Protecting retirement plans from external fraud and potentially fraudulent participant requests
The SECURE 2.0 Act made it easier for retirement plan participants to access their savings by expanding the use of self-certification for certain distributions, including hardship withdrawals. Rather than requiring extensive supporting documentation, plan administrators may generally rely on a participant’s electronic certification that the applicable requirements have been satisfied.
While this simplifies administration and improves participant access, self-certification should not be confused with the elimination of fiduciary oversight. Plan fiduciaries have an ongoing responsibility to prudently administer their plans and protect participants’ retirement savings. That includes recognizing that distribution fraud can originate from two very different sources:
- External fraud: Criminals gaining unauthorized access to participant accounts and initiating fraudulent distributions through identity theft or compromised credentials.
- Internal fraud or misrepresentation: Participants knowingly providing false information or electronically certifying circumstances that do not satisfy the applicable distribution requirements.
Both risks deserve attention.
A Real-World Example: When Distribution Activity Raises Red Flags
In a recent review, we identified a participant who had requested eight disaster-related hardship distributions, despite residing in an area where no applicable FEMA-declared disasters could be identified. The same participant had also requested distributions associated with a birth or adoption and domestic abuse.
While each distribution category has its own eligibility requirements, the frequency and combination of these requests raised legitimate questions about whether the participant understood and satisfied those requirements.
This example illustrates an important point: Just because a recordkeeper’s system accepts an electronic certification does not necessarily mean the underlying transaction is legitimate. Self-certification relies on participants providing truthful information. Without some level of monitoring, potentially inappropriate distributions can go undetected.
A Practical Approach to Fiduciary Oversight
We recommend that plan fiduciaries establish a process to review participant distribution activity at least semi-annually, with particular attention to unusual or repetitive transactions. This review does not need to be burdensome. Plan sponsors should work with their recordkeepers and advisors to identify patterns that warrant further attention, including multiple hardship withdrawals, repeated use of special distribution provisions, or activity inconsistent with known eligibility requirements.
When suspicious activity is identified, we recommend sending a letter directly to the participant that serves two purposes:
- Transaction verification: Confirm that the participant personally initiated and authorized the distribution, helping identify possible account takeover or identity theft.
- Participant education and accountability: Remind the participant that electronic certifications carry legal and tax implications, that eligibility requirements must be satisfied, and that false certifications can have significant consequences.
Where appropriate, additional documentation or investigation may be warranted. All outreach should be handled discreetly, particularly when sensitive circumstances such as domestic abuse are involved.
The Bottom Line
Self-certification is a valuable administrative convenience, but it is not a substitute for sound fiduciary practices. Plan fiduciaries should not assume that every distribution processed by a recordkeeper is necessarily appropriate simply because a participant electronically certified eligibility.
A simple, documented semi-annual review of distribution activity, combined with targeted participant follow-up when warning signs emerge, can provide an important additional layer of protection.
Ultimately, effective fiduciary oversight is not about making it harder for participants to access their retirement savings. It is about protecting those savings, maintaining the integrity of the plan, and helping ensure distributions are made for legitimate, authorized purposes.
If you’d like help reviewing how your plan monitors distribution activity, connect with the Twelve Points Retirement Plan Advisory team.
PLEASE SEE IMPORTANT DISCLOSURE INFORMATION at twelvepoints.com/disclosure