How to Protect Your Retirement Savings from Cyber Fraud

A 2024 Fidelity 401(k) data breach highlighted a growing risk facing retirement savers: Cybercriminals targeting retirement accounts. As hackers exploit phishing, social engineering, and call center weaknesses, we recommend investors actively monitor and protect their retirement accounts to avoid devastating financial losses.

Why Retirement Accounts Have Become a Prime Cyber Target

In August 2024, Fidelity Investments disclosed a data breach affecting certain 401(k) accounts.

According to reports, cybercriminals exploited weaknesses in call center procedures, gained access to participant information, and, in some cases, drained retirement accounts entirely.[1] 

Fidelity has reimbursed affected investors, but lawsuits are now pending.

It’s terrifying to think your retirement savings could be drained overnight. 

As unsettling as that sounds, it’s happening.

Criminals know retirement accounts are valuable targets. 

They also know many investors take a set-it-and-forget-it approach, rarely checking their accounts. 

By the time a problem is discovered, the damage is often done.

The reality is this: You can’t just contribute to a 401(k) or IRA and assume it’s safe anymore. 

In addition to managing how your money is invested, you now have to pay attention to how it’s protected.

Below, we’ll walk through how retirement accounts are hacked – and how to protect your retirement savings from cyber fraud. 

How Retirement Accounts Are Hacked

When it comes to retirement accounts, it is often a matter of account takeover via stolen login information from phishing scams or malware attacks.

Here are the most common ways retirement accounts are hacked. 

AI-Driven Phishing Attacks

Cybercriminals are using AI to create highly convincing phishing emails that can bypass traditional security. 

These attacks pose a serious risk to both participant savings and plan sponsors, who could face fiduciary breach claims under the Employee Retirement Income Security Act (ERISA).

Social Engineering & Credential Theft

Most hacking incidents, especially those targeting seniors, are the result of social engineering where attackers impersonate trusted institutions (like a plan provider) to steal login credentials. 

The goal is often to trick a user into providing a password or a one-time verification code.

Call Center Vulnerabilities 

Breaches can occur by exploiting weaknesses in provider call centers, where a hacker might successfully impersonate a participant or even an employee to gain access.

What Laws Protect Your 401(k) from Cyberattacks?

The law that governs 401(k)s, the Employee Retirement Income Security Act (ERISA), hasn’t fully addressed cyber fraud prevention and response measures. 

This ambiguity can leave 401(k) investors in a tough spot.

Many plan providers promise to return stolen funds, but the fine print sometimes suggests they could find ways to avoid fulfilling that promise. 

Some only cover you if you follow certain security practices.

While 401(k) providers invest in cybersecurity, your own vigilance is often the best defense. 

11 Ways to Protect Your Retirement Savings from Cybercriminals

Even with cybersecurity for retirement accounts at the top level, you must take steps at the personal level to help protect your retirement savings. 

• Create long, unique passwords. Experts recommend using password phrases. These are lengthy phrases consisting of multiple words and numbers that would be difficult for hackers to guess (no Abcde or 1234). Also, don’t use this password for anything else.
  

• Use multi-factor authentication. Use multi-factor authentication when accessing any site that includes PII (personally identifiable information). This requires the user to not only submit a password but also gain access via an additional code sent by text message or email.
  

• Use fictional answers for security questions. Further protect yourself and use fake answers. For example, if you use your mother’s maiden name as an answer, hackers might have this info.
  
  
• Do not click on a link in a text or email. A good rule of thumb is just don’t click on links that appear to be from your plan provider, bank, etc. Instead, log in to the app or your online portal and check your notifications. If you are suspicious, call the institution and ask if they sent it.
• Be careful of text messages or phone calls. You might be thinking you are speaking to your plan provider or your bank, but it’s a scammer. Never give important information over the phone. Never give your pin, Social Security number, or account information. Hang up and use the number on your retirement statements and call the institution.
   
• Do not give out PII or account information. Often, retirement accounts are breached because an individual provides a criminal with personal information unknowingly. Be skeptical. You should never give out personal information (such as login information or banking information) over the phone, text message, or email. Always verify the sender requesting information.
  

• Avoid public Wi-Fi. Free Wi-Fi networks allow cybercriminals to gain access to personal information.
  

• Sign up for security alerts. Sign up for security alerts with your bank and credit card company. In addition, monitor your credit reports and banking statements for any unauthorized transactions.
  

• Monitor your retirement accounts. Stay aware of what is happening with your 401(k) account. It’s imperative that you read your 401(k) statements. The sooner you recognize discrepancies, the better.
  

• Know your 401(k) plan’s security measures. Make yourself aware of your plan’s security measures. What steps are taken to ensure your retirement account is safe? How do they verify account changes are valid? Knowing this information upfront will help you decipher a phishing scam from the real thing.
  

• Educate yourself on cybercrime. Take time to learn new strategies cybercriminals are using to gain access to personal information. Learn how to identify phishing emails. Don’t click on links. Don’t open emails or texts you don’t recognize. 

What to Do If You Are a Victim of Retirement Cyber Fraud

If you are the victim of retirement cyber fraud, there are steps you can take to be reimbursed.

Contact your plan sponsor immediately. 

After that, you need to file a police report. You may also need to contact the FBI or the Department of Homeland Security and file a report with them. 

One important tip: While plan sponsors and fiduciaries may have cyber fraud security, there may be contingencies that make it harder to be reimbursed. 

For example, if you wait too long to report potential cyber fraud, the money may be lost. 

Sources

[1] SC Media. Fidelity Investments confirms August breach affected 77,000 customers. Published October 2024.