District Court Narrows $750,000 Retirement Theft Lawsuit Claims

A federal judge granted the motion to dismiss one of three defendants in a retirement theft lawsuit. 

A New York judge denied two motions to dismiss fiduciary breach claims brought by a retired Colgate-Palmolive marketing executive against Alight Solutions and the Colgate-Palmolive employee relations committee—but granted the motion to dismiss the Bank of New York Mellon Corporation from the lawsuit.

Plaintiff Paula Disberry’s original complaint, filed in U.S. District Court for the Southern District of New York, stated that in September 2020, after unsuccessfully trying to log in to her account, she was informed her entire accumulated retirement plan balance of $751,430.53 had been withdrawn in one lump sum without her knowledge.

Court documents show that a fraudster was able to intercept a temporary PIN sent by Alight to Disberry’s correct address in January 2020, changed the address to the fraudster’s residence in Las Vegas and proceeded to request distribution from Alight in March 2020, all despite multiple failed attempts at identity verification.

“On March 20, 2020, BNY Mellon mailed a check for $601,144.42 ($751,430.53, the gross amount of the distribution, less mandatory tax withholdings) to the Las Vegas mailing address,” states the court order. “Whoever received the check cashed or deposited it at a bank in Las Vegas on March 27, 2020.”

Disberry’s complaint alleged one count against all defendants for breach of fiduciary duty under the Employee Retirement Income Security Act.

Each of the three defendants argued that allegations in the complaint should be dismissed for failure to state a claim under the Federal Rule of Procedure Rule 12(b)(6). Under ERISA, to sufficiently state a claim for breach of fiduciary duty, the plaintiffs must allege that the defendant was acting as a fiduciary to the plan, the defendant breached that duty and, lastly, that the breach caused harm to the plaintiffs.

Alight Solutions and BNY Mellon moved to dismiss the claim on the basis they were not acting as fiduciaries for the plan. Senior U.S. District Judge Colleen McMahon granted BNY Mellon’s motion, but she ruled against dismissing the plaintiff’s claims against Alight Solutions.

“It is not possible to dismiss out of hand the possibility that Alight would qualify as a ‘functional fiduciary’ within the meaning of ERISA, given its alleged role in directing the institution that held the plan assets (BNY Mellon) to make the distribution in the plaintiff’s case,” McMahon wrote.

Alight argued, unsuccessfully, it was not a plan fiduciary because the plaintiff’s complaint identified it as “performing purely ministerial tasks,” the judge states in the order.

However, an organization may also be deemed an ERISA fiduciary if it meets the definition of “functional fiduciary,” as defined by 3(21)(A) of ERISA—detailed in an advisory opinion by the Department of Labor’s Employee Benefits Security Administration—which was also noted in McMahon’s order.

ERISA requires that every employee retirement benefit program must provide for one or more named fiduciaries to possess the authority for control, operation and administration of the plan. For the Colgate-Palmolive plan, the entity or individual identified as the administrator in the plan document is automatically deemed a named fiduciary, which is in this case the retirement plan committee, not Alight Solutions, according to the order.

McMahon’s decision stated, “Common law claims that would be preempted were they asserted against a plan fiduciary may in fact be asserted against non-fiduciaries such as persons who perform ministerial tasks with respect to an ERISA plan.”

BNY Mellon served as a plan trustee for the Colgate-Palmolive retirement plan, provided investment management services, served as custodian of the plan’s assets and made payments from the plan’s trust fund, according to court documents. BNY Mellon was dismissed as a defendant because it did not act as a fiduciary for the plan, ruled McMahon.

“Its argument succeeds where Alight’s failed,” she wrote. “The only action that BNY Mellon took in connection with the fraud was to issue a check for the amount in the plaintiff’s account.”

As the plan administrator and named fiduciary for the Colgate-Palmolive defined contribution plan, the committee did not dispute that the first factor applied. Instead, it argued that Disberry failed to plead facts showing the committee breached any fiduciary duty to the plaintiff or that any act of the committee caused the harm.

“I agree with the plan committee,” McMahon wrote. “The plaintiff is the unfortunate victim of a clever criminal. But the committee—the one entity that inarguably can be sued under ERISA (and only ERISA)—is simply not alleged to have done anything that violates ERISA.”

Despite her agreement, McMahon did not dismiss the allegations because of the potential for negligence on behalf of the committee in its choice and monitoring of Alight Solutions.

While the complaint alleged, in “purely conclusory fashion,” that each of the “defendants failed to monitor other’ fiduciaries distribution processes, protocols and activities … [I]f indeed the committee was negligent in its selection of Alight or in monitoring Alight’s protocols and activities (whether or not Alight was a fiduciary), it might be liable for breach of fiduciary duty,” McMahon wrote.

McMahon’s order also set the leave-to-amend and discovery schedules for the continuing case against Alight and the Colgate-Palmolive employee relations committee.

Alight Solutions did not respond to a request for comment. Representatives for BNY Mellon and Colgate-Palmolive declined comment.

Cybersecurity: Key Considerations and Resources for Plan Sponsors

There is no hiding from attacks on your plan’s technology and data. What are the most important steps you can take to stay prepared?

