Cybercrime potential rising with virus upheaval

Updated with clarification

The millions of Americans now working from home due to the COVID-19 pandemic presents an opportunity for bad actors looking to infiltrate individual retirement accounts, sources said.

"Bad actors don't get a conscience just because other people are experiencing hardship," said Ben Taylor, Los Angeles-based senior vice president and head of tax-exempt DC research at Callan LLC. "They use the opportunities that are available to them."

"The risks are substantially increased as a result of people working from home," he added.

Email phishing attempts have spiked in recent weeks, sources said anecdotally.

Andy Lovell, vice president of strategic partnerships at third-party administrator National Benefit Services LLC, Salt Lake City, warned of defined contribution participant accounts that have not been claimed online, meaning participants haven't logged in and established their credentials. If a bad actor gains access to someone's email, sees where their retirement account is located and finds the account unclaimed, the bad actor could establish the account for him or herself, Mr. Lovell said.

And while retirement accounts have long been a target for bad actors, last month's passage of the Coronavirus Aid, Relief and Economic Security Act makes them even more attractive, Mr. Lovell said. He pointed to one of the bill's provisions, which allows 401(k) plan participants to withdraw up to $100,000 from their accounts.

But sources at some of the nation's largest record keepers, which have vast resources and technological capabilities, said that while the pandemic can present cybersecurity challenges, they're up to the task.

"There are definitely more cybercriminals out there trying to take advantage of hardworking Americans, particularly during this pandemic, I suspect, than there were previously," said Edmund F. Murphy III, Empower Retirement president and CEO, Greenwood Village, Colo. "However, this is an area where we've made pretty material investments over the last several years. And we are absolutely committed to maintaining the highest level of online security and protection of personal information."

Record-keeper cybersecurity personnel increased 10.5% to 4,504 employees in the year ended Sept. 30, Pensions & Investments' latest survey of the largest record keepers showed. Meanwhile, the number of professionals working in record-keeping operations declined 15% to 19,328; investment analysis and due diligence, down 3.5% to 4,757; and relationship managers, a 6.8% decline to 2,612 employees. Record-keeper assets totaled $7.49 trillion as of Sept. 30, a slight increase from $7.45 trillion the year prior, according to the survey.

TIAA-CREF, which had $611.4 billion in record-keeping assets as of Sept. 30, down 6% from the previous year, in 2019 created a partnership with The New York University Tandon School of Engineering to offer employees the opportunity to obtain a master's degree in cybersecurity at no cost after successfully completing the coursework and utilizing TIAA's tuition reimbursement program, according to Tim Byrd, Charlotte-based chief information security officer. "Our partnership with NYU Tandon strengthens the skills of our existing cyber team, while also offering other TIAA employees the opportunity to transition into cybersecurity from another area of the company if that's something they are interested in pursuing," he said in an email. TIAA had more than 250 cybersecurity employees, according to Mr. Byrd.

Alison Borland, executive vice president of wealth solutions and strategy at Alight Solutions in San Francisco, said in addition to hiring staff who specialize in cybersecurity, Alight formalized an internal "security first" program two years ago to ensure all employees are actively engaged in all aspects of security including proper cyber protocols, like avoiding email phishing scams and protecting participant data. "We consider security the job of every colleague who works at Alight," Ms. Borland said. Alight had 278 cybersecurity employees as of Sept. 30 and $459.2 billion in record-keeping assets, up 3.4% from the previous year, according to the survey.

Of note, the Department of Labor filed a petition April 6 in U.S. District Court in Chicago seeking a court mandate to compel Alight to produce documents in an ongoing ERISA compliance investigation.

The Labor Department issued a subpoena in November, and in January, said Alight "provided a limited number of documents and provided a 39-page letter containing numerous objections," according to the agency's court filing.

"We have been working with the DOL to better understand their request, but their specific asks and intent remain broad and unclear," Alight spokeswoman MacKenzie Lucas said in an email. "We will continue to work with them to provide necessary information while protecting the privacy of our clients and their people."

During its investigation, which began in July, the Labor Department's Employee Benefits Security Administration discovered that Alight processed unauthorized distributions as a result of cybersecurity breaches relating to its ERISA plan clients' accounts, the agency said in court filings.

Alight said there's no evidence to suggest there's been any compromise of its systems.

Moreover, in early April, a former employee of Abbott Laboratories, Chicago, sued the company and Alight, its record keeper, accusing plan fiduciaries and Alight of violating their ERISA duties because her 401(k) account was looted by an impostor. The suit alleges that $245,000 was transferred from the former employee's account without her knowledge, blaming the defendants for allowing the money to be transferred to an internet address in India before she could take steps to stop the fraud.

Alight declined to comment on the lawsuit but said it takes seriously the security of data and accounts it oversees and takes an "aggressive approach" in preventing fraud.

Record keepers like Alight and Empower — the latter of which had 864 cybersecurity employees as of Sept. 30 and $631.7 billion in record-keeping assets, up 14.2% from the previous year, according to the survey — are seeing spikes in call volume related to market volatility and CARES Act provisions, but calls regarding fraud are not on the rise.

"We are on high alert for any increase in activity, given the nature of what's happening in the world, but we have not seen an increase in unauthorized activity," Ms. Borland said.

The largest record keepers each have cybersecurity protocols in place, including features like multifactor authentication at login and for certain transactions and text updates to participants when transactions or account changes are made.

Fidelity Investments, the nation's largest record keeper with $2.25 trillion in record-keeping assets as of Sept. 30, up 4.6% from the previous year, offers voice technology where a participant's account can be automatically authenticated by the sound of their voice, said Robert Salerno, Boston-based senior vice president of relationship management. Over the years, Fidelity has worked to make its cybersecurity solutions seamless for plan participants, he added. "If we can make sure the cybersecurity elements are aligned to a strong participant experience, that's when we think we've created a win-win," Mr. Salerno said.

TIAA over the last year has increased its level of participation in industry threat intelligence groups, such as the Financial Services Information Sharing and Analysis Center, an industry consortium dedicated to reducing cyberrisk in the global financial system, "to allow for real-time threat intelligence sharing of cyber tactics seen in the industry," Mr. Byrd said.

The goal for record keepers is to "stay one step ahead of the bad guys," Mr. Murphy said, which is why cybersecurity has been such a focus in recent years. "The investment that we've made here has increased considerably over the last five to seven years," he said, though he declined to provide specifics.

Those investments have put record keepers in good position to deal with bad actors attempting to infiltrate participant accounts, typically by way of email phishing scams, sources said.

"Cybersecurity has long been a priority for the record-keeping industry and our members apportion a significant part of their IT budgets to protecting plan and participant data," said Tim Rouse, executive director at the SPARK Institute, Simsbury, Conn., in an email. "So, with the recent pandemic causing more people to now work from home our members were prepared and experienced. However, our industry continues to be on the alert to new work from home scammers."

Having participants access accounts from personal devices is not new for major record keepers, including Alight. "Our authentication protocols, our security, our real-time fraud protection all work exactly as planned and designed, whether participants are accessing our systems from home or from the office," Ms. Borland said.

"We continue to adapt and adjust and make new investments," she added. "That's been true for years and will continue to be true in the future because fraudsters continue to show a lot of creativity and also a level of relentlessness that we absolutely have to match each day."