PLANSPONSOR - April/May 2019 - 73

threats and defenses, as do organizations
such as the U.S. Department of Homeland
Security and privacy protection groups.
Register Online
One strategy that recordkeepers increasingly
promote to protect plan data is to
have all participants register online.
" Registering your account for online
access can offer an additional degree of
security, so no one else can attempt to
register on your behalf, " says Charles P.
Nelson, CEO for retirement and employee
benefits, with Voya Financial in New York.
" This prevents a certain degree of fraud
activity. Sponsors should encourage participants
to register their accounts online. "
If a hacker or other ne'er-do-well
obtains a participant's ID and that person
has not registered online, the fraudster can
pose as the participant, using that information
to open an account and apply for
loans or other disbursements, Taylor says.
But if the participant already has
registered online, most recordkeepers
have techniques to detect a faux disbursement
request, he explains. Those include
knowing the participant's online pattern
of behavior, having a record of where he is
located, and checking whether the access
or disbursement request came from one of
his devices-which the sponsor would be
able to identify.
Brummel says that by registering
online and giving personal information
to their provider such as their name,
Social Security number, date of birth and
address, participants are " claiming " their
account as their own and making it more
difficult for someone else to misuse it.
Some recordkeepers, he says, assure
participants that any assets taken from
their account in a security breach will be
made good by the provider-but only if the
individual already has registered online.
It is not unusual for retirement plan
participants to believe their personal data
is safer not registered digitally, as the fear
of online information theft has become so
widespread. But, says Nelson, " This [type
of thinking] can be misguided. " For one
reason, a participant's data can be swiped
in many other ways.
He notes that participants who
neglect to register online still receive plan
notifications by regular mail. This written
material is comparatively easier prey for
fraudsters seeking to obtain data and steal
disbursements, as opposed to successfully
breaking into a recordkeeper's data
base and gaining access to a participant's
assets, Nelson says.
In general, recordkeepers, because of
their size, can protect data more securely
than plan sponsors can. " Big recordkeepers
are like Fort Knox, " says Taylor,
adding that the most vulnerable targets
for fraud are smaller providers and a sponsor's
own human resources (HR) department.
" It's easier to hack an HR computer
than a large recordkeeper, " he says.
Yet even a large recordkeeper's paper
documents are less secure than its online
data, according to Taylor. " You can just
go into HR and print the documents, " he
says. " That has happened. "
One method of fraud, Taylor says, is
to target new retirees or older participants
who lack an online account. Documents
have been taken off desks and then used
to register accounts under false pretenses.
Dual-Factor Identification
A common form of online security is dualfactor
identification, by which a provider
sends a one-time ID number to a user's
personal device before that individual
can log in to an account. That ensures
the user's own cell phone or computer is
being utilized, rather than the device of an
NEXT STEPS
* Urge participants to register online, and inform them that security is
stronger for information recorded electronically than on paper.
* Be vigilant about asking advisers and providers what data protection
systems they employ, and have an auditing firm determine if the
provider complies with SPARK's common cybersecurity framework.
* Protect plan documents by strengthening HR security safeguards,
particularly when it comes to paper documents.
PLANSPONSOR.com April - May 2019 73
One method of
fraud is to target
new retirees or
older participants
who lack an
online account.
intruder who has somehow obtained the
user's documents. Two-factor identification
cannot be exploited when a participant
is registered on paper only.
" I think what sponsors should be
doing and asking is, 'What percent of
my participants are signed up for online
digital access?' " says Nelson. " They should
be using that as one measure of a plan's
health, so they can help, and the participants
can help, protect their accounts. "
Plan sponsors also can work closely
with their provider to guard against fraud
and attempts at breaching a plan. " Fraud
attempts come in all shapes, sizes and
forms, " says Nelson. " So it's very important
to understand what your provider's
security protocols are, how it encrypts data,
how it's using data and analytics to protect
[accounts], and anticipate where some
suspicious activity [may be] occurring. "
That process is boosted by online
registration, because it helps providers
detect patterns, often through predictive
analytics-and increasingly through
biometrics-that might suggest fraudulent
activity, he says. -Louis Berney
http://www.plansponsordigital.com/plansponsor/april-may_2019/TrackLink.action?pageName=73&exitLink=http%3A%2F%2FPLANSPONSOR.com
PLANSPONSOR - April/May 2019

Table of Contents for the Digital Edition of PLANSPONSOR - April/May 2019
