Pension Fund Cybersecurity Guide: Member Accounts, Administrators and Fraud

Pension schemes hold large pots of money, decades of personal data and long-dormant member accounts, and most of that sits with outsourced administrators the trustees do not run. That combination makes pensions a target for two kinds of attacker: those who want data at scale from an administrator, and those who want to redirect one member's benefits through a fraudulent transfer, address change or bank detail change. This guide is for trustees, scheme managers, pension administrators, in-house pension teams and the security staff who support them. It covers what the UK Pensions Regulator (TPR) and the US Department of Labor's Employee Benefits Security Administration (EBSA) expect, how to secure member accounts and administrator access, how to stop transfer and payment fraud, and how to respond when an administrator is breached.

Key takeaways

• Trustees stay accountable. TPR's cyber security principles say trustees and scheme managers remain accountable for scheme information and assets even when administrators and suppliers hold the data.
• The administrator is the main attack surface. A single administrator breach can touch hundreds of schemes at once, so supplier assurance, incident notification terms and exit data arrangements matter more than controls inside the trustee board.
• Fraud targets the change, not the login. Address changes, bank detail changes, transfers and full-balance withdrawals are where money moves; put extra verification and cooling-off on those events.
• Core payments must keep running. TPR expects pensioner payments, retirement processing and bereavement services to be restored as soon as safe, ideally within 24 hours.
• Tell members early. TPR's guidance and its Capita intervention report both say not to wait for confirmation of data exfiltration before warning members at risk of scams.

Why pension schemes are different

Pensions combine features that rarely appear together elsewhere:

• Long-lived identities: a deferred member may not log in for 20 years. Contact details go stale, and an attacker who changes an address or email first can intercept every later communication.
• High-value, one-off transactions: a transfer out or full-balance withdrawal can move a lifetime of savings in a single instruction. Once paid to another scheme or account it is hard to recover.
• Layered outsourcing: trustees appoint administrators, who use payroll bureaus, tracing agencies, printing and mailing houses, actuaries and software suppliers. Each holds member data. See the Fourth-Party and Nth-Party Risk Guide.
• Vulnerable members: older members and bereaved families are frequent targets of social engineering. See the Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide.
• Lay governance: trustee boards often include member-nominated trustees without security backgrounds, so oversight relies on clear reporting from administrators.

What regulators expect

TPR's principles scale controls to risk: the largest and highest-risk schemes and suppliers should fully meet the NCSC 10 Steps to Cyber Security, while the smallest should at least consider the NCSC small business guide. Technical controls are expected to align with Cyber Essentials. See the Cyber Essentials Guide.

Securing member accounts

Member portals and contact centres are the front door for account takeover. EBSA's best practices ask service providers to verify participant identity, confirm the identity of fund recipients, alert members to account information changes and apply extra validation to personal information changes and full-balance distributions.

• Authentication: offer MFA on the member portal and require it before any change of address, email, phone or bank details. EBSA asks for MFA that is phishing-resistant where possible. See the Phishing-Resistant MFA Guide.
• Registration: first-time online registration is a takeover point for dormant accounts. Send an activation code to the address on file by post, not to a new email supplied during registration.
• Change notifications: notify the old and new contact points after any change, so a genuine member sees an attacker's edit.
• Contact centre: callers asking for a change should pass knowledge-independent checks (a call-back to the number on file, a one-time code to a registered device). Do not rely on date of birth, National Insurance or Social Security numbers, or postcode, which leak in breaches. See the Help Desk Identity Verification Policy Template.
• Bereavement and power of attorney: these flows hand control of an account to a third party. Verify the documents with the issuing source where possible and route them to a specialist team.

High-risk events and controls

NHI Mgmt Group recommendation: set a hold of several working days between any contact or bank detail change and the first payment or transfer that follows it, and notify the member through the old contact point during that hold. See the Account Takeover Prevention Guide and the Authorised Push Payment (APP) Fraud Guide.

Administrators, suppliers and where identity fits

TPR tells trustees not to assume suppliers have adequate controls and to seek evidence. Accreditations such as Cyber Essentials, Cyber Essentials Plus or ISO 27001 may help, but trustees should check what audits, tests and insurance actually cover and exclude. EBSA's tips for hiring a service provider make the same point for US fiduciaries.

• Contract terms: incident notification timescales, plain-English regular reports on threats and breaches (TPR), MFA and encryption requirements and breach notification (EBSA), right to audit, and subcontractor disclosure.
• Exit and legacy data: TPR says that when changing supplier, trustees should establish who is legally responsible for data after exit, how long it is kept, where and how it is protected. The Capita report found data held by former administrators may still be the trustees' responsibility.
• Administrator staff access: administration platforms let staff change bank details and authorise payments. Require named accounts, MFA, role-based access and four-eyes approval for payment changes. EBSA asks for access reviews at least every three months.
• Machine access: payroll file transfers, bank payment interfaces, tracing services and the employer's contribution feeds run on service accounts, SFTP keys and API credentials. Inventory them, assign an owner, rotate them and restrict them to the systems they serve. See the Service Account Security Guide.
• Trustees' own devices: TPR expects trustees to have policies on sending scheme information to personal email and accessing it on mobile devices. Give trustees a managed board portal rather than email attachments.

