Finding Every Account Tied to an Address

Time: ninety minutes the first time, twenty minutes a year after that. Repeat: annually, and before any address change.

Accept that there is no complete list, then get most of the way there

Start from the fact that nobody, including your provider, holds a list of the accounts registered with your address. There is no button for this. What exists are four separate records, each incomplete, which together account for nearly everything you have.

Ninety minutes gets you a list you can act on. Chasing the last few percent is where people give up and end up with nothing, so do the four passes below, accept the gaps, and add to the list over the following year as strays reveal themselves.

Start with the password manager and the browser

Export from your password manager first, because it is the only source that was designed to answer this question. A CSV of every saved login, sorted by site, is the backbone of the inventory and takes two minutes to produce.

If you have never used a password manager, the browser is holding the same data in less convenient form. Every major browser has a saved passwords page that lists sites and usernames, and every major browser can export it. Do this on each browser and each device you use, since the lists are rarely identical, and check the profile you use for work as well as the personal one.

Delete the export file when the inventory is finished. A plain text list of your logins is precisely the sort of thing you do not want to leave in a downloads folder.

Search your own mailbox with the right phrases

Search for the messages every service sends when an account is created, since that is the one message class almost nothing skips. These queries, run one at a time, surface accounts nothing else knows about:

"welcome to", "verify your email", "confirm your account", "your account has been created", "reset your password", "your receipt", "order confirmation", "subscription", "free trial", and the names of the payment processors that appear on your card statement.

Search the archive and the deleted items too, not just the inbox, and set the date range to everything rather than the last year. Write down the service name from each hit; you are collecting names, not reading mail, and it goes quickly once you stop opening messages. The password reset query deserves attention of a different kind: a reset you did not request is a signal in its own right, and if there are several, deal with a mailbox that has been broken into before continuing with the inventory.

Pull the list of sites you signed into with the mail account

Open your provider's security settings and find the section listing third party access and connected sites. Every account you created by clicking "continue with" instead of choosing a password is recorded there, and none of those accounts produced a welcome email you would recognise as an account.

This source is easy to overlook and it usually contains surprises: services tried once years ago, an app installed on a phone you no longer own, a site whose name means nothing to you now. Copy the names into your list. While you are in that screen, revoke anything you do not recognise or no longer use, since access granted years ago does not expire on its own.

Read the card statement for the accounts that never write to you

Go through twelve months of card and bank statements line by line, looking for recurring charges. This is the only source that catches subscriptions billing silently against an account whose emails you long ago stopped seeing.

Twelve months is the right window because annual renewals only appear once. Check any secondary cards and the payment services that sit between you and the merchant, where the descriptor on the statement often names the payment processor rather than the service. Where a charge is unrecognisable, the merchant name in the transaction detail usually identifies it, and if it does not, the bank can tell you who is billing.

Keep the inventory in four columns, outside the mailbox

Build one table with four columns: the service, the address it is registered to, whether it has a second factor, and what happens if you lose access to it. That last column is what turns a list into a plan, because it sorts the accounts by consequence rather than by alphabet.

Store the file somewhere that is not the mailbox you are inventorying. A document inside the account you might lose access to is not an inventory; it is part of the same failure. A password manager's secure notes, an encrypted file on your own machine, or paper in a drawer all work. Update it when you sign up for something significant, which takes five seconds and saves the next ninety minutes.

Know what these four passes still miss

Expect three categories to escape all four sources, and note them as gaps rather than assuming the list is complete.

Accounts that never sent a single message and never billed you, which are common on forums and small sites. Accounts on addresses you no longer use, which are only findable from those mailboxes; if one of them was a throwaway that has since expired, that is a different recovery problem with its own order of operations. And accounts created through a social network rather than an email address, which will not appear under any email search because there is no email involved.

For the second category, the practical answer is to run this same procedure in each old mailbox while it still exists. That is one of the better arguments for keeping an old mailbox alive rather than closing it the day you move.

Act on the list the day you make it

Do something with the inventory immediately, while it is fresh and while you still have the energy the search consumed. Three actions, in this order.

Close what you do not use. Fewer accounts means fewer places holding your data and fewer things to maintain, and closure is usually a two minute job on the service's own settings page. Add a second factor to everything holding money or identity, which is the shortest path from a long list to a safer one. Then change the address on the accounts that matter, working from this same inventory in the order set out in changing your email address.

Expect the inventory to also explain the volume of mail you receive, since every one of those accounts has an opinion about how often to write to you. Turning that off properly is its own procedure, and it works much better once you know who all the senders are. It is also the point at which the case for a separate compartment becomes obvious: signups you will never return to do not have to be on this list at all, because a self-deleting inbox never becomes an account you have to inventory.

The checklist

• Export the password manager, and every browser's saved logins, on every device.
• Search the whole mailbox for welcome, verification, receipt and subscription phrases.
• Read the provider's list of connected apps and sign-in grants, and revoke the dead ones.
• Check twelve months of card statements for recurring charges.
• Record everything in four columns and keep the file outside the mailbox.
• Close, secure and re-address in that order, then repeat the whole pass once a year.