A Roommate Moves Out and the Shared Logins Stay Behind. What the Handover Looks Like Now
A shared rental changes hands twice, ten years apart, and the same move-out task turns from a fridge note into a twenty-minute account handover.
The task looks identical on both ends of a decade. Somebody on the lease leaves, the rest of the household stays, and a set of shared accounts that were opened casually in a kitchen now belong to nobody in particular. What follows is a composite, assembled from the pattern that repeats in shared rentals rather than from one address: a three-bedroom unit, three tenants on one lease, one turnover in the middle of the 2010s and another this year. The accounts were roughly the same both times. The correct response was not.
The 2015 version: one password, written down, changed on the way out
In the first turnover the shared surface was small and flat. There was a router with a printed password on a sticker, an electric account in one tenant's name, a streaming subscription split three ways, and a building parking permit portal that emailed a plain text reminder if you asked it to. When the departing tenant left, the remaining two changed four passwords in about ten minutes and considered the job done. Nothing about that was careless by the standards of the time. The advice everyone had absorbed was that a password was the whole lock, so replacing the password replaced the lock.
It half worked. Changing the streaming password did not sign out the old phone, because the service kept the session alive until the device asked again, which it did not. The electric account stayed in the departing tenant's name for two more billing cycles because nobody wanted the conversation about the deposit. The router password changed, but the guest network kept its old key, and the old key had been given to a friend of a friend during a move-in weekend. None of this produced a disaster. It produced a slow tail of loose ends that the household discovered one at a time, usually at an inconvenient hour.
What changed in the guidance, and why it matters to a renter specifically
The federal digital identity guidance that most corporate password rules were built on is maintained by the National Institute of Standards and Technology, which is responsible for that standard, and the direction of travel over the past decade has been away from complexity theater and toward length, breach screening and second factors. For a household that shares a bathroom rather than an IT department, the practical translation is narrow. Rotating a password on a schedule buys you very little. Making it long, unique to that account, and backed by a second factor buys you most of what there is to buy. That single shift changes what a move-out handover has to accomplish.
It matters more to renters than to owners for a structural reason. A tenant's accounts are attached to a unit for a fixed and often short term, held jointly with people they did not choose, and tied to a landlord's portal they do not control. Ownership of the account and occupancy of the apartment come apart constantly. The utility is in one name, the internet in another, the rent portal registered to whoever filled out the application first. When someone leaves, the question is not only who knows the password but whose identity the account legally sits behind.
The current version: sessions, recovery, and who the account belongs to
In the recent turnover the same household worked a different sequence, and it took about twenty minutes with everyone in the room. They started with the accounts that hold money or identity rather than the ones that hold entertainment: the rent portal, the renters insurance policy, the electric and internet accounts. For each one they asked three questions in order. Whose name is on it, who currently has an active session, and what happens if the person named on it stops answering their phone. Only then did they touch passwords, which turned out to be the easiest part of the whole exercise.
Two steps did the real work. They used the sign out everywhere control that most services now expose, which kills active sessions rather than just changing the credential, and they moved the second factor off the departing tenant's phone number before anyone reset anything. That second step is the one people miss. A password change is worthless if password recovery routes to a phone that just moved to another state. Where a service offered printed recovery codes, they generated a fresh set, and put it in the same envelope as the spare mailbox key, which was the only shared physical location all three tenants already trusted.
The week-to-week reality once the handover is done
Between turnovers, almost nothing happens, and that is the point of doing it properly once. The rent portal gets touched monthly, the insurance portal maybe twice a year, the electric account only when a bill looks wrong. The router password gets shared with a guest a few times a season, which is why a separate guest network with its own key stopped being an optional nicety and became the thing that keeps the main key from circulating. The habit that holds all of it together is unglamorous: one shared vault for the accounts the household genuinely shares, and personal accounts kept firmly out of it, so that a move-out touches four entries rather than forty.
The 2015 household was not doing anything wrong. They were following the advice that existed, which was to treat the password as the lock. The current household treats the password as one of three things that matter, alongside the live session and the recovery path, and the handover is faster for it.
If you are the tenant whose name ended up on the utility account, the useful move is to write down which accounts those are before anyone gives notice. The list is almost always shorter than people fear, and knowing it turns move-out week into an errand instead of a search.