The COVID-19 pandemic’s acceleration of remote working brought with it a renewed awareness of cybersecurity-related issues, as people established offices and networks outside the “protection” of an in-office environment. Scammers and cybercriminals also used fears of the coronavirus to their advantage. The Financial Industry Regulatory Authority noted the increased risks in an information notice from March 2020, “Cybersecurity Alert: Measures to Consider as Firms Respond to the Coronavirus Pandemic (COVID-19).”

In addition, the U.S. Department of Labor’s 2021 guidance on cybersecurity put a spotlight on the topic and prompted renewed industry discourse about its importance. At the heart of the matter for plan sponsors is: Who has access to your participant data, and how are you protecting that data?

When it comes to a data breach, it’s not a matter of if, but when. As one example, the Defined Contribution Institutional Investment Association’s Retirement Research Center did a short survey in October of 69 employers and found that 13% said, “Yes,” they had experienced a data breach with their service provider/employee data. The topic will be one of ongoing importance in today’s rapidly evolving tech and litigation environment.

DOL Cybersecurity Guidance

The DOL’s 2021 guidance on cybersecurity is not binding, but it is likely to come up in any cybersecurity discussion. As described by the DOL, the guidance comes in three forms:

  • Tips for Hiring a Service Provider: Helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as the Employee Retirement Income Security Act requires;
  • Cybersecurity Program Best Practices: Assists plan fiduciaries and recordkeepers in their responsibilities to manage cybersecurity risks; and
  • Online Security Tips: Offers plan participants and beneficiaries who check their retirement accounts online basic rules to reduce the risk of fraud and loss.

 

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

Plan fiduciaries should document their process in considering the guidance and why the guidance was or was not followed. They should discuss who is responsible if there is a “blameless breach” and ensure all parties are aware. They should clarify the roles of the service provider, the participant, the consultant/adviser, law firm and other stakeholders and document those roles.

‘During vendor negotiations, it is useful to fully understand the vendor’s history and protocols. Ask if (or when) the vendor has paid out cybersecurity claims. Clearly define “data breach” and notification standards on your plan’s behalf. What are the remediation steps? What remedies are provided to participants? Also, ask about the role and oversight of subcontractors. Finally, it may be worth exploring specialized insurance coverage for cybersecurity liability. Applicants for this coverage will need to demonstrate awareness and implementation of cybersecurity best practices. Unfortunately, coverage may be difficult to obtain and/or expensive, given increasing volumes of cyber-attacks.

The DOL notes that the department’s guidance “complements [the Employee Benefits Security Administration]’s regulations on electronic records and disclosures to plan participants and beneficiaries. These include provisions on ensuring that electronic recordkeeping systems have reasonable controls, adequate records management practices are in place and that electronic disclosure systems include measures calculated to protect Personally Identifiable Information.”

Additional Plan Sponsor and Service Provider Resources

In an article on retirement plan cybersecurity, insurance brokerage and consulting firm Arthur J. Gallagher & Co. notes, “For HR leaders, making prevention the first imperative requires working with corporate IT to put safeguards in place. They should have clear sight into how data is collected, held and classified, who has access, and which laws apply. Investing in enterprise-wide technology is critical to recognizing cyberattacks and stopping them when they occur. … Phishing and other social engineering techniques have become very sophisticated and can easily fool unwary team members into divulging information that give thieves access to sensitive data. One of the best protections is thorough training for both HR staff and employees.”

The article also provides a detailed list of important cybersecurity-related best practices for plan sponsors to consider.

An article by the Groom Law Group notes the importance of informing plan participants about their role in protecting their own data, stating that “One great way for an ERISA fiduciary to educate participants about online security is to distribute the DOL’s Online Security Tips directly to participants. These tips teach participants how to reduce the risk of fraud and loss to retirement accounts. Some plan sponsors have already put these tips on their websites and have sent them to participants by mail. Others are even including them in summary plan descriptions (SPDs).”

The industry is already keenly aware of and responding to cybersecurity challenges. Research from Cerulli Associates revealed that recordkeepers are increasing their cybersecurity staff as it becomes a growing area of general interest, as well as plan sponsor scrutiny. The nonprofit Society of Professional Asset Managers and Recordkeepers has a robust array of cybersecurity and fraud resources on its website; in particular, plan sponsors may want to consult the Plan Sponsor and Advisor Guide to Cybersecurity.

The guide cites security breaches typically being some form of attack on or intrusion into a network, a lost unsecured laptop and/or data file loss (recordkeeper to third party). It also describes forms of cyber fraud like phishing; malware and account takeover; theft; or impersonation. SPARK recommends that service providers utilize 17 “control objectives” that are listed and described in the guide when reporting on their overall data security capabilities.

At a broader level, the Cybersecurity and Infrastructure Security Agency leads the U.S. effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. Of particular note, it offers resources for small and midsized businessesthese organizations may have special considerations, given potentially more limited resources to manage cyber risks than larger companies.

There are many resources available to plan sponsors to facilitate discussions about cybersecurity and awareness of best practices, as well as helping to inform and educate plan participants about the key role they play in protecting their information and retirement savings. Plan sponsors may want to consider creating a rolling calendar via which important topics like cybersecurity and participant data are regularly brought up for internal discussion among key stakeholders including HR, finance, legal, IT and communications.

Pam Hess is the vice president of research at the DCIIA Retirement Research Center.

 

«