What to do if…
you receive a notice that an online account will be deleted soon for inactivity
Short answer
Don’t click links in the message. Go to the service by typing the address yourself, sign in, and immediately export/download anything you’d be upset to lose.
Do not do these things
- Don’t log in via buttons/links in the email or text (these notices are commonly mimicked by scammers).
- Don’t “confirm your password”, one-time codes, or recovery codes in response to a message.
- Don’t ignore it assuming you can recover everything later — deletion can be irreversible once it happens.
- Don’t start changing lots of security settings until you’ve confirmed you’re on the real site/app (panic-clicking can lock you out).
- Avoid using a public/shared computer if you can. If you must, use a private/incognito window, don’t save passwords, and sign out fully.
What to do now
-
Pause and treat it as potentially fake until proven real.
Don’t click anything in the notice. Open a fresh browser/app and type the service name/address yourself (or use a bookmark you already trust). -
Verify whether the account is actually at risk inside the account settings.
Once signed in via the real site/app, look for items like “Account status,” “Inactive,” “Deactivation,” “Closure,” “Data retention,” or “Security notices.” If there’s no warning inside the account, assume the message may be a scam. -
If you want to keep the account, do a small, reversible action that often counts as “activity” (it varies by provider).
Don’t do anything risky. Examples that often count include: signing in, using a core feature briefly (send a test email; open/edit and save a document), or confirming you still control the account. Then sign out and sign back in once to confirm you still have access. -
Immediately download/export your data (even if you plan to keep the account).
Look for Export / Download your data / Transfer your data / Archive / Backup. Prioritise:- Anything irreplaceable: photos, messages, contacts, documents, notes
- Anything that proves ownership: receipts, licences, purchase history, subscriptions
Save exports in two places (for example: your computer + an external drive, or two separate cloud storage accounts).
-
Do a quick security check (high-impact, low-drama).
- Check recovery email/phone are current and belong to you.
- Turn on two-step verification if available.
- Review recent sign-ins/devices and sign out of anything you don’t recognise (if the service provides this).
-
If you can’t sign in, move fast but stay on official routes.
- Use the provider’s “Can’t sign in?” / “Forgot password?” flow from the real site/app.
- Take screenshots of any error codes and the stated deadline.
- Use the provider’s official help centre route — avoid “support” numbers found in messages or ads.
-
If this is a work/school account, notify the right person today.
Contact your IT/admin/helpdesk and share: the account address, the deletion deadline, and what data is at risk. Organisational accounts often have different retention rules and only admins can stop deletion. -
If you suspect it’s a scam, report it using UK routes and contain it.
- Forward suspicious emails to report@phishing.gov.uk. Forward suspicious texts to 7726 (free).
- If you think you’ve been hacked or lost money, report it via Report Fraud (England/Wales/Northern Ireland). In Scotland, report to Police Scotland (101) if you’ve been a victim.
- Mark the message as phishing/spam in your email app.
- If you clicked a link or entered details: go to the real site/app and change your password, and review recent login activity.
What can wait
- You don’t need to decide whether to permanently leave the service today.
- You don’t need to reorganise your whole digital life or move everything perfectly right now.
- You don’t need to chase the “best” backup method — a fast export in two places is enough for today.
- You don’t need to debate policy details before you’ve secured a copy of your data.
Important reassurance
These notices are designed to create urgency — and scammers copy that style. Slowing down to verify the message first is the safest move. If you act in the right order (verify → sign in safely → export → secure), you usually avoid the worst outcomes even if the deadline feels close.
Scope note
This is first-steps-only guidance to prevent sudden data loss and account takeover. Later, you may want specialist help for account recovery disputes, business accounts, or complex data migration.
Important note
This is general information, not legal, security, or IT advice. Account policies vary by provider and account type; if you can’t confirm something inside the service itself, proceed cautiously and use the provider’s official support channels.
Additional Resources
- https://support.google.com/accounts/answer/12418290?hl=en
- https://www.microsoft.com/servicesagreement
- https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams
- https://consumer.ftc.gov/consumer-alerts/2025/04/protect-yourself-phishing-scams
- https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email
- https://www.reportfraud.police.uk/phishing/
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-data-portability/