ERISA Benefits Law Desk ReferenceERISA Benefits Tech, LLC

Part 24 · Chapter 2

Fraudulent Distributions, Loss Allocation, and Incident Response

Law stated as of October 3, 2026 · Benefits Cybersecurity and Data Incidents

Scope and status

This chapter covers account-takeover fraudulent distributions from retirement plan accounts and cyber incident response for benefit plans: the fact pattern and legal theories, the developing case law, how the loss is allocated in and out of litigation, the tax treatment of restorative payments, the notification analysis (including the absence of any ERISA breach-notification rule), and the incident-response sequence. Scope discipline: this chapter supplies doctrine, exposure analysis, and response posture. Litigation strategy is reserved for litigation counsel (see Part 23 (ERISA Disputes, Enforcement, Preemption, and Remedies)).

Citations are to primary authority (ERISA §§404, 405, 409, 412, 502; 29 C.F.R. §§2560.503-1, 2580; Rev. Rul. 2002-45; and the case law as cited). Authority-level discipline: this area is almost entirely district-court motion-to-dismiss law. Tag it as such and do not overstate it (B1). For HIPAA breach notification, see Part 13 (COBRA, HIPAA, and Welfare Benefits); see Part 21 (Plan Corrections: EPCRS, VFCP, and DFVCP) for VFCP correction; see this Part's vendor/insurance chapter for the fidelity bond and insurance layering.

Sections

Part A is shown in full. The other sections are listed by title; their text is available to subscribers.

Part A — The Fact Pattern and the Legal Theories

A1.How account takeover happens

Part 24, ch. 2, § A1

The recurring pattern: a fraudster obtains identifying data (SSN, date of birth, address) from an unrelated prior breach; contacts the recordkeeper's call center or web portal and completes a credential reset or obtains a one-time passcode; changes the mailing address, email, and phone number on the profile; adds a new bank account for ACH; and then requests a full lump-sum distribution days or weeks later. Practitioner consensus; drawn from the pleadings in the cases at B1.

A2.The theories, and who the defendants are

Part 24, ch. 2, § A2

A defrauded participant has several routes, which allocate the loss very differently:

  • §502(a)(1)(B) — benefits due. The payment to a thief was not a valid distribution under the plan's terms, so the vested account balance remains an unpaid benefit owed by the plan. Statute: ERISA §502(a)(1)(B), 29 U.S.C. §1132(a)(1)(B). This is the most potent and least-litigated theory because it does not require proving imprudence — but it makes the plan (and therefore the remaining participants) the payor, which is precisely the allocation problem in C3.
  • §502(a)(2)/§409 — fiduciary breach. The breaching fiduciary must "make good to such plan any losses"; losses to an individual account are recoverable. Statute: ERISA §§502(a)(2), 409, 29 U.S.C. §§1132(a)(2), 1109; Case law: Supreme Court — LaRue v. DeWolff, Boberg & Assocs., 552 U.S. 248 (2008).
  • §502(a)(3) — equitable relief, constrained by the Great-West/Montanile line. Statute: ERISA §502(a)(3); Case law: Supreme Court — Great-West Life & Annuity Ins. Co. v. Knudson, 534 U.S. 204 (2002); Montanile v. Board of Trustees, 577 U.S. 136 (2016).
  • §405 co-fiduciary liability and the duty to monitor — the sponsor's principal exposure route where the operational failure occurred at the recordkeeper. Statute: ERISA §405; Case law: Supreme Court — Tibble v. Edison Int'l, 575 U.S. 523 (2015).
  • State-law claims against the recordkeeper (consumer fraud, negligence), whose preemption status is unsettled (B3).

Potential defendants: the plan sponsor/administrator; the benefits committee as named fiduciary; the recordkeeper as a functional fiduciary under §3(21)(A)(i) (control over plan assets) or (iii) (discretionary authority in administration); and the directed trustee/custodian. Statute: ERISA §3(21)(A).

Part B — The Case Law (district-court law; do not overstate)

  1. B1Status of the authoritySubscribers
  2. B2Disberry v. Employee Relations Committee of the Colgate-Palmolive Co. — fiduciary statusSubscribers
  3. B3Bartnett v. Abbott Laboratories — the monitoring defenseSubscribers
  4. B4Berman v. Estée Lauder and Leventhal v. MandMarblestone GroupSubscribers
  5. B5Recent developmentsSubscribers

Part C — Loss Allocation

  1. C1Recordkeeper customer-protection guaranteesSubscribers
  2. C2The services agreement is the operative allocation documentSubscribers
  3. C3Restoring from plan assets — the unresolved problemSubscribers
  4. C4Restorative payments — the tax treatmentSubscribers

Part D — The Notification Analysis

  1. D1There is no ERISA breach-notification ruleSubscribers
  2. D2State breach-notification lawSubscribers
  3. D3Health plans — HIPAA breach notificationSubscribers
  4. D4Distinguish the two analysesSubscribers

Part E — Incident Response

  1. E1The sequenceSubscribers
  2. E2Post-incident fiduciary remediationSubscribers

The first Part of each chapter is open to everyone. The remaining sections, with their authority and practice points, are available to subscribers and to clients of ERISA Benefits Law Group, PLLC whose engagement includes access.

Sign inSubscribe