The Strotman Memo: Widespread Fidelity 401K Fraud?

Bad news if you are a Fidelity 401K account holder: Some Fidelity customer service reps are apparently not so good at protecting customers' account information, and in a few cases have emptied the account holdings to con men. That's not all: It's not entirely clear if Fidelity will reimburse people have been cheated out of their 401K money.


The story comes from a San Francisco Chronicle reporter David Lazarus. He was able to get ahold of an internal Fidelity memo written by Tom Strotman, a Fidelity "director in customer support services focusing on risk management." According to the memo cited in the Chronicle article, Fidelity has had to make "many unpleasant calls" to customers who have been victimzed in a scam which apparently involves Fidelity customer service reps not properly authenticating people on the telephone, and then issuing 401K distributions to imposters.

Not surprisingly, Fidelity is in full damage control mode. From the article:

"But while clarifying that Strotman's department has not had to make 'many' calls related to incidents like the one described in the memo, [Fidelity senior vice president Anne] Crowley declined to directly refute the document's claim that at least some customers' retirement accounts are being emptied by con artists. 'I'm not going to get into parsing the memo line by line,' she said. "

I am more inclined to believe Strotman, rather than the Fidelity spin doctors. For one, Strotman never intended for this to get out; it was an internal memo intended to educate colleagues to reduce fraud. Therefore, I have to take at face value the statement:

43 percent of "invalid calls" received by Fidelity reps last month were not properly authenticated.

Crowley refused to define "invalid call". It's also not clear how many invalid calls Fidelity received in that month. but the Strotman memo said Fidelity investigated 457 cases of potential fraud in 2005, with "over $31 million in customer assets at risk." When the SF Chronicle asked Fidelity's Crowley about this, this was the result:

Of the 457 cases investigated by Fidelity's customer-service risk management team last year, she said only two resulted in a total of $10,750 being compensated to customers.

Before you have nightmares of your 401K being emptied by identity thieves, consider this from the SF Chronicle article:

Retirement funds held by a brokerage are not insured in the same way that bank deposits are. But officials and lawyers say the brokerage is responsible under federal law for safeguarding 401(k) accounts.

And at this point, I'll add a little more information to this story: So-caled "mumble attacks", which involve con men pretending to be speech impaired to corporate customer service reps in order to gain access to accounts or personal information. Is this what happened in Fidelity's case? Fidelity is not a public company, and perhaps doesn't feel it has to talk about the details.

But regardless of Fidelity's lame response, I must point out that the current system of authentication -- telling customer service reps the last four digits of your social security number, and your birthday -- is a pretty flimsy system to protect $10 thousand, $100 thousand, or $1 million dollars in 401K assets.

And it's not just a problem at Fidelity -- other mutual fund companies, banks, etc., use the same processes. I think in five years biometrics will be a common technology, and a better technology for authenticating people. But in the meantime, we are all vulnerable, to a certain degree.

Read this post on PFBlog.com/fidelityobserver -- Reader comments often appear there that won't show up on this page. You can leave comments on either page, I'll read 'em all!