A new warning from the Pensions Regulator has highlighted the increasing sophistication of fraudsters targeting pensions. Arc Pensions Law’s Ben Fairhead examines what this means for trustees.
In March, the Pensions Regulator (TPR), in collaboration with City of London Police, issued a warning urging the pensions industry to take immediate action to protect millions of people’s retirement savings after a rise in reports of impersonation fraud.
TPR’s analysis warned that fraudsters are using people’s personal details to take over their pension accounts and steal their savings. More recently, the Pensions Ombudsman has also issued a warning about the risk of impersonation by criminals attempting to defraud members of the public.
These warnings are a timely reminder that pension scams do not go away but rather keep evolving. While sums lost to this type of fraud so far may currently appear modest compared with scams in the past, TPR’s focus signals a growing and more sophisticated threat.
Impersonation fraud relies on fraudsters obtaining personal data and using it to bypass security checks, change bank details and divert pension funds.
Ultimately, it is trustees and administrators who are on the front line of defence for members.
For trustees and administrators, this is not simply a matter of awareness but one of governance and risk management, with TPR’s intervention effectively establishing a benchmark against which their actions may be assessed. Where trustees and administrators cannot demonstrate that they have taken appropriate and proportionate steps to mitigate fraud risk, the scope for scrutiny and potential member complaints is likely to increase.
As fraudsters refine their methods, so too must schemes refine their controls. This means moving beyond static processes and ensuring that administrative practices are capable of adapting to emerging threats.
What TPR expects from trustees
As outlined in TPR’s alert, trustees and administrators should carry out regular and documented reviews of identity verification procedures, such as encouraging members to adopt two-step verification and use stronger passwords, and ensure that data security measures for correspondence – particularly where documents are sent overseas – remain robust.
There is also a clear expectation that schemes engage actively with the wider anti-fraud framework. TPR has emphasised the importance of reporting suspicions promptly through the new Report Fraud service, recognising that intelligence shared by trustees and administrators is central to identifying patterns and disrupting criminal activity.
In practice, this requires schemes to have clear internal escalation processes and to ensure that administrators are trained to identify and act on warning signs.
At the same time, trustees should be alert to the fact that risk is not uniform across their membership. TPR’s analysis highlights increased targeting of members based overseas, but the underlying vulnerabilities – weak credentials, compromised email accounts and gaps in verification processes – are common across all schemes. A targeted and proportionate approach to risk assessment will therefore be key.
However, even robust systems cannot eliminate the risk of scams entirely, and some fraudsters will inevitably succeed despite reasonable precautions. In those circumstances, the quality of a scheme’s processes will be judged not only by whether fraud occurred, but by whether those processes were actually adhered to, how well risks were managed, and how effectively the response is handled.
Regular system checks and updates serve a dual purpose: first and foremost, reducing the likelihood of fraud occurring, while also mitigating the administrative and legal consequences in the event that it does.
Trustees and administrators should therefore treat TPR’s warning as an indication of regulatory expectation, and a prompt to reassess whether their existing safeguards remain fit for purpose.
Ben Fairhead is a partner at Arc Pensions Law.