See the Third-Party Risk Management Guide for the wider programme.

How to implement: a phased approach

1. Map the footprint (month 1): list administrators, employers, advisers and suppliers, the member data each holds, and the critical functions (benefit payments, retirement processing, transfers). Record cyber risk on the scheme risk register. See the Risk Register Template.
2. Gather supplier evidence (months 1 to 3): request each key supplier's certifications, latest independent audit and penetration test summary, incident response plan and notification commitments. Note gaps and agree remediation dates.
3. Harden member-facing changes (months 2 to 4): with the administrator, add MFA to change events, change notifications and holds on payments after changes. Pilot with one member segment and monitor complaint and abandonment rates before extending.
4. Write and rehearse the incident plan (months 3 to 5): cover roles, escalation, who informs trustees, member communications, regulator reporting, and restoration priorities for core payments. TPR points to the NCSC Exercise in a Box tool. See the Incident Response Plan Template.
5. Prepare communications (month 5): draft member notices and scam warnings in advance, a lesson TPR drew from the Capita incident.
6. Review annually: TPR expects assessments, controls and plans reviewed at least annually and after significant change, such as a new administrator or system.

Rollback: if new verification steps cause genuine members to fail transfers or withdrawals, keep the hold and notification controls (they cost little) and relax only the step that fails, with a manual verification route for those members.

Responding to an administrator breach

TPR's Capita intervention report (published 2 February 2024) describes a breach Capita became aware of on 31 March 2023, with access appearing to start around 22 March 2023. TPR contacted 383 schemes its records showed Capita administered. Lessons for trustees:

• Expect a matching workload: identifying compromised data and mapping it to schemes and members takes time.
• Warn early: contact members at risk before the investigation finishes, with scam warnings.
• Watch transfers: monitor for unusual transfer requests after a breach.
• Keep records current: keep contact details up to date on TPR's Exchange system so the regulator can reach the board.
• Know the notification route: understand how each supplier will tell you about an incident and rehearse it.

US plans should follow EBSA's incident response practice: notify law enforcement and the insurer, investigate, and notify affected participants without unreasonable delay, alongside state breach laws. See the Third-Party Incident Response Playbook.

Decision guidance

• Small schemes: rely on the administrator's controls, but get evidence, put cyber risk on the register, hold a tested plan and pre-drafted member communications. TPR's small business guide threshold applies.
• Large schemes and master trusts: expect NCSC 10 Steps coverage from administrators, independent assessment by a cyber specialist, and metrics reported to the board each quarter. Authorised master trusts also use TPR's significant event reporting.
• In-house administration: the scheme carries the full technical control set itself, including privileged access to the administration platform. See the Privileged Access Management Guide.
• Friction versus fraud: holds and step-up checks frustrate genuine members. Apply them to change and payment events, not to viewing balances.

Detection and measurement

• Monitor: contact and bank detail changes followed quickly by a withdrawal or transfer, many changes from one IP address or device, registrations on long-dormant accounts, and administrator staff changing payment details outside normal patterns.
• Log: audit trails of processing activity (TPR) with who approved each payment change.

Common failure patterns

• Accepting a certificate as assurance: trustees file an ISO 27001 certificate without checking its scope covers the pensions platform.
• No hold after a change: address and bank changes take effect immediately and the withdrawal follows the same day.
• Knowledge-based checks only: contact centres verify callers with personal data that is already in criminal hands after a breach.
• Waiting for the forensic report: members are not warned until weeks after a breach, while scammers use the stolen data.
• Forgetting the old administrator: data left with a previous administrator is out of sight but still the trustees' responsibility.
• Untested plans: the incident plan exists but has never been exercised with the administrator.

Framework mapping

Practitioner checklist

• Record cyber risk on the scheme risk register and review it at least annually.
• Map administrators, suppliers, member data and critical functions.
• Hold current assurance evidence for every key supplier, with scope checked.
• Require MFA or call-back for contact and bank detail changes, with notifications to old and new contacts.
• Apply a hold between a change and the first payment or transfer.
• Apply transfer red and amber flag checks and record evidence.
• Require four-eyes approval and quarterly access reviews for administrator payment functions.
• Keep a tested incident plan and pre-drafted member communications and scam warnings.
• Know the reporting routes: TPR, ICO, Report Fraud, and EBSA practices for US plans.

Standards and references

• The Pensions Regulator: Cyber security principles for pension schemes
• The Pensions Regulator: Capita cyber security incident regulatory intervention report
• legislation.gov.uk: Occupational and Personal Pension Schemes (Conditions for Transfers) Regulations 2021, regulation 8
• US Department of Labor: Cybersecurity Program Best Practices
• US Department of Labor: EBSA updated cybersecurity guidance news release
• NCSC: 10 Steps to Cyber Security
• The Pensions Regulator: General code of practice, cyber controls
• Report Fraud: Should I report to Report Fraud? (Scotland: Police Scotland on 101)

Related NHI Mgmt Group resources: Fraud and Cyber Convergence Guide · Account Recovery and Help Desk Security Guide · Third-Party Risk Management Guide · Board Cyber Report Template. This guide summarises regulatory expectations and is not legal advice.