By law, states must hold onto long-forgotten bank accounts, security deposits, IRS refunds and more -- adding up to billions in unclaimed property.