How to Create a Memorial Website Without Exposing Your Family to Identity Theft

The biggest security risk when creating a memorial website is the information you publish in the obituary and tribute page itself. A public obituary that includes a full name, date of birth, maiden name, home address, and surviving family members can expose details that identity thieves may use to attempt fraud — and the deceased cannot monitor suspicious activity themselves. Here is how to build a memorial that honors your loved one without creating a security vulnerability for the entire family.

Identity theft using a deceased person's information is a recognized risk. The FTC says that updating the person's credit file to show they are deceased can make it harder for someone to misuse their identity.

The Three Security Layers

Protecting a memorial website and the people connected to it requires three coordinated layers: what you publish, what you lock down, and which platform you choose.

Layer 1: What You Publish

The memorial page itself is the primary attack surface. Every piece of biographical data you include is potentially useful to someone committing identity fraud.

Information to omit from any public memorial:

• Exact date of birth (use year only, or age at death)
• Mother's maiden name
• Home address or street name
• Schools attended with graduation years (common security question answers)
• Employer names with specific job titles and dates
• Maiden names of surviving female relatives

Lower-risk information to include:

• First name and surname of the deceased
• General age or decade of birth
• City and state of residence (no street address)
• General career field without employer names
• Names of surviving family members (first names only, no maiden names)
• Memorial service location and date

The principle is simple: anything that could answer a security question or verify an identity application should stay off the public page. A tribute that says "beloved teacher in Portland for thirty years" is just as meaningful as one that says "taught at Jefferson High School from 1992 to 2022" — and far less useful to a fraudster.

Layer 2: What You Lock Down in the First Week

Prompt credit-bureau notification can help reduce the risk of identity theft using a deceased person's information. The Creating a Memorial Website or Tribute Page toolkit includes a day-by-day first-week security protocol. The critical steps:

Days 1–2:

• Notify a credit bureau in writing and request a deceased indicator on the file; send a copy of the death certificate and the deceased's legal name, Social Security number, date of birth, and date of death. This indicator tells creditors that the consumer has died; it is not a credit freeze. TransUnion says one bureau notification prompts it to notify the other two.
• Notify the Social Security Administration of the death so it can update its records and address benefits due.
• Secure all devices with the deceased's saved passwords, biometrics, or passcodes before they auto-lock or get factory-reset by a family member who does not know the consequences.

Days 3–5:

• Notify the deceased's bank and financial institutions. Account freezes prevent unauthorized transactions but also prevent legitimate estate access, so coordinate with the executor.
• Change or disable two-factor authentication only on accounts you are authorized to manage under the applicable platform legacy setting, legal instrument, or terms of service; RUFADAA sets that priority order.
• Opt out of data broker sites that have already indexed the obituary.

Days 6–7:

• If you need to act for the estate before the IRS, file IRS Form 56 (Notice Concerning Fiduciary Relationship) to notify the agency of your fiduciary role; it does not block fraudulent tax returns.
• Register the deceased with DMAchoice's Deceased Do Not Contact List, operated by the Association of National Advertisers, to reduce marketing mail.

Layer 3: Which Platform You Choose

Not all memorial platforms handle security equally. Some free-tier platforms use programmatic advertising or share visitor data with partners. Some platforms also make memorial pages public or search-indexable by default, so check privacy and indexing settings before publishing.

When evaluating a platform, check:

• Default privacy setting: Is the page public or private by default? Can you restrict access to invited viewers only?
• Search engine indexing: Can you toggle between public search indexing and unlisted or password-protected access?
• Visitor tracking: Does the platform use third-party advertising cookies? Does it share visitor data?
• Data portability: If you need to move the memorial to a more secure platform later, can you export all content in standard formats?

The toolkit's seven-platform comparison matrix scores every major provider on these criteria. Platforms like Online-Tribute and Keeper offer documented zero-tracking, zero-ad policies with robust privacy controls. Free-tier platforms like ForeverMissed and Ever Loved display third-party ads and have less transparent data practices.

Who This Is For

• Any family member creating a public-facing memorial who wants to minimize identity theft risk for the deceased and surviving relatives
• Executors who want to protect estate property and reduce the risk of fraudulent use of the deceased's identity
• Families where the obituary has already been published and needs to be audited for exposed security-relevant data
• People creating memorials for high-profile individuals or anyone with a public-facing professional history

Who This Is NOT For

• Families creating a private memorial shared only with known, invited individuals — the identity theft risk from the memorial itself is minimal in a closed-access context
• Situations where a funeral home is handling all public-facing communications and the family is not publishing anything independently

Frequently Asked Questions

Can identity thieves really use obituary information to open accounts?

An obituary can expose personal details that someone could use in an identity-fraud attempt, and the deceased cannot monitor their own credit. A family member or executor can ask a credit bureau to mark the file as deceased.

How quickly should I notify a credit bureau of the death?

As soon as practical. The toolkit's workflow targets a credit-bureau death notification within 30 days. A deceased family member's credit report cannot be frozen; send a written death notice and death certificate to one bureau, which TransUnion says will notify the other two. Include the deceased's legal name, Social Security number, date of birth, and date of death. Executors and other non-spouse representatives should also include identification and proof of authority.

Does a private memorial page eliminate the identity theft risk?

It reduces the risk from the memorial itself, but not from other sources. Obituaries published in newspapers, funeral home websites, or social media posts by well-meaning friends can still expose security-relevant data. The first-week security protocol in the toolkit covers all exposure vectors, not just the memorial page.

What if the obituary has already been published with sensitive information?

Contact the publication to request removal of the most sensitive details (date of birth, maiden name, address). For online versions, request de-indexing from search engines. Ask a credit bureau to mark the deceased person's file as deceased if you have not already. The toolkit includes specific communication scripts for requesting obituary modifications from publishers.

Can an obituary create identity risk without publishing the deceased's Social Security number?

Yes. A public obituary can expose other sensitive details. The toolkit's audit recommends excluding full dates of birth, middle names, and mother's maiden names; never publish an SSN or other private identifiers.