A Roommate Moves Out in October. Which Passwords Actually Have to Change

Lease turnover clusters. Most residential leases in the United States start and end at the top of a month, and a large share of them land between June and October, which means a household that has been stable since last fall suddenly loses a name from the mailbox and gains one. The keys come back. The passwords, mostly, do not, because nobody made a list of them and because several of the accounts involved are not owned by anyone who lives in the unit. That gap is where the practical security work sits, and it is smaller than it looks once you separate the accounts by who actually controls them.

Three piles, sorted by who holds the account

The first pile is what the household owns outright: the internet service account, the streaming subscriptions, the shared grocery delivery login, the utility accounts in a tenant's name. The second is what the landlord or management company owns and issues to you: the rent payment portal, the maintenance request system, the resident app that also opens the lobby door. The third is the physical-digital hybrid, the smart lock code, the garage opener app, the building intercom entry that rings a phone. Sorting them this way matters because your remedy is different in each pile. In the first you reset. In the second you request. In the third you usually have to ask who is even holding the administrator account.

The advice that was withdrawn, and what replaced it

For roughly fifteen years the standard corporate rule was a forced change every sixty or ninety days, plus a symbol, a number and a capital letter. The National Institute of Standards and Technology, which is responsible for the federal digital identity guidelines that most of that practice was drawn from, revised its position: routine calendar-driven expiration is no longer recommended, and length matters more than the character-class puzzle. Rotation is now event-driven. You change a password when there is a reason to believe it is exposed, and a person who lived in your apartment for two years, knew your Wi-Fi passphrase and watched you type your streaming login is a reason, even when the parting was friendly and nothing at all went wrong.

That shift is unusually convenient for renters, because it maps onto the calendar a lease already imposes. Move-out is an event. So is a breach notice, a lost phone, a device that went to a repair shop with a saved browser session on it. Between those events, the current advice is to leave good passwords alone and spend the effort on the two things that carry more weight: a distinct password for every account that touches money, and a second factor on the handful that would hurt most if lost. That is a shorter list than the ninety-day habit produced, and it holds up better.

The accounts you cannot reset yourself

The rent portal is the awkward one. In most arrangements each resident has an individual login tied to an email address, and removing a departed co-tenant is an administrative action taken by the management company, not by you. Ask for it in writing at the same time you ask for the security deposit accounting, because both belong to the same move-out paperwork and one email can carry both. Smart lock codes work similarly. Where a landlord controls the lock platform, the code assigned to a departing tenant is theirs to revoke, and a written request creates the record that the request was made. If your lease is silent on who resets access credentials, that silence is worth resolving before the next turnover rather than during it.

Consumer protection here is real but indirect. The Federal Trade Commission oversees unfair and deceptive practices in how companies handle consumer data, and a management company that keeps a former tenant's access live after being told to close it is on notably weak ground. You do not need to threaten anything. You need a dated message, a name, and a reply. Most offices close the account the same week when asked plainly, and the ones that do not have given you the only document that matters later.

The week-to-week version

Recovery paths are the part people miss. An account can have a brand new password and still be reachable by whoever controls the recovery email or phone number on file, which in a shared household is sometimes the person who just moved out. Check that field on the four or five accounts that hold a card number. Change the Wi-Fi passphrase once, on the day the keys come back, and write the new one somewhere the current household can find it. Then stop. The rest of the year, the useful habit is not rotation but attention: opening the breach notices, reading the login alerts, and treating an unexpected password reset email as the alarm it usually is.

Turnover season gives renters a natural checkpoint that most households never schedule for themselves, and the current guidance asks for exactly the kind of work that fits inside it. One afternoon at move-out, one written request to the management office, and the accounts that matter are back under the control of the people paying the rent.