A lawsuit filed in the U.S. District Court for the District of Colorado shows large retirement plan recordkeepers and service providers are increasingly seen as targets for fraudsters.

As outlined in the text of the lawsuit, filed by the state’s U.S. Attorney’s office, on or about November 2016, the FBI Denver Division was contacted by Debbie Muhlhauser, vice president, internal audits, Great-West Financial, “with the referral of a matter involving allegations of fraudulent transfers from clients’ 401(k) accounts from JP Morgan.”

At the time of the report, the lawsuit states, Great-West Financial had 20 participants affected and a loss of at least $1 million dollars with a potential loss in excess of $2 million.

“Although it has yet to be determined why specific accounts were targeted, requests for withdrawals were received, and the requestor was able to provide the plan participants’ biographical data, i.e. name, Social Security numbers, date of birth, and employment data,” the lawsuit text continues. “Because the requests were authenticated with the plan participants’ identifiers, the perpetrator was able to make changes to the accounts and facilitate the withdrawals. Since Great-West’s initial referral, Muhlhauser advised that Great-West continues to identify fraudulent disbursements from participants’ accounts.”

Great-West provided to the FBI a general explanation of how the unauthorized transfers were accomplished, as follows: “An individual plan participant establishes an account online. The Great-West call center assists as needed when contacted by a plan participant. The call center uses a four-part authentication process using biographical identifiers for the plan participant. The plan participant is provided a distribution form via either email or mail. Once a plan participant has access to an account, information can be changed or updated and disbursements can be requested.”

Based on Great-West’s investigation, it appears that unauthorized individual(s) have been fraudulently using this process to obtain access to funds held in retirement accounts. These unauthorized individuals have caused funds to be transferred from those retirement accounts to other bank accounts without the consent or knowledge of the plan participant/account holder.

The text of the lawsuit walks through the various alleged schemes that were used by individuals to in effect steal money from clients of Great West, some of them quite sophisticated. According to the U.S. Attorney’s complaint, analysis of the stolen funds “reveals that [the ringleader of this illegal activity] is receiving wires from multiple fraud schemes and appears to have no personal income coming into the account other than small dollar amount cash deposits.”