What Should You Do After Money Is Stolen From a Retirement Account?
You sign in to an IRA or workplace retirement account and find a withdrawal you did not make. The money may already have left the institution. Your first impulse may be to calculate the loss, call family, or move every other investment.
The better response has two speeds. Account protection and reporting begin immediately. Major retirement-plan changes usually wait until you know what happened, what may be recovered, and what spending the missing money was meant to support.
What should happen during the first call?
Contact the custodian, recordkeeper, or plan administrator through a phone number or website you already trust—not a link in a message about the incident. Ask for the fraud or security team. Identify the transactions you dispute and ask what can still be stopped, recalled, restricted, or reviewed. FINRA says unfamiliar money movements, missing assets, and unauthorized changes to contact information can signal an account takeover.[1]
Ask whether online access should be locked, credentials reset, transfer instructions canceled, or a replacement account opened. Secure the email account and phone number used for authentication as well. A retirement-account password change will not solve the problem if the thief still controls the recovery channel.
What belongs in the written record?
Write down when you discovered the loss, each disputed transaction, the destination if visible, prior alerts or profile changes, every person contacted, and every case number. Save statements, notices, emails, and screenshots without clicking unfamiliar links. FINRA advises investors who lost money or saw an unauthorized trade to complain to the firm in writing and retain the correspondence.[2]
If identity information was used, IdentityTheft.gov can create a recovery plan and an identity-theft report.[3] You can also report cyber-enabled theft through the FBI’s Internet Crime Complaint Center, which asks victims to retain supporting evidence.[4] Ask the institution whether it also needs a police report, affidavit, or its own claim form. These reports create evidence and route information; they do not guarantee repayment.
The response moves on two clocks
NOW · PROTECT
Stop additional movement and secure the access channels.
TODAY · ESTABLISH
Create the claim record while details and evidence are available.
NEXT · BOUND
Separate confirmed loss, possible recovery, and still-unknown exposure.
THEN · ADAPT
Change the retirement plan only as far as the known loss requires.
Protection cannot wait for certainty. Long-term decisions should not pretend certainty already exists.
Why is recovery uncertain?
Recovery depends on the account, institution, transaction path, facts, and governing agreement. Some firms publish protection guarantees, but their terms and customer responsibilities matter. Fidelity, for example, describes coverage for qualifying losses from unauthorized activity occurring through no fault of the customer.[5] Schwab also publishes a security guarantee with customer responsibilities.[6] Those examples should prompt you to obtain the terms for your own account—not assume every loss is covered.
Keep three amounts separate: money confirmed missing, money the institution is investigating, and money already restored. Do not count a possible recovery as available cash. Also be cautious if someone promises to recover the money for an upfront payment; fraud victims are frequently targeted again through recovery scams.[7]
Dovetail Principle: When Life Changes, the Plan Can Change Without Starting Over
A theft creates pressure to make the account whole quickly. The steadier priority is to protect essential spending and preserve future choices while recovery remains uncertain. Replacing the dollars comes after deciding what those dollars were meant to support.
When does the theft become a retirement-plan decision?
It becomes a planning decision when the missing amount changes a job the money was assigned to perform. Was it supporting next month’s income, a multi-year reserve, future care, or long-term growth? A loss from near-term reserves may require an immediate spending bridge. The same dollar loss from long-term assets may allow more time before the household changes course.
First protect essential bills and known tax payments. Then decide whether to pause a discretionary purchase, redirect cash flow, use another reserve, or adjust a scheduled portfolio withdrawal. Avoid taking more investment risk simply to recover faster. The question is not, “How do we win it back?” It is, “Which commitments are affected, and what is the least disruptive way to support them now?”
What should be reviewed after the facts settle?
Ask the institution what tax reporting it expects to issue and whether it will issue any correction. An unauthorized retirement-account distribution can create a Form 1099-R question even when the account owner did not benefit from the money. The IRS directs a taxpayer who receives an incorrect Form 1099-R to first seek a corrected form from the payer before using Form 4852 as a substitute.[8] Coordinate the institution’s records with a tax professional before filing or amending a return.
Once the recovered and unrecovered amounts are clearer, update the retirement-income plan, reserve target, investment allocation, and any spending that depended on the stolen assets. Record what remains under investigation and the date it will be reviewed again. The plan does not need to wait passively, and it does not need to be rebuilt around the worst case on day one. It needs a protected near term, an honest loss range, and deliberate adjustments as uncertainty becomes fact.
Related Reading: How Do You Protect Retirement Accounts From Account Takeover? explains the preventive layers to review after the immediate incident is contained.
