data attached.
Bottom line
None of these methods is complete, and each produces leads, not verdicts. Combined, they give a decent map. Search your mail, review saved logins, check connected apps, run breach checks, then try your usernames. Delete what you can, lock down what you keep, and treat every result as something to verify before you act on it.