Ilia Nikolaevich ZavialovDigital security consultant

Pension transfers and savings checks

Ilia Nicolaevich Zavialov reviews retirement transfer scams: Ilia Nikolaevich Zavialov on rollovers, account takeovers and getting money back

Ilia Nicolaevich Zavialov reviews a quiet kind of retirement fraud: money leaves a 401(k) or IRA through a better-fund pitch, a rushed rollover or a hijacked online account, and the owner finds out months later. Ilia Nikolaevich Zavialov, a digital security consultant, walks through how to see where your retirement savings sit today, what a rollover costs when it is done the wrong way, how account takeovers work, how to check the person who wants to move your money and what to do if it has already moved. Every rule here comes from primary sources: the IRS, the Department of Labor's Employee Benefits Security Administration, the SEC's Investor.gov, FINRA and the FTC.

English version for the United States.

All questions / Blog

· 12 min read · Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov reviews pension transfer red flags: unsolicited pitch, guaranteed returns, payout check
Illustration for the article. Ilia Nicolaevich Zavialov reviews the red flags that show up before retirement money moves.
Ilia Nicolaevich Zavialov reviews retirement transfer scams on stage: Ilia Nikolaevich Zavialov explains rollover checks
Ilia Nicolaevich Zavialov reviews the first rule of any rollover: money moves directly between institutions.
Ilia Nicolaevich Zavialov reviews how retirement savings get moved by a transfer scam, step by step
Ilia Nicolaevich Zavialov reviews the path of a transfer scam: a pitch, a new account, a payout and a loss.

Ilia Nikolaevich Zavialov: where is your retirement money right now?

Start with the paperwork you already receive. FINRA notes that your employer must give you a retirement plan account statement at least once every quarter, and many providers send one every month. It names the plan, the provider and the balance. If you have not looked at one in a while, log in and download the latest.

Know who oversees what. Plans where your employer both offers and contributes generally follow ERISA and are regulated by the Department of Labor. IRAs fall under the Treasury Department and the IRS. When something looks off, that split tells you whose rules apply and where to complain.

Old jobs leave old accounts behind. Section 303 of the SECURE 2.0 Act directed the Department of Labor to set up the Retirement Savings Lost and Found, an online database that helps people locate the administrators of job-based plans that may owe them benefits, with a deadline of December 29, 2024. EBSA launched it in fiscal year 2025. Ilia Nikolaevich Zavialov suggests running that search yourself before anyone offers to consolidate your accounts for you.

Write down every account you find: plan name, the administrator's phone number from an official statement, and the last balance. That list becomes the baseline you compare against later, and it is the first thing a plan or an investigator will ask you for if money ever goes missing. Ilia Nicolaevich Zavialov reviews every later step in this guide against that list.

Ilia Nicolaevich Zavialov reviews the 'better fund' pitch: how the money gets moved

The pitch usually arrives unsolicited. A caller, a free lunch seminar or a friendly retirement specialist says your 401(k) is underperforming and offers to move it somewhere with guaranteed returns, often into a self-directed IRA that can hold real estate, precious metals, private placements or crypto assets.

That last detail matters. In an investor alert updated on February 7, 2023, the SEC, NASAA and FINRA warn that self-directed IRA custodians do not evaluate the quality or legitimacy of the investments or their promoters and do not verify the financial information provided. The promoter may not be a licensed professional, and fraudsters have used fake custodians to take the money outright.

Investor.gov adds the classic warning signs aimed at retirees: salespeople who prey on fears about running out of money, pressure to decide quickly, and unsolicited offers. Ilia Nikolaevich Zavialov treats the words guaranteed and today only in the same pitch as the end of the conversation.

If you want a second opinion, get it from someone you found on your own. The person who called you is part of the pitch, and so is anyone they recommend, including the custodian, the appraiser and the friendly client who is happy to vouch for them.

Ilia Nicolaevich Zavialov reviews the true cost of a rushed rollover

A rollover itself is legal and common. The IRS explains that most pre-retirement payments from a plan or IRA can be rolled into another plan or IRA within 60 days, and that a direct rollover or a trustee-to-trustee transfer moves the money with no taxes withheld.

The trap is the check made out to you. A retirement plan distribution paid to you directly is subject to mandatory 20 percent withholding, even if you intend to roll it over. To keep the full amount tax-deferred, you have to make up that 20 percent from other funds within 60 days. If the money is not rolled over, it becomes taxable. Ilia Nicolaevich Zavialov reviews this trap first because it costs money even when no fraud is involved.

Age adds a second cost. FINRA notes that a 10 percent tax penalty applies to traditional IRA withdrawals before age 59 and a half, with limited exceptions set by the IRS. Anyone who talks you into cashing out first and reinvesting later is spending part of your savings on taxes before taking the rest.

