EXPOSED: How Data Brokers Are Helping Thieves Drain Your Entire Retirement

Liberty Check

• Identity thieves are targeting 401(k) accounts with stolen personal data, bypassing traditional fraud protections that cover credit cards
• Federal law provides little recourse for retirement account theft victims, leaving Americans vulnerable to total savings wipeouts
• Your personal information sold by data brokers is fueling a massive surge in retirement fraud targeting Americans over 60

An impostor phoned Alight Solutions, the recordkeeper for Colgate-Palmolive’s 401(k) plan, and identified herself as a Colgate employee. She asked to update the contact information on an account.

Months later, the entire $751,430 balance had been sent in a single lump sum to a Las Vegas address and bank account. The real account holder, Paula Disberry, was living in South Africa.

Disberry sued Alight, Colgate’s benefits committee and BNY Mellon, the plan’s custodian, to recover the money. The case was later settled on undisclosed terms.

The court never ruled on whether Alight had to restore the funds.

In February 2024, the Government Accountability Office told the U.S. Department of Labor to issue new guidance on retirement plan participant data. The GAO cited eleven separate lawsuits filed between 2009 and 2024 under the Employee Retirement Income Security Act, the federal law governing private retirement plans.

When account takeover hits a 401(k), the consumer protections that govern credit card fraud do not apply. This is a critical gap that leaves hardworking Americans exposed to catastrophic losses with virtually no recourse.

The Disberry case began when an impostor called Alight’s Benefits Information Center. She gave Disberry’s name, the last four digits of her Social Security number, her date of birth and the mailing address Alight had on file.

That was enough to clear the call center’s security check.

She then asked Alight to update the contact information on Disberry’s account. Alight did not send an alert to Disberry’s existing email address or phone number, both of which it had on file.

Instead, the company issued a temporary password through the mail.

Disberry’s plan had a 14-day waiting period between an address change and any distribution. Her lawsuit alleged that Alight skipped it.

Within weeks, the impostor logged in, requested a full payout, and BNY Mellon mailed a check to a Las Vegas address.

Heide Bartnett, a former Abbott Laboratories employee, sued Alight over a $245,000 401(k) distribution. She alleged that a hacker used the plan portal’s “forgot password” feature to reset her credentials and trigger the payout.

Other retirement plan recordkeepers have faced similar cybertheft lawsuits.

The problem extends beyond 401(k) accounts. The FBI’s April 2024 Internet Crime Report found that Americans 60 and older lost $7.7 billion to internet crime in 2023, a staggering 59% jump from the year before.

Investment fraud accounted for $3.5 billion of those losses, making retirement-age savers a major target for online criminals.

Account takeovers begin with information someone already has. Names, dates of birth, partial SSNs and email addresses appear in dark web breach dumps, often combined with leaked passwords from unrelated services.

When the account holder reuses a password across accounts, hackers can test that breach data directly against the recordkeeper’s login portal.

Disberry’s takeover bypassed the login portal entirely. The impostor never logged in to Disberry’s account directly.

She called Alight’s call center, used what she already knew about Disberry to clear identity verification and had the contact information changed. After that, the temporary password Alight mailed went somewhere only the impostor could intercept.

Some thieves skip the recordkeeper and go straight for the account holder. A recent investigation documented the case of Barry Heitin, a 76-year-old retired lawyer, who lost $740,000 in 2024 after receiving a call from someone claiming to be a federal fraud investigator.

The caller convinced Heitin that his retirement accounts were under attack and walked him through transferring the money out himself.

He believed he was helping a federal investigation.

Federal protections for retirement account theft are limited, but several account-level controls cost nothing and may make takeovers harder. The truth is, you’re largely on your own when it comes to protecting your life savings.

Account-change alerts on the recordkeeper portal only work if the recordkeeper sends them. The Disberry case showed what can happen when those alerts go unsent.

A strong identity theft monitoring service can add another layer of protection by watching for suspicious activity beyond the retirement plan portal. Some services let you link bank, credit card and investment accounts so you can receive alerts when unfamiliar transactions appear.

In a retirement account takeover, that could help flag suspicious money movement even if the recordkeeper misses the outgoing transfer.

Many identity theft monitoring services also watch for changes across your credit reports, scan the dark web for exposed personal information and search data broker or people-search sites for your details. Some plans also include fraud resolution support and identity theft insurance for eligible recovery costs.

If you are unsure whether criminals have already exposed your information, take action now. Start with a free identity breach scan to see whether your data appears in known leaks.

Early detection gives you more control and helps you respond before fraud spreads.

Retirement accounts can feel separate from the everyday fraud risks we hear about with credit cards, email accounts and bank logins. But this case shows how quickly a 401(k) can become a target when someone has enough personal information to fool a call center or reset account access.

The scary part is that a stolen retirement account may not come with the same consumer protections people expect from credit card fraud.

That makes prevention and early warning signs even more important. Turn on multi-factor authentication, enable every account alert your plan offers and ask your employer or plan administrator what happens after an address, phone number or bank account change.

No one should have to find out months later that their life savings disappeared. The earlier you spot suspicious activity, the better your chances of stopping the damage before it becomes a financial nightmare.

Data brokers profit by selling your most sensitive information to the highest bidder, creating a treasure trove for criminals targeting retirement accounts. Without stronger federal oversight and mandatory security protocols for retirement plan administrators, American workers remain vulnerable to devastating fraud that could wipe out decades of savings in a single phone call.

It’s time to push back.