The Shoebox of Logins: Inside a Yorkshire Firm's Digital Probate
The drawer under the till at Ellams Fabrication in Huddersfield had been locked for as long as anyone could remember. When Margaret Ellams handed the keys to her son Daniel last spring, after three decades of tooling and turning, she handed him that key too.
Inside: a Muji notebook with 'LOGINS' written on the cover in biro, two USB sticks, a laminated card with the BT account number, and a Post-it reading simply 'don't cancel the GoDaddy one'.
Daniel thought he'd inherited the business. In a very real sense, he'd inherited its paperwork — and in 2025, the paperwork is mostly passwords.
Twenty Years of Yes
The notebook ran to 47 entries. Some were current. Some had been dead for a decade. Between them sat the archaeology of a small firm's digital life: the web host from 2009, the abandoned Sage account, the email marketing tool they'd tried for one Christmas campaign in 2014, a domain registered in 2003 that nobody could explain.
"I spent a full week just working out what we were paying for," Daniel says. "There were four subscriptions coming off a credit card my dad still had. £340 a month, roughly. Some of it for software we hadn't opened since lockdown."
This is digital probate, and almost no family firm is ready for it. Unlike a will, there's no solicitor holding a tidy folder. Unlike the premises, there's no deed. There's just a shoebox — or, more often, nothing at all.
The Three Traps
Working through Ellams' inherited accounts, three problems kept recurring, and they'll be familiar to anyone who's taken over a parent's business.
Trap one: the personal email. The company's Google Workspace, its domain registrar, its accounting software — all registered under Margaret's personal btinternet.com address. Her son couldn't receive a single password reset. Every recovery route ran through an inbox belonging to someone who no longer worked there.
Trap two: the two-factor lock. Sensible security in 2019 became a brick wall in 2025. The firm's Companies House WebFiling account, its banking app authorisation, its main email — all tied to a mobile number Margaret had retired along with the rest of it.
Trap three: the silent direct debits. The £340 a month wasn't the worst of it. A dormant company credit card was still funding a website builder, a stock photo subscription and — inexplicably — a US-based invoicing tool billed in dollars. Nobody had noticed because nobody was looking.
Digging Out, Account by Account
The untangling took Daniel roughly six weeks of evenings. His method was unglamorous but transferable:
- Follow the money first. Export twelve months of statements and list every recurring payment. The subscriptions tell you what the software stack actually was, regardless of what the notebook claims.
- Claim the domain before anything else. The domain is the keystone. Once Daniel had registrar access, he could reroute email and prove ownership of the web presence to every other provider.
- Change the recovery email, then the password, then the 2FA. In that order, for every account that matters. A new recovery route on a company-owned address turns a personal account into a business asset.
- Kill on sight. Anything unused for two billing cycles got cancelled and noted in a fresh, shared password manager. The old notebook was retired with honour.
The domain nobody could explain? It turned out to be a misspelled version of the company name Margaret had bought defensively in 2003. It now redirects, at least.
Write the Shoebox Before You Need It
The obvious lesson is the one nobody acts on: document the digital estate while you're still around to document it. Not in a notebook in a drawer — in a proper password manager with an emergency access feature, a company email as the primary recovery route on every business account, and a one-page 'digital will' listing what exists and who owns it.
Margaret, to her credit, took it well. She sat with Daniel for an afternoon, closed the last of the zombie accounts, and moved her own personal affairs onto the same system.
"She said the notebook had worked fine," Daniel laughs. "I said yes — for the person who wrote it. That's the whole problem."
The Evolved take: your business's digital estate is an asset with no deed. Treat it like the roof — inspect it before there's a leak, and for heaven's sake, don't cancel the GoDaddy one.