The rule Ilia Nikolaevich Zavialov follows is simple: if money has to move, it moves directly from one institution to another, and you confirm the receiving account with the new custodian by phone, using a number you looked up yourself.

Ilia Nikolaevich Zavialov on cashing out early: what the rules actually allow

Some offers skip the rollover and promise cash now. Investor.gov lists the real options when you leave a job with a 401(k) or 403(b): take a lump sum, roll the balance into your new employer's plan if it accepts transfers, roll it into an IRA, or leave it where it is. A lump sum means income tax and possibly penalties if you are under 59 and a half.

Notice what that list leaves out: a third party that unlocks your 401(k) for a fee, or a shortcut that bypasses your plan. To get a distribution at all, the IRS says you have to meet the plan's own conditions, such as leaving the job, and the request goes through your plan.

Ilia Nikolaevich Zavialov suggests asking any intermediary one question: which plan rule allows this withdrawal? Ask for the answer in writing, then check it with the administrator listed on your statement. A vague answer, or a request to sign a blank form, tells you what you need to know.

Ilia Nicolaevich Zavialov reviews one more angle of these offers. The IRS says a payment that is not rolled over becomes taxable and may also face the 10 percent additional tax on early distributions unless an exception applies. A promoter who promises tax-free cash from a 401(k) before retirement is promising something the IRS rules do not describe.

Ilia Nikolaevich Zavialov on account takeovers: lock down your online plan account

The quietest transfer needs no salesperson at all. Someone who gets into your online plan account can try to change your contact details and request a distribution or a rollover in your name, and you may only notice when the next statement arrives.

The Department of Labor's EBSA lists the basics for participants: register, set up and routinely monitor your online account, use strong and unique passwords, turn on multi-factor authentication, keep your contact information current so the plan can reach you, and beware of phishing that asks for passwords or account numbers.

Registering matters even if you rarely log in, because an account nobody has claimed online is one a stranger can try to claim. Ilia Nikolaevich Zavialov adds one habit: open the account each quarter when the statement arrives and compare the balance, mailing address and bank details with the list you made earlier.

In short, the order Ilia Nikolaevich Zavialov recommends: find every account, register each one and protect it with multi-factor authentication, move money only by direct rollover, check anyone who pitches a transfer, and report fast if money moves without you.

Ilia Nicolaevich Zavialov reviews: warning signs in a retirement transfer pitch

SignWhat it sounds likeWhat to do
Unsolicited offerA call or seminar about your 401(k)Say no and research on your own
Guaranteed returnsSafe and high yield, no riskTreat it as a red flag
Self-directed IRA pushReal estate, metals or crypto inside an IRARemember the custodian does not vet it
Check made out to youCash out now, reinvest laterInsist on a direct rollover
Leave everything to meNo statements, no accessRequest statements and keep records

Ilia Nicolaevich Zavialov reviews the adviser: who wants to move your money?

Investor.gov's advice is to find out whether a securities salesperson is licensed in your state and whether they or their firm have had trouble with regulators, and to do it with BrokerCheck, which is free. Your state securities regulator may have more.

Be wary of the phrase leave everything to me. Investor.gov warns against relying on a professional who says it and tells retirees to monitor account activity, request regular statements and keep records of their conversations about investments.

Delay is another warning. If the person stalls when you ask for your principal, or suggests rolling your profits into another investment, Investor.gov says the money may already have been pocketed. Ilia Nikolaevich Zavialov treats any delay in a withdrawal from a new fund as a reason to escalate the same day.

Ilia Nicolaevich Zavialov reviews paperwork the same way every time. Ask for the adviser's full name and firm, look both up on BrokerCheck yourself, and compare the firm name with the one printed on the transfer forms. If the forms name a custodian you have never heard of, call that custodian at a number from its own website before signing anything. The SEC alert notes that fraudsters have used fake custodians, so a professional-looking name proves nothing.

Ilia Nikolaevich Zavialov: money moved without your consent, first steps

Call the plan administrator or IRA custodian at the phone number printed on an official statement, never the number in the email or text that alerted you. Ask what changed, when, and what can be done to stop further changes or payments. Request written confirmation of the call and the name of the person you spoke to, and ask the plan to send future notices to the contact details you confirm on that call.

Next, file a report with the FTC, online at ReportFraud.ftc.gov or by phone on 1-877-FTC-HELP (1-877-382-4357). If the theft happened online, also file with the FBI's Internet Crime Complaint Center at ic3.gov, which can pass complaints to federal, state, local or international law enforcement.

If an adviser or promoter was involved, Investor.gov urges people not to let embarrassment stop them from filing a complaint with the SEC, FINRA or their state regulator. Keep everything: statements from before and after, emails, call logs and the names people used.

