John E. Chapman Chief Executive OfficerAt the start of each year, conversations with business owners and HR leaders often focus on how the plan is working for employees: participation and savings rates, recent SECURE 2.0 and policy changes, and whether the plan’s design and features are helping people make progress toward retirement. Additionally, there is one more topic that belongs on that list: the growing risk of identity fraud and cyberattacks targeting retirement accounts, and what you can do to help protect your participants.
Regulators and industry data point to a sharp rise in fraud and cyber-related losses. Consumers reported losing more than 10 billion dollars to fraud in 2023, an increase of over 1 billion dollars in just one year. According to a recent Federal Trade Commission report to Congress, total fraud losses reported by adults aged 60 and older increased about fourfold from roughly 600 million dollars in 2020 to 2.4 billion dollars in 2024. One leading retirement-plan provider notes that Americans lost a record 16.6 billion dollars to cyberattacks in 2024, with criminals increasingly targeting retirement plans because of their large balances and rich personal data.
The Department of Labor has also made it clear that plan sponsors have a fiduciary responsibility to address cyber risk, issuing formal guidance on cybersecurity best practices for retirement plans and their service providers.
Why 401(k) Accounts Are Being Targeted
For employers, this is not just an IT issue; it is a plan and people issue. Identity fraud has become more personal and more sophisticated. Rather than only trying to breach systems, criminals often deceive individuals and plan administrators through social engineering. Tactics include phishing emails that mimic your recordkeeper, fake customer service calls, fraudulent loan or withdrawal requests, and rollover scams promising “better” investments. Others use SIM-swap attacks to intercept verification codes or steal mail containing distribution or rollover checks.
Because retirement accounts are designed for long-term growth, unusual activity can go unnoticed longer than in checking or savings accounts. That delay can increase losses, create operational headaches for HR and Payroll, and expose sponsors to questions about governance and vendor oversight.
Guidance for Plan Sponsors
While cyber risk cannot be fully eliminated, plan sponsors can take meaningful steps to set expectations, select strong partners, and integrate fraud awareness into ongoing governance. As co-fiduciary advisors, we support and reinforce thoughtful practices such as:
- Confirming that recordkeepers and key service providers maintain documented cybersecurity programs and controls aligned with Department of Labor guidance.
- Including cyber and identity fraud as a recurring topic on the plan committee agenda—alongside investments, plan design, and participant outcomes.
In addition, we encourage plan sponsors to consider complementary internal practices, including:
- Establishing a clear escalation process so HR, Payroll, and employees understand what to do and whom to contact if suspicious activity arises, in coordination with internal IT and existing policies.
- Reinforcing fraud-prevention awareness through enrollment meetings, webinars, and financial wellness conversations throughout the year.
- Building a simple escalation process so HR, Payroll, and employees know exactly what to do and whom to contact if something looks suspicious. Consider creating a separate compliance/cyber policy that outlines this. Lean on your in-house or outsourced IT team to support the development of these processes.
- Incorporating fraud-prevention topics into enrollment meetings, webinars, and financial wellness conversations throughout the year.
Your employees look to you and your partners for guidance, so even simple reminders can make a meaningful difference in protecting their accounts.
How Clearwater Can Support You
Your 401(k) represents years, and often decades, of disciplined saving for your employees and is a visible reflection of how your organization shows up for its people. While investment risk is part of long-term growth, identity fraud is a risk that can be significantly reduced when sponsors set clear expectations, partner with the right providers, and help participants take proactive steps aligned with emerging regulatory guidance.
Sources: Federal Trade Commission, TIAA, U.S. Department of Labor, Alliant Retirement Consulting, IdentityTheft.gov
20260330 – 2
