Your 401(k) is the new identity theft target

An impostor phoned Alight Solutions, the recordkeeper for Colgate-Palmolive’s 401(k) plan, and identified herself as a Colgate employee. She asked to update the contact information on an account. Months later, the entire $751,430 balance had been sent in a single lump sum to a Las Vegas address and bank account. The real account holder, Paula Disberry, was living in South Africa.

Disberry sued Alight, Colgate’s benefits committee and BNY Mellon, the plan’s custodian, to recover the money. The case was later settled on undisclosed terms. The court never ruled on whether Alight had to restore the funds.

In February 2026, the Government Accountability Office told the U.S. Department of Labor to issue new guidance on retirement plan participant data. The GAO cited eleven separate lawsuits filed between 2009 and 2024 under the Employee Retirement Income Security Act, the federal law governing private retirement plans.

When account takeover hits a 401(k), the consumer protections that govern credit card fraud do not apply.

How the 401(k) account was drained

The Disberry case began when an impostor called Alight’s Benefits Information Center. She gave Disberry’s name, the last four digits of her Social Security number, her date of birth, and the mailing address Alight had on file. That was enough to clear the call center’s security check.

She then asked Alight to update the contact information on Disberry’s account. Alight did not send an alert to Disberry’s existing email address or phone number, both of which it had on file. Instead, the company issued a temporary password through the mail.

Disberry’s plan had a fourteen-day waiting period between an address change and any distribution. Her lawsuit alleged that Alight skipped it. Within weeks, the impostor logged in, requested a full payout, and BNY Mellon mailed a check to a Las Vegas address.

Why the 401(k) account takeover is not an isolated case

Heide Bartnett, a former Abbott Laboratories employee, sued Alight over a $245,000 401(k) distribution. She alleged that a hacker used the plan portal’s “forgot password” feature to reset her credentials and trigger the payout. Other retirement plan recordkeepers have faced similar cybertheft lawsuits.

The problem extends beyond 401(k) accounts. The FBI’s April 2026 internet crime report found that Americans 60 and older lost $7.7 billion to internet crime in 2025, a 59% jump from the year before. Investment fraud accounted for $3.5 billion of those losses, making retirement-age savers a major target for online criminals.

How thieves take over retirement accounts

Account takeovers begin with information someone already has. Names, dates of birth, partial SSNs, and email addresses appear in dark web breach dumps, often combined with leaked passwords from unrelated services. When the account holder reuses a password across accounts, hackers can test that breach data directly against the recordkeeper’s login portal.

Disberry’s takeover bypassed the login portal entirely. The impostor never logged in to Disberry’s account directly. She called Alight’s call center, used what she already knew about Disberry to clear identity verification, and had the contact information changed. After that, the temporary password Alight mailed went somewhere only the impostor could intercept.

Some thieves skip the recordkeeper and go straight for the account holder. The New York Times documented the case of Barry Heitin, a 76-year-old retired lawyer, who lost $740,000 in 2024 after receiving a call from someone claiming to be a federal fraud investigator. The caller convinced Heitin that his retirement accounts were under attack and walked him through transferring the money out himself. He believed he was helping a federal investigation.

How to protect your 401(k) and retirement savings

Federal protections for retirement account theft are limited, but several account-level controls cost nothing and may make takeovers harder.

• Turn on multi-factor authentication on the recordkeeper portal. A stolen password is far less useful when a one-time code is required.
• Enable every account-change alert. Email and text alerts for password resets, contact information updates, address changes, and bank account changes are the earliest signals that someone else has access to your account.
• Ask your plan administrator about distribution holds. Some plans impose a waiting period between an address change and any distribution. Get the policy in writing and confirm what triggers the hold.
• Review statements quarterly. A new bank account or a change in contact information shows up faster on a quarterly review than on an annual one.
• Get an IRS Identity Protection PIN. The six-digit PIN, available at irs.gov/ippin, blocks fraudulent tax returns filed using your SSN.
• Freeze your credit at all three bureaus. A freeze blocks new accounts from being opened in your name. Equifax, Experian, and TransUnion have offered free freezes since September 2018.

Where identity theft monitoring can help

Account-change alerts on the recordkeeper portal only work if the recordkeeper sends them. The Disberry case showed what happens when those alerts go unsent.

Aura lets members link bank, credit card, and investment accounts directly to its app and monitors them independently of the recordkeeper. When an unfamiliar transaction appears on a linked account, Aura sends an alert tied to it. In an account takeover, that means the bank account a thief redirects a distribution into can flag the deposit on the receiving side, even when the recordkeeper does not flag the outgoing one.

Aura also monitors all three credit bureaus, scans the dark web and more than 200 data broker and people-search sites for exposed identifiers, and connects members with U.S.-based fraud resolution specialists who help dispute unauthorized activity. Plans include identity theft insurance of up to $1 million per adult for eligible recovery costs.

Exclusive CyberGuy deal: Save up to 68% today. Get Aura’s award-winning identity theft protection and credit monitoring for as low as $9/month when billed annually.

One of the best parts of Aura: Identity Theft Protection is its all-in-one approach to safeguarding your personal and financial life. Aura includes identity theft insurance of up to $1 million per adult to cover eligible losses and legal fees, plus 24/7 U.S.-based fraud resolution support with dedicated case managers ready to help restore your identity fast.

How to check if your personal information was exposed

If you are unsure whether criminals have already exposed your information, take action now. Start with a free identity breach scan to see whether your data appears in known leaks. Early detection gives you more control and helps you respond before fraud spreads.

Check if your personal information is already being used for identity theft, fraud, or appearing on the dark web.

Related Links:

• Why physical ID theft is harder to fix than credit card fraud
• Identity theft losses surge 70% for older Americans
• Google dropped dark web monitoring: Should you care?

Kurt’s key takeaways

Retirement accounts can feel separate from the everyday fraud risks we hear about with credit cards, email accounts and bank logins. But this case shows how quickly a 401(k) can become a target when someone has enough personal information to fool a call center or reset account access. The scary part is that a stolen retirement account may not come with the same consumer protections people expect from credit card fraud. That makes prevention and early warning signs even more important. Turn on multi-factor authentication, enable every account alert your plan offers and ask your employer or plan administrator what happens after an address, phone number or bank account change. No one should have to find out months later that their life savings disappeared. The earlier you spot suspicious activity, the better your chances of stopping the damage before it becomes a financial nightmare.

Should retirement plans be required to send stronger alerts before any major account change or distribution, especially when someone’s life savings are on the line? Let us know your thoughts in the comments below.

FOR MORE OF MY TECH TIPS & SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE

This article was created in partnership with Aura

Copyright 2026 CyberGuy.com.  All rights reserved.  CyberGuy.com articles and content may contain affiliate links that earn a commission when purchases are made.