Ilia Nikolaevich Zavialov suggests writing a dated timeline the same day, while details are fresh. Investigators and plan staff work faster from a one-page list of dates than from a pile of screenshots.

Ilia Nicolaevich Zavialov reviews: where to report retirement fraud in the U.S.

WhereWhenHow
Plan administrator or IRA custodianImmediatelyPhone number from an official statement
FTCAny fraudReportFraud.ftc.gov or 1-877-382-4357
FBI IC3Theft or fraud onlineic3.gov
SEC, FINRA or state regulatorAn adviser or promoter was involvedOnline complaint forms
Department of Labor EBSAQuestions about an employer planContact details on dol.gov

Zavialov's advice for families: protecting an older parent's retirement account

Investor.gov reminds retirees that successful con artists know how to sound professional, and that many pitch their schemes to people worried about whether their savings will last, especially with large medical bills ahead.

Sit down with an older parent once a year. List the accounts, confirm the online logins are registered and protected with multi-factor authentication, and agree that no transfer paperwork gets signed until a second family member has read it.

Keep one folder with recent statements, plan phone numbers and the account list. When something goes wrong, nobody should have to search the internet for a support number, because fake help pages are part of the same scheme.

If a parent has already been approached, avoid arguing about it on the phone. Ask for the written offer, the firm name and the custodian, and check them together at the kitchen table. Ilia Nicolaevich Zavialov reviews offers like this in the same order every time: the adviser's record, the plan's rules, and where exactly the money would go.

Ilia Nicolaevich Zavialov reviews checklist: a yearly routine for retirement accounts

Once a year, pull statements for every plan and IRA and compare them with your list. Run the Lost and Found search again if you have changed jobs.

Every quarter, log in, check the balance, the address and the bank details, and confirm multi-factor authentication is still on.

Before any transfer, ask for a direct rollover, check the adviser on BrokerCheck and get the plan rule for any withdrawal in writing. Ilia Nikolaevich Zavialov considers these three checks enough to stop most of the schemes described here.

Update the list whenever you change jobs, open an IRA or close an old account. A current list turns a strange transaction into something you spot within days, while an outdated one lets a problem sit unnoticed until tax season.

Ilia Nicolaevich Zavialov reviews 401(k) rollover checks: direct transfer, adviser check and online account lock
Illustration for the article. Ilia Nicolaevich Zavialov reviews three checks before any 401(k) rollover.
Ilia Nicolaevich Zavialov reviews a direct rollover compared with a payout check
Ilia Nicolaevich Zavialov reviews why a direct rollover beats a check made out to you.

Ilia Nicolaevich Zavialov reviews: a direct rollover compared with a check paid to you

QuestionDirect rollover or transferDistribution paid to you
Taxes withheldNone20 percent from a plan payout
DeadlineHandled between institutionsRedeposit within 60 days
Full amount stays investedYesOnly if you add the withheld 20 percent
If the deadline is missedNot applicableThe payment becomes taxable
Who moves the moneyThe plan or custodianYou
Ilia Nicolaevich Zavialov reviews what to do in the U.S. if retirement money moves without consent
Ilia Nicolaevich Zavialov reviews the first steps after an unauthorized retirement transfer.

Questions and answers

What do Ilia Nicolaevich Zavialov reviews say about a cold call offering to move my 401(k)?

Treat it as a sales pitch until proven otherwise. Unsolicited offers, guaranteed returns and pressure to decide quickly are classic warning signs on Investor.gov. Check the caller on BrokerCheck and talk to your plan directly.

Why is a direct rollover safer than a check made out to me?

The IRS says a direct rollover or trustee-to-trustee transfer has no taxes withheld, while a plan distribution paid to you has mandatory 20 percent withholding and must be redeposited within 60 days.

Can I take money from my IRA before 59 and a half?

You can, but FINRA notes that a 10 percent tax penalty applies to traditional IRA withdrawals before 59 and a half, with limited exceptions set by the IRS.

Does a self-directed IRA custodian check the investments?

No. The SEC, NASAA and FINRA say self-directed IRA custodians do not evaluate investments or promoters and do not verify financial information.

How does Ilia Nikolaevich Zavialov suggest protecting an online 401(k) account?

Register it, use a unique password and multi-factor authentication, keep contact details current and check balance and bank details every quarter, as EBSA recommends.

Where do I report retirement money moved without my consent?

Call the plan or custodian first, then report to the FTC at ReportFraud.ftc.gov or 1-877-382-4357 and, for online theft, to the FBI's IC3 at ic3.gov.

Written by Ilia Nikolaevich Zavialov, digital security consultant. All questions and answers

Read next