Empower's new 401(k) cybersecurity guarantee a sign of the times

Empower Retirement, one of the largest retirement-plan record keepers, has begun offering participants a backstop against financial losses resulting from cyber attacks — both a sign of the mounting threat digital crime poses in the 401(k) market and the shifting competitive landscape for service providers. Empower, which administers $534 billion for about 9 million participants, began offering a "security guarantee" to DC-plan investors in the first quarter, joining other record keepers that offer similar cybersecurity measures. The guarantee, which hasn't been previously reported, restores participant money lost due to unauthorized transactions that occur through no fault of the investor. It applies only to accounts maintained by Empower, not to third-party accounts such as outside self-directed brokerages. "If someone hacks in and steals $50,000, we'll make them whole," Edmund F. Murphy III, the president of Empower Retirement, said Monday afternoon at the Kohler Retirement Plan Advisor Conference in Kohler, WI. (More: IRA assets will almost double those in 401(k) plans over next five years) "We're in the record-keeping business," Mr. Murphy said. "People trust their assets with us." The move to hedge against cyber crimes comes as the retirement industry has seen a "massive uptick in fraud," said Doug Peterson, chief information security officer at Great-West Financial, a sister company of Empower Retirement. Other large providers, such as Charles Schwab, Wells Fargo and Fidelity Investments, the largest retirement record keeper, have added similar security guarantees, said Andrew Way, the retirement manager at Corporate Insight. But, the fact that Empower — the second-largest record keeper by participant count — launched a measure to protect participants from cyber theft is an important indicator of what clients and advisers are coming to expect from service providers, Mr. Way and other analysts said. "I certainly do think it's a sign of the times," said Neil Bathon, managing partner at FUSE Research Network. "I believe this sort of thing is going to be a requirement by plan sponsors in the not-too-distant future, where now it is definitely a differentiator." The bidding process for record keepers to win business has evolved over the past three to five years, said Mr. Murphy, explaining that they now incorporate "exponentially" more questions about cybersecurity.