Technology
Your 401(k) is the new identity theft target
NEWYou can now listen to Fox News articles!
An impostor phoned Alight Solutions, the recordkeeper for Colgate-Palmolive’s 401(k) plan, and identified herself as a Colgate employee. She asked to update the contact information on an account. Months later, the entire $751,430 balance had been sent in a single lump sum to a Las Vegas address and bank account. The real account holder, Paula Disberry, was living in South Africa.
Disberry sued Alight, Colgate’s benefits committee and BNY Mellon, the plan’s custodian, to recover the money. The case was later settled on undisclosed terms. The court never ruled on whether Alight had to restore the funds.
In February 2026, the Government Accountability Office told the U.S. Department of Labor to issue new guidance on retirement plan participant data. The GAO cited eleven separate lawsuits filed between 2009 and 2024 under the Employee Retirement Income Security Act, the federal law governing private retirement plans.
When account takeover hits a 401(k), the consumer protections that govern credit card fraud do not apply.
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS
A stolen 401(k) shows how one phone call, exposed personal details and weak account-change safeguards can drain retirement savings. (Kurt “CyberGuy” Knutsson)
How the 401(k) account was drained
The Disberry case began when an impostor called Alight’s Benefits Information Center. She gave Disberry’s name, the last four digits of her Social Security number, her date of birth and the mailing address Alight had on file. That was enough to clear the call center’s security check.
She then asked Alight to update the contact information on Disberry’s account. Alight did not send an alert to Disberry’s existing email address or phone number, both of which it had on file. Instead, the company issued a temporary password through the mail.
Disberry’s plan had a 14-day waiting period between an address change and any distribution. Her lawsuit alleged that Alight skipped it. Within weeks, the impostor logged in, requested a full payout, and BNY Mellon mailed a check to a Las Vegas address.
Why the 401(k) account takeover isn’t an isolated case
Heide Bartnett, a former Abbott Laboratories employee, sued Alight over a $245,000 401(k) distribution. She alleged that a hacker used the plan portal’s “forgot password” feature to reset her credentials and trigger the payout. Other retirement plan recordkeepers have faced similar cybertheft lawsuits.
The problem extends beyond 401(k) accounts. The FBI’s April 2026 Internet Crime Report found that Americans 60 and older lost $7.7 billion to internet crime in 2025, a 59% jump from the year before. Investment fraud accounted for $3.5 billion of those losses, making retirement-age savers a major target for online criminals.
INSIDE A SCAMMER’S DAY AND HOW THEY TARGET YOU
Retirement account takeovers can start with leaked names, birth dates, partial Social Security numbers and reused passwords from past data breaches. (Kurt “CyberGuy” Knutsson)
How thieves take over retirement accounts
Account takeovers begin with information someone already has. Names, dates of birth, partial SSNs and email addresses appear in dark web breach dumps, often combined with leaked passwords from unrelated services. When the account holder reuses a password across accounts, hackers can test that breach data directly against the recordkeeper’s login portal.
Disberry’s takeover bypassed the login portal entirely. The impostor never logged in to Disberry’s account directly. She called Alight’s call center, used what she already knew about Disberry to clear identity verification and had the contact information changed. After that, the temporary password Alight mailed went somewhere only the impostor could intercept.
Some thieves skip the recordkeeper and go straight for the account holder. The New York Times documented the case of Barry Heitin, a 76-year-old retired lawyer, who lost $740,000 in 2024 after receiving a call from someone claiming to be a federal fraud investigator. The caller convinced Heitin that his retirement accounts were under attack and walked him through transferring the money out himself. He believed he was helping a federal investigation.
How to protect your 401(k) and retirement savings
Federal protections for retirement account theft are limited, but several account-level controls cost nothing and may make takeovers harder.
- Turn on multi-factor authentication on the recordkeeper portal. A stolen password is far less useful when a one-time code is required.
- Enable every account-change alert. Email and text alerts for password resets, contact information updates, address changes and bank account changes are the earliest signals that someone else has access to your account.
- Ask your plan administrator about distribution holds. Some plans impose a waiting period between an address change and any distribution. Get the policy in writing and confirm what triggers the hold.
- Review statements quarterly. A new bank account or a change in contact information shows up faster on a quarterly review than on an annual one.
- Get an IRS Identity Protection PIN. The six-digit PIN, available at irs.gov/ippin, blocks fraudulent tax returns filed using your SSN.
- Freeze your credit at all three bureaus. A freeze blocks new accounts from being opened in your name. Equifax, Experian and TransUnion have offered free freezes since September 2018.
HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET
Multi-factor authentication, account-change alerts, credit freezes and regular statement reviews can help protect your 401(k) before thieves strike. (Kurt “CyberGuy” Knutsson)
Where identity theft monitoring can help
Account-change alerts on the recordkeeper portal only work if the recordkeeper sends them. The Disberry case showed what can happen when those alerts go unsent.
A strong identity theft monitoring service can add another layer of protection by watching for suspicious activity beyond the retirement plan portal. Some services let you link bank, credit card and investment accounts so you can receive alerts when unfamiliar transactions appear. In a retirement account takeover, that could help flag suspicious money movement even if the recordkeeper misses the outgoing transfer.
Many identity theft monitoring services also watch for changes across your credit reports, scan the dark web for exposed personal information and search data broker or people-search sites for your details. Some plans also include fraud resolution support and identity theft insurance for eligible recovery costs.
How to check if your personal information was exposed
If you are unsure whether criminals have already exposed your information, take action now. Start with a free identity breach scan to see whether your data appears in known leaks. Early detection gives you more control and helps you respond before fraud spreads. You can also check whether your personal information is already being used for identity theft, fraud or appearing on the dark web.
See my tips and best picks on Best Identity Theft Protection at CyberGuy.com
Kurt’s key takeaways
Retirement accounts can feel separate from the everyday fraud risks we hear about with credit cards, email accounts and bank logins. But this case shows how quickly a 401(k) can become a target when someone has enough personal information to fool a call center or reset account access. The scary part is that a stolen retirement account may not come with the same consumer protections people expect from credit card fraud. That makes prevention and early warning signs even more important. Turn on multi-factor authentication, enable every account alert your plan offers and ask your employer or plan administrator what happens after an address, phone number or bank account change. No one should have to find out months later that their life savings disappeared. The earlier you spot suspicious activity, the better your chances of stopping the damage before it becomes a financial nightmare.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Should retirement plans be required to send stronger alerts before any major account change or distribution, especially when someone’s life savings are on the line? Let us know by writing to us at CyberGuy.comCyberguy.com
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Microsoft launched Teams’ Together Mode during the pandemic to give the illusion of a bunch of people sitting in a conference room together, even if they were really sitting at home without pants on. But times have changed, and it’s now being retired in favor of a more simplified Teams experience. The feature used AI to cut your head and shoulds out, and place you in a virtual space with others in the meeting. It could definitely feel gimmicky — especially when you’d tap co-workers on the shoulder, or give virtual high fives — but it did limit visual distractions.
The changes are being rolled out gradually, but as they are, the Together Mode toggle will disappear from the view menu. And Together-specific features, such as scenes and seat assignments, will go along with it. Part of the reasoning, according to Microsoft, is to reduce fragmentation across various platforms. But it also cites a streamlined interface with fewer options, less clicking, and less confusion. It also says this will allow the company to focus on improving video quality, stability, and performance.
Apple is hoping that its record on privacy can be the differentiator on the AI front, and maybe even buy it a little slack as it continues to lag behind the competition. According to Bloomberg’s Mark Gurman, the more chatbot-like Siri set to debut in iOS 27 will include the option to autodelete chat histories. Users will be able to save conversations for 30 days, one year, or forever. That’s in stark contrast to the other major players in the space that generally only offer temporary incognito chats, if that.
It appears Apple is betting that people are willing to give up some convenience in the name of greater privacy, as anxiety around AI continues to increase. While the company is replacing many of its under-the-hood components with Google’s Gemini tech, it seems to be trying to turn some of Apple Intelligence’s perceived weaknesses into a selling point. As Gurman notes:
Most leading AI chatbots today rely heavily on histories and memory systems to personalize responses and improve future interactions. But Apple will place tighter limits around how memory works, including restrictions on what information can persist and how long i can be retained.
NEWYou can now listen to Fox News articles!
Robocalls are the phone version of stepping on a Lego barefoot. You know the pain. Your phone buzzes during dinner, during a meeting or right when you finally sit down. Then a fake bank alert, Medicare scam or “urgent” car warranty pitch tries to hijack your day.
So when the Federal Communications Commission says it wants to crack down on illegal robocalls, most people will probably say, “Finally.”
FCC Chairman Brendan Carr said in a recent press release, “We must bring meaningful robocall relief to consumers.” A few days later, the FCC said stopping illegal calls remains its top consumer protection priority.
The agency has reason to be aggressive. Late last year, a report from the consumer advocacy group U.S. PIRG Education Fund found that Americans had received 2.14 billion robocalls per month in 2024. That works out to only a handful per person on average, but robocalls do not hit everyone evenly. Some Americans can get hit with dozens of spam calls in a single day.
Still, the FCC’s proposed fix raises a new question. Could the fight against robocalls also make it harder to get a phone without having to hand over more personal information?
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
FBI WARNS OF DANGEROUS NEW ‘SMISHING’ SCAM TARGETING YOUR PHONE
The FCC wants phone companies to do more to stop illegal robocalls before they ever reach your phone. (Kurt “CyberGuy” Knutsson)
What the FCC robocall rules would change
Last month, the FCC voted to seek public comment on stronger “Know Your Customer” rules for voice service providers. These rules are not final yet. The FCC is still gathering feedback, including privacy concerns. Under the proposal, phone providers may have to collect more information from new and renewing customers before giving them access to service. That could include a full legal name, physical address, government ID and an existing phone number.
For higher-volume customers, the FCC is also looking at additional checks. Providers may need to review how the customer plans to use the service and whether other details look suspicious. The goal is to stop bad actors before they can flood phone networks with illegal calls.
That sounds reasonable when you picture a scam call center blasting thousands of fake alerts. However, the privacy concern starts when you think about everyday people who rely on prepaid phones, temporary numbers or more private ways to communicate.
Why burner phones could be affected by the FCC proposal
Burner phones have a shady reputation because TV shows love to put them in the hands of criminals. In real life, though, prepaid phones can serve people who need flexibility or safety. Someone leaving an abusive relationship may need a phone that isn’t connected to a shared family account. A person without stable housing may not have a traditional physical address. A journalist source, whistleblower or privacy-conscious consumer may also prefer a phone number that isn’t tied to every part of their identity.
Civil liberties advocates warn that the FCC proposal could create a broader identity-verification system around one of the last semi-anonymous communication tools available to ordinary Americans.
That does not mean the FCC is trying to ban burner phones outright. Still, if phone providers must collect more identity details before activating or renewing service, anonymous or semi-anonymous phone access could become much harder to get.
INSIDE A SCAMMER’S DAY AND HOW THEY TARGET YOU
New proposed rules could require carriers to collect more customer information before activating or renewing service. (Kurt “CyberGuy” Knutsson)
FCC robocall red flags that could trigger scrutiny
The FCC proposal also discusses risk-based checks. That means certain customer details or behaviors could trigger a deeper review.
Possible red flags may reportedly include using a virtual office, using certain commercial addresses, operating a suspicious website or using an email address that raises concerns.
Other red flags could include not being traceable to the state listed in the customer’s address or paying for phone service with cryptocurrency.
That may help carriers spot scam operations. But it also raises a tricky question. What happens when a legitimate person gets flagged because their life does not fit neatly into a standard form?
A person using a shelter address, mail service or privacy-focused payment method could face more questions. The rules may be aimed at robocallers, yet the burden could land on people who already have a hard time proving who they are.
Why phone companies may get strict fast
The proposed enforcement system could put serious pressure on telecom providers. The FCC proposal reportedly includes a possible $2,500 per-call base forfeiture for Know Your Customer violations.
That is a big incentive for providers to be careful. It may also make them overcorrect. If a provider thinks a customer looks risky, it may decide that denying service is safer than getting blamed later. For consumers, that could mean more ID checks, more account reviews and more hoops to jump through when signing up for phone service.
The FCC argues that, as the gateway to the phone network, carriers are in the best position to stop scammers before calls go out. The concern is whether that gate becomes too hard for ordinary people to pass through.
What the FCC robocall proposal means to you
For now, nothing changes overnight. These rules are still proposed. The FCC is asking for public comment, and any final rules would come later.
Still, this proposal points to where phone service may be heading. Carriers may collect more identity information. Prepaid service may become less private. Some customers may face more questions when they open or renew an account.
That could bring fewer scam calls. It could also mean less anonymity for people who have legitimate reasons to keep a phone number separate from the rest of their life.
