Is My 401(k) Safe from Hackers?

Imagine somebody accessing your 401(k) account, editing your details, and then calling your retirement plan’s call center pretending to be you in order to transfer hundreds of thousands of dollars of your pension funds into their own bank account. This chain of events, as improbable as it might sound, isn’t fiction. It is the story of Heide Bartnett, a woman from Darien, Ill., and should serve as a reminder that no money is out of reach of hackers.

401(k)s Are Hotspots for Hackers

Most of us never give hackers much thought. It seldom crosses our minds that an experienced online thief could quite easily get into our financial accounts and empty them without breaking much of a sweat.

But if we were to be targeted, a 401(k) would be attractive prey. These investment accounts usually hold a lot more money than checking or savings accounts and aren’t generally checked very often. By the time we discover that a 401(k) has been fully or partially raided, the thief will likely be long gone.

Logging into somebody’s 401(k), then somehow getting a distribution to a new bank account signed off by the administrator without ever alerting the plan holder, sounds like a highly challenging and improbable task. It apparently isn’t, though. Judging by the numerous horror stories out there, online criminals are constantly coming up with ways to circumvent the latest cybersecurity safeguards put in place to stop them.

And those who don’t go all the way might still get hold of personal information, which in some cases can be just as damaging. Hackers steal personal information so that they, or somebody to whom they sell it, can pose as the victim and apply for credit cards, government benefits, loans, and other things in their name. That’s a lucrative market and another big risk to watch out for.

If My 401(k) Is Hacked, Can I Get My Money Back?

When money is stolen from a bank account or credit card, it’s usually fairly straightforward to get it back. With 401(k)s, reimbursement can be a little more complicated.

The federal Employee Retirement Income Security Act (ERISA), the law that governs 401(k) plans, has yet to fully address measures for preventing and dealing with private retirement account hacks—much to the dismay of the Government Accountability Office (GAO).

That ambiguity can leave 401(k) account holders in a tricky position. Yes, custodians do generally pledge to return any funds that went missing because of fraud. However, the language they sometimes use suggests that they could easily come up with ways to wriggle out of that commitment.

A handful of plan providers provide assurances that they will cover clients unconditionally. Others say they will pick up the bill only if account holders abide by certain security practices.

Tips to Thwart Hackers

Don’t bank on your plan provider to stop you from getting hacked. Billions are spent on cybersecurity, but sloppy behavior by 401(k) participants can render all of that extra protection useless.

Here are some basic steps you can take to reduce the risk of your retirement account being compromised:

Routinely monitor your account

We are often advised not to monitor investments too closely, as doing so can tempt us into knee-jerk reactions. That doesn’t mean you should never log in to your 401(k) online account, though. As with your bank account, it’s wise to comb through your statements fairly frequently to make sure there is no suspicious activity.

Make sure you also turn on account alerts. Do that and you should be informed whenever there is any kind of activity on your account, including login attempts and editing of your personal information.

Create a long, unique password

Cybersecurity experts recommend using a password with at least 16 characters. According to LMG Security, an eight-character password hash can be cracked in approximately seven days, whereas a 16-character one would take 147 trillion years to unlock.

The problem with utilizing unique, long, and complicated passwords for every online account is remembering them, particularly as we are not supposed to save passwords somewhere where somebody with evil intentions could find them. A helpful way around this can be to use a phrase. Combine several words together that are familiar to you but gibberish to anybody else and spell them creatively, with numbers and the odd caps lock thrown in.

Accept all the extra security offered

Nowadays, many plan providers offer a two-factor authentication process for access to your account. If this option is presented to you, use it.

Getting a code sent to your phone or an authenticator app isn’t completely flawless; hackers have been known to hack them, too. However, it does represent extra security, which is always a good thing.

Biometric safeguards are even better. Some websites now require fingerprints or voice or facial recognition to get past the login phase, making it even more difficult for hackers to gain access.

Be careful when using free Wi-Fi

Free Wi-Fi at airports, hotels, and coffee shops is a great way to save mobile data. It can also be dangerous.

If you happen to be connected to the public network at the same time as a crafty hacker, you could be in trouble. According to Kaspersky, it’s possible for the cybercriminal to position themselves between you and the connection point, giving them unfettered access to every piece of information you’re sending out on the internet.

Other than being careful what you access, you should also consider using a VPN, enabling the “Always Use HTTPS” option on websites, and turning off the sharing option on your computer.

Treat communication with caution

Whenever somebody calls, texts, or emails you asking for personal information, be skeptical. It is very unlikely that your 401(k) provider would contact you to request that kind of information.

You should also be careful about clicking on links, as this could plant malicious software on your device or lead you to a website designed to steal sensitive information. If in doubt, contact the plan provider or administrator using the numbers/addresses provided in the official documents.

The Bottom Line

The relative ease with which hackers swipe funds or personal information—coupled with generally little clarity about who is to blame and should foot the bill—has put the onus on 401(k) account holders to do all they can to beef up their own security. Some companies spend billions of dollars protecting their websites. However, at the end of the day, it is the simple steps taken by you, the account holder, that often function as the best form of defense.