Impostor Drains $751,430 from Colgate-Palmolive Employee 401(k)

An impostor called Alight Solutions, the recordkeeper for Colgate-Palmolive's 401(k) plan, and provided the account holder's name, the last four digits of her Social Security number, date of birth, and existing mailing address. Alight updated the contact information and later mailed a temporary password to the new address.

The plan included a 14-day waiting period between an address change and any distribution. The impostor later requested and received the entire $751,430 balance in a single payment sent to a Las Vegas address and bank account. The account holder, Paula Disberry, was living in South Africa at the time.

Disberry sued Alight, Colgate-Palmolive's benefits committee, and BNY Mellon, the plan custodian, to recover the funds.

The lawsuit was settled on undisclosed terms without a court ruling on whether Alight was required to restore the funds. The case began when the impostor contacted Alight's Benefits Information Center and cleared the call center's security check using the information already on file. Alight did not send an alert to Disberry's existing email address or phone number.

A separate lawsuit filed by former Abbott Laboratories employee Heide Bartnett alleged that a hacker used the plan portal's "forgot password" feature to obtain a $245,000 distribution. U.S. Department of Labor to issue new guidance on retirement plan participant data after reviewing eleven lawsuits filed under the Employee Retirement Income Security Act between 2009 and 2024.

5 billion of those losses.