Protect Your Retirement Accounts

Everything needed to run a small-group roundtable on the login and the payment path for a 401(k), Roth, IRA, crypto wallet, or other investment account. Includes a facilitator plan, agenda, seven habits, a four-stage tabletop, and a one-page handout. This is not investment, tax, or legal