Disberry sued Alight, Colgate’s benefits committee and BNY Mellon, the plan’s custodian, to recover the money. The case was later settled on undisclosed terms. The court never ruled on whether Alight had to restore the funds.<\/p>\n
In February 2026, the Government Accountability Office told the U.S. Department of Labor to issue new guidance on retirement plan participant data. The GAO cited eleven separate lawsuits filed between 2009 and 2024 under the Employee Retirement Income Security Act, the federal law governing private retirement plans.<\/p>\n
When account takeover hits a 401(k), the consumer protections that govern credit card fraud do not apply.<\/p>\n
\u00a0Sign up for my FREE CyberGuy Report<\/strong><\/p>\n REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS<\/strong><\/a><\/p>\n A stolen 401(k) shows how one phone call, exposed personal details and weak account-change safeguards can drain retirement savings. (Kurt “CyberGuy” Knutsson)<\/p>\n How the 401(k) account was drained<\/strong><\/p>\n The Disberry case began when an impostor called Alight’s Benefits Information Center. She gave Disberry’s name, the last four digits of her Social Security number<\/a>, her date of birth and the mailing address Alight had on file. That was enough to clear the call center’s security check.<\/p>\n She then asked Alight to update the contact information on Disberry’s account. Alight did not send an alert to Disberry’s existing email address or phone number, both of which it had on file. Instead, the company issued a temporary password through the mail.<\/p>\n Disberry’s plan had a 14-day waiting period between an address change and any distribution. Her lawsuit alleged that Alight skipped it. Within weeks, the impostor logged in, requested a full payout, and BNY Mellon mailed a check to a Las Vegas address.<\/p>\n Why the 401(k) account takeover isn\u2019t an isolated case<\/strong><\/p>\n Heide Bartnett, a former Abbott Laboratories employee, sued Alight over a $245,000 401(k) distribution. She alleged that a hacker used the plan portal’s “forgot password” feature to reset her credentials and trigger the payout. Other retirement plan recordkeepers have faced similar cybertheft lawsuits.<\/p>\n The problem extends beyond 401(k) accounts. The FBI’s April 2026 Internet Crime Report found that Americans 60 and older lost $7.7 billion to internet crime in 2025, a 59% jump from the year before. Investment fraud accounted for $3.5 billion of those losses, making retirement-age savers a major target for online criminals.\u00a0<\/p>\n INSIDE A SCAMMER\u2019S DAY AND HOW THEY TARGET YOU<\/strong><\/a><\/p>\n Retirement account takeovers can start with leaked names, birth dates, partial Social Security numbers and reused passwords from past data breaches. (Kurt “CyberGuy” Knutsson)<\/p>\n How thieves take over retirement accounts<\/strong><\/p>\n Account takeovers begin with information someone already has. Names, dates of birth, partial SSNs and email addresses appear in dark web breach dumps<\/a>, often combined with leaked passwords from unrelated services. When the account holder reuses a password across accounts, hackers can test that breach data directly against the recordkeeper’s login portal.<\/p>\n Disberry’s takeover bypassed the login portal entirely. The impostor never logged in to Disberry’s account directly. She called Alight’s call center, used what she already knew about Disberry to clear identity verification and had the contact information changed. After that, the temporary password Alight mailed went somewhere only the impostor could intercept.<\/p>\n Some thieves skip the recordkeeper and go straight for the account holder. The New York Times documented the case of Barry Heitin, a 76-year-old retired lawyer, who lost $740,000 in 2024 after receiving a call from someone claiming to be a federal fraud investigator. The caller convinced Heitin that his retirement accounts were under attack and walked him through transferring the money out himself. He believed he was helping a federal investigation.<\/p>\n How to protect your 401(k) and retirement savings<\/strong><\/p>\n Federal protections for retirement account theft are limited, but several account-level controls cost nothing and may make takeovers harder.<\/p>\n\n
![\"Tablet](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/05\/1-how-to-secure-your-401k-plan-from-identity-fraud.png\")
<\/p>\n![\"Couple](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/05\/1-are-data-brokers-endangering-your-retirement-security.jpg\")
<\/p>\n\n
![\"Woman](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/05\/4-remove-your-data-to-protect-your-retirement-from-scammers.jpg\")
<\/p>\n