PLANSPONSOR - December 2022-February 2023 - 4

RULES & REGULATIONS
Hackers' Withdrawal Strategies
E
mployer retirement accounts are
facing increasingly
sophisticated
attacks by hackers looking to get
a slice of worker savings, according to
cybersecurity experts. " We're seeing a
significant increase in the hackers getting
access to these retirement assets, "
Brian Edelman, CEO of cybersecurity
protection firm FCI, said during CNBC's
Financial Advisor Summit recently.
" We're out there protecting them on
the investment side, but we need to also
manage the data-if a hacker gets at the
retirement assets, then there is nothing
left to manage. "
In the panel discussion " Securing
Your Savings, " Edelman said criminals
will use a corporate email hack to intercept
a conversation between a retirement
plan saver and a plan administrator. They
then try to get the participant to divert
savings to a separate account that the
criminal runs.
Gregory Wilson, chief information
security officer for Putnam Investments,
said he has seen an increase in phishing
attacks in which hackers send a fake
message to take over an account and steal
the assets. If this type of assault is not
detected quickly, authorities may lose their
chance to recover the money, according
to Wilson. " You need to get it back in two
days; otherwise, the ability to get those
funds back drops significantly, " he said.
Both experts said fiduciaries for
retirement plans should be well versed in
guidance the Department of Labor put out
last year on cybersecurity for retirement
benefits. The guidance provides both
pertinent best practices for plans covered
by the Employee Retirement Income
Security Act and guidance on how to
select a service provider with strong cybersecurity
practices.
While it is important for fiduciaries
to follow the DOL guidelines, Wilson
said, they should understand that those
guidelines are just a foundation to build
on by adding the specific circumstances
of the plan administrator.
4 PLANSPONSOR.COM December 2022 - February 2023
Art by Jam Dong
" That is going to be the standard
they are held to if something goes wrong, "
Wilson said. " The thought is often to do
the absolute minimum, but if something
goes wrong, there are penalties, fines and
institutional
risk that comes into play.
[Fiduciaries] need to do everything they
can to entrust the assets. "
At Putnam, Wilson said, he conducts
" tabletop exercises " in which a specific
financial scam is set up, and teams work
on it as if it were actually happening.
He once had the FBI come in to run a
scenario in which even he did not know
the setup, he said.
He noted that one of the biggest
issues arises when a decisionmaker is
unavailable, and the company cannot act
quickly. It is important, he said, to have an
active chain of command to mitigate that
risk. " Murphy's law says that when something
goes 'Boom!' the person you need
won't be available. You don't want to be
holding the bag without a way to contact
that person. " -Alex Ortolani
http://www.PLANSPONSOR.COM
PLANSPONSOR - December 2022-February 2023

Table of Contents for the Digital Edition of PLANSPONSOR - December 2022-February 2023
