Schwab 401k 'hacked'; somehow they added/linked an unknown bank account and transfered out ~10% of my balance!! How

Question

I recently received a couple of 'notification' emails from Schwab re. the approval/completion of various changes I supposedly requested to an old 'inactive' (past employer) 401k account, including:

1. the addition of a bank account linked to my Schwab 401k;
2. the successful transfer of 10% of my 401k to the linked bank account;
3. and the required IRS 'penalty' forms resulting from my 401k early withdrawl.

Having significant Network/IT related experience, my first reaction was to 'trace/track' any info I could find to help ID the thief, however, I noticed that the transferred funds had just cleared that same day (literally, ~6 hours earlier) AND the added/linked unknown bank account was still active; so, I immediately set up a reverse transfer back to my 401k (~10% +$50 to cover any potential fees I might need to cover as a result). I contacted Schwab next, and explained what I had done. They all seemed to get a kick out of my reverse transfer, but also informed me that my funds would be returned regardless and they would handle reverting my account to its original status with additional security protocols. In the end, my reverse transfer went through and the unknown bank account was deleted. About a week later Schwab subtracted the extra $50 reverse transfer portion. I contacted them to find out why (-$50), and what the status was with my ID/Bank Fraud (victim) case. I was shocked to find that their position/policy in such security breach / fraud cases was; "these ID Theft rings are highly sophisticated and nearly impossible to catch....it very well may have been an 'inside' job scenario, and there really is not anything more Schwab can do unless the police get involved...which typically is a dead end anyway...".

So...my general question(s):

1. Is there any truth to Schwabs' responses or are they just trying to avoid any bad publicity?
2. It's been over 3 months now and I am still feeling an excessive insecurity regarding all my internet financial accounts, and a continuous suspicion that it may have been a 'personal attack'. Any advice or suggestions on dealing with this situation or my options (legal or otherwise) should I choose to pursue this matter would be gratefully appreciated.
3. And, where did the extra $50 go? Why does Schwab get to profit from my loss (do I still have to pay the penalty for early withdrawl or do I need some documentation from Schwab?).

Answer 1

In essence, Schwab is stating that they are not a law enforcement agency and they have neither the interest nor the legal right to pursue criminals. They state that they will assist law enforcement but also tell you that, from their experience, law enforcement while they have the legal right also don't have any interest in doing so.

This is completely correct.

I'm not going to comment on what you should do to protect yourself from identity theft.

With respect to the reverse transfer: you are on very shaky legal ground here - you transferred funds without authorization and you are not legally allowed to do this even to recover your own losses. If you had limited this to just recovering your own funds then you would be extremely unlikely to be prosecuted but by taking more than was yours you have technically committed a theft of your own. That said, it seems unlikely that law enforcement will be interested - Schwab are not making a complaint and I doubt that the original thief will - for obvious reasons.

However, its possible (even likely) that this was not the thief's bank account - this is likely to be an innocent third party's account that the thief was using to obfuscate their crime. If so, the money you took (both the original amount and the extra $50) you took actually belongs to that innocent party - your money had probably spent very little time in that account.

Answer 2

This answer only addresses your question #3 about the early withdrawal penalty.

There is a general provision that if funds withdrawn from a retirement account are "rolled over" into another retirement account within 60 days, then the 10% tax penalty won't apply. The tax might be withheld by the broker, but you can get it refunded when you file your taxes for the year. This article suggests that this also applies when you deposit funds back into the same account from which they were withdrawn, though I can't find explicit confirmation of that from an official source.

But if you can't find another way to avoid the penalty, you might be able to take advantage of this provision. You'd want to discuss it with the people at Schwab as well as your own tax advisor.

Answer 3

Banks have convinced the public of a false sense of security regarding money that clients have in their accounts. People are under the general assumption that money they have in their bank is safe and it could never disappear. However, this unfortunately isn't the case. These banks are incredibly unprotected and insecure in the digital age. These banks need to be pressured to better secure these accounts. As of now, they can pretty much claim no responsibility when their client's accounts are hacked unless it is proven in court.

When a customer has their money stolen out of their accounts, it's also very difficult for the bank to verify the theft. The user could have used an IP address in a foreign country to login to their account and transfer funds. As a result, the bank doesn't know if it's theft or if the user is defrauding the bank and claiming fake fraud.

What ends up happening is that the bank then has option of taking the loss and reimbursing your account. They generally only choose to do this if the loss is insignificant and they don't want to lose your business. If the loss is substantial, the bank will generally require that you prove the theft in a court of law. Once the theft is proven, then the bank will likely reimburse your loss. This is generally reimbursed through their insurance and/or FDIC.

Because the theft has not yet been proven, the bank is able to charge you reverse transfer fees as consented by their terms of service. It's not fair. But then again, it's a bank.

In terms of being taxed on your IRA early withdrawal, you have 60 days to return IRA funds back into an IRA account without being taxed. If the funds are taken out of the account for longer than 60 days then there is an early distribution penalty of 10%. In your case, if you returned the funds back to your IRA within 60 days you don't have to pay the tax on those funds.

Answer 4

Is there any truth to Schwabs' responses or are they just trying to avoid any bad publicity?

If you mean the part saying they can't be tracked, tbh we have no way to tell without being Schwab.

It's been over 3 months now and I am still feeling an excessive insecurity regarding all my internet financial accounts, and a continuous suspicion that it may have been a 'personal attack'. Any advice or suggestions on dealing with this situation or my options (legal or otherwise) should I choose to pursue this matter would be gratefully appreciated.

Who would you go after if you don't know who did it?

And, where did the extra $50 go? Why does Schwab get to profit from my loss (do I still have to pay the penalty for early withdrawl or do I need some documentation from Schwab?).

I would assume they would refund the penalty given the circumstances, but you would have to ask them.