Unfortunately, hackers set their sights on more than just bank accounts. Cybercriminals have started breaking into retirement funds to gain access to people’s hard-earned money. It’s a lucrative business — retirement accounts essentially put all the nest eggs in one basket and the payoff can be an entire lifetime’s worth of savings.
How do they do it? What’s the best way to stop them in their tracks?
Common Hacking Methods
Cybercriminals use a suite of strategies to take over people’s accounts. Here are some of the most widely used techniques.
1. Ransomware
Hackers install software on a company network. They often do this by sending emails containing links that look legitimate, but actually install malicious code. This software either locks people out of the computer system or holds their data hostage and then the hackers demand payment to restore access.
2. Spoofing
Employees might receive an official-looking email regarding their retirement plan. It contains a link telling them they need to update their financial information, which appears to be from their workplace or bank. But the link actually leads to a well-designed copy of a legitimate website.
When clicking the link, the victim will think they’re on an official company site because the hackers have carefully replicated the website’s appearance. The victim then enters their information and unwittingly sends it to the hackers. Spoofing can also involve criminals copying a familiar caller ID or email address to trick the victim.
3. Phishing
The victim receives an email pretending to be from someone familiar, such as a manager or bank account employee. This email is designed to gather information about the victim. It might have an urgent tagline, such as “Changes to Your Roth IRA Account.”
The cybercriminal may ask for passwords, bank account information or details about an employee’s retirement plan. The victim readily supplies this data because they trust the person they think sent the message.
In 2021, for example, a hacker stole $3.5 million from a retirement system that included over 3,000 people by emailing one of the board’s investment managers. In the email, the hacker posed as a former employee and told the manager to transfer the money to a third-party bank. The funds then disappeared and have not been recovered.
4. Spyware
Cybercriminals install software on someone’s device that allows them to track the user’s data. The hacker then monitors the victim’s online behavior — such as which websites they visit and their login information — and uses this knowledge to hack into their accounts.
5. Social Profiling
Posting information on social media isn’t as harmless as many people assume. Hackers trawl through public profiles to learn about a person’s job, educational background, hobbies, family members and current needs, such as if they’re looking for furniture. They can then use this data in several ways.
For example, they might craft an ad for the type of furniture the social media user was looking for on Facebook. They can then post the malicious ad on websites the victim frequents that installs malicious software when the victim clicks on it.
Or, hackers can use the information they gather from public accounts to guess passwords. People commonly use birthdays, pet names and favorite foods as passwords, which makes it easy for hackers to break into their accounts.
Preventing Cyberattacks
Here are some ways individuals and organizations can protect their retirement accounts against being hacked:
- Having backup plans for situations in which computer systems go down.
- Using strong passwords and changing them regularly.
- Only using trustworthy companies to manage retirement accounts.
- Generating complicated, encrypted passwords and storing them via a password manager.
- Using network segmentation.
- Using different passwords for every account.
- Adding a banner to emails coming from outside the company.
- Disabling hyperlinks in incoming emails.
- Always using secure networks rather than unsecured networks like Wi-Fi.
- Installing antivirus software on all devices.
- Regularly updating antivirus software.
- Backing up data and keeping offline copies of the backups.
- Updating all software, firmware and operating systems regularly.
- Turning on auto-updates for all security software.
- Only allowing people with admin privileges to install software.
- Auditing administrative accounts regularly.
- Turning on multi-factor authentication — also called two-factor authentication — for secure systems.
- Using passphrases instead of passwords.
- Turning off remote access.
- Keeping backups of all critical data files and ensuring they can’t be modified or deleted.
- Turning off unused RDP ports and keeping an eye on their logs.
- Encrypting data by installing a virtual private network.
None of these methods are foolproof, but they form a considerable barrier against cyberattacks together.
Standing Up to Cyberattacks
Anyone with a retirement plan is at risk of being hacked. However, it’s certainly not a guarantee — there are multiple ways people can shore up their defenses against cybercrime. By using strong computer security habits and a little common sense, people can protect their accounts from criminal activity so they can retire in peace.
Devin Partida writes about investor technologies, big data and apps. She is also the Editor-in-Chief of ReHack.com.
Leave a Reply