ANDROID SECURITY UPGRADES OUTSMART SCAMS AND PROTECT YOUR PRIVACY
Spam call tools can help, but stricter phone rules may also raise new privacy questions for everyday users. (Kurt “CyberGuy” Knutsson)
Tips to stay safe from robocalls
You do not need to wait for regulators to act. You can lower your risk right now.
1) Let unknown calls go to voicemail
If you do not recognize the number, let it ring. Scammers often rely on panic. A real caller can leave a message.
2) Turn on your phone’s spam protection
On iPhone, go to Settings > Apps > Phone. Look for Screen Unknown Callers and choose Ask Reason for Calling. This screens calls from unsaved numbers before your phone rings, so you can decide whether to answer.
If spam calls are overwhelming, you can choose Silence instead. Just be aware that calls from people not in your contacts may go straight to voicemail. That could include a doctor’s office, school, delivery driver or other legitimate caller.
You can also check Call Filtering and turn on available carrier spam-filtering options. For example, AT&T may show a Spam toggle that says calls identified as spam or fraud will be silenced, sent to voicemail and moved to the spam list. Other carriers may use different wording or place this option in a carrier app.
On a Samsung phone, open the Phone app > tap the three dots in the upper-right corner > Settings > Caller ID and spam protection > turn on Caller ID and spam protection. Then tap Block spam and scam calls and choose the blocking level that works best for you, such as blocking all spam and scam calls or only high-risk scam calls. Menu wording may vary by carrier, region and whether your phone uses Samsung Phone or Phone by Google.
3) Use your carrier’s call-blocking tools
AT&T, Verizon, T-Mobile and other carriers offer spam call blocking features. Some are free, while others require a paid plan. Check your carrier app for call protection settings.
4) Use a data removal service
Scammers can pull your phone number, address and other personal details from data broker and people-search sites. That information can make robocalls sound more believable. A data removal service can help remove your personal information from many of these sites, and keep checking if it shows up again. Check out my top picks for data removal services and get a free scan at CyberGuy.com/FreeScan
5) Do not press buttons during a scam call
A robocall may tell you to press a number to stop future calls. That can confirm your number is active. Hang up instead.
6) Never give out codes or account details
A scammer may pretend to be your bank, carrier or a government agency. Do not share one-time passcodes, Social Security numbers or payment details over an unexpected call.
7) Register with the National Do Not Call Registry
Register your number for free with the National Do Not Call Registry at donotcall.gov. The registry will not stop criminals, but it can reduce legitimate telemarketing calls. That makes scam calls easier to spot.
8) Report suspicious calls
You can report unwanted calls at donotcall.gov/report.html or file a complaint with the FCC at consumercomplaints.fcc.gov/hc/en-us. Reports help regulators track patterns and target bad actors.
Take my quiz: How safe is your online security?
Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: CyberGuy.com
Kurt’s key takeaways
Robocalls are more than annoying. They waste time, steal money and make people think twice before answering their own phones. So yes, stronger action is needed. But privacy has to be part of the conversation. The FCC’s proposal is aimed at scam call operations, but the final rules should not make it harder for everyday people to get a private or low-cost phone when they need one. That’s the balance regulators have to get right. They need to make life harder for robocallers without turning every phone customer into a suspect. Phone service connects people to jobs, doctors, family, schools and emergency help. Any crackdown should protect that access while still going after the bad actors abusing the system.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Would you be willing to show more ID to get phone service if it meant fewer robocalls, or does that feel like too much privacy to give up? Let us know by writing to us at CyberGuy.com
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
-
Lifestyle16 minutes agoHow Tamara Rojo is remaking ballet
-
Technology28 minutes agoMicrosoft is retiring Teams’ Together Mode
-
World34 minutes agoCanada confirms hantavirus case linked to cruise ship outbreak that has killed three passengers
-
Politics40 minutes agoTrump reads Bible as thousands pack National Mall for America 250 prayer rally
-
Health46 minutes agoFrequent museum visits tied to reduced cellular aging, research finds
-
Sports52 minutes agoIndy 500: Counting Down The 10 Best Finishes In Race History
-
Business1 hour agoWhy this Hollywood director thinks AI can save L.A. film jobs
-
Entertainment1 hour agoPedro Pascal goes undercover for ‘Star Wars’ surprise at Disneyland
