PLANADVISER - January/February 2021 - 17

may not need now but that they think
could be useful in the future, " she says.
" That's really just amplifying the risk:
The more sensitive data you have on
your server, the more risk you have if
there's an intrusion. "
CAPTRUST keeps little individual
participant data in its system, Meyer
says. " There are actually very few
instances when we need [it] to do our
work, " he says. " I think any service
provider working with retirement
plans should collect participant data
only when it is absolutely required for
doing their job. "
Lockton Retirement Services in
Kansas City, Missouri, has little individual
participant data in its system,
says Chief Administrative and Compliance
Officer Karen Prange. " Most of the
time, if we're analyzing a plan's participation
or its participants'
investment
allocations, we don't really need individual
participant data, " she says. " If
we do, we minimize what we ask the
recordkeeper for. We generally can do
an analysis without having information
such as participants' Social Security
number, their address or even their
name. Then we eliminate that data from
our system when it's no longer relevant
to doing our work. "
Some advisory firms, with cybercrime
prevention in mind, have no
provision for letting participants withdraw
money from their account. " We
don't handle any of those types of
transactions, such as loan requests or
distribution requests, " Olsen says. " If a
participant asks about it, we're trained
to provide only contact information
for that plan's recordkeeper, because
that's public information. "
SageView, for another firm, does not
process loan or withdrawal requests,
Merid says. The practice has a protocol
that staff must follow if a participant
asks about
them.
" If a participant
contacts SageView for assistance with
a loan or withdrawal, we always refer
the person back to the recordkeeper, "
she says.
If an advisory firm does need individual
participant data to do its work,
sources recommend carefully limiting
which employees may see it. " If that
data is absolutely required to do our
HELPING PARTICIPANTS
HELP THEMSELVES
ONE OF THE BEST WAYS to keep participants' data and assets secure
is for these individuals to stay engaged. " Participants can dramatically
reduce the risk of fraud by taking simple steps to safeguard their account, "
says Duke Alden, vice president of client and customer security at Alight
Solutions in Lincolnshire, Illinois.
Here are five pointers advisers can pass along to participants for how
to keep their account and assets safe:
* Register your account. " The best way for participants to secure their
account is to secure their log-in credentials: Personalize their user name
and password, answer the security questions, and set up the two-factor
authentication, " says Eric Brickman, chief solutions officer at Newport in
Walnut Creek, California. Participants sometimes assume they are safer
if they never fully set up their online account, he says. " The irony is, that's
the least secure way to handle it, " because keeping their first-time log-in
credentials rather than customizing them makes it easier for cybercriminals
to figure out access. " So every time someone calls into our call center
who hasn't registered their account, we say, 'Hey, we see that you haven't
logged into the site to set up your security credentials.' "
* Take simple preventative steps. Alden says these include not using the
same password for their participant account that they use for other
email or online accounts, not sharing their account log-in information
with others, keeping their contact information up to date with their
plan's recordkeeper, and responding immediately to alerts they get
from the recordkeeper about activity in their account.
* Check your account at least quarterly. If participants never log into
their online account, it could take much longer for a cybercrime to be
discovered. " Retirement accounts are not like an active-trading account:
Many people 'set it and forget it,' and many others are automatically
enrolled, " Brickman says. " Typically, we say to participants, 'You should
be checking your account at least quarterly.' If you're doing that, at least
you're seeing if there has been activity that you don't recognize. "
* Be careful how they access their account. Using free WiFi poses a
security risk, because fraudsters can invade these open networks more
easily, so participants should access their account only from a network
they know is secure. " And if you're using a [public] computer at a hotel
or elsewhere while traveling, don't check the button on a [participant]
website that says something like, 'Remember my login,' " Brickman
says. The next person who accesses that site on that computer will have
entrée to the participant's account, he says.
* Stay wary of suspicious emails or calls. " I tell participants, 'If you haven't
called your plan's recordkeeper to ask about your retirement account,
but you get a call out of the blue from someone claiming to be with your
recordkeeper and asking for your personal information, just hang up,' "
PlanPilot's Mark Olsen says. " That may seem rude, but most likely, that
person is not from the recordkeeper and is interested in getting good
data points so they can try to steal your money. " -JW
planadviser.com January-February 2021 | 17
http://www.planadviser.com
PLANADVISER - January/February 2021

Table of Contents for the Digital Edition of PLANADVISER - January/February 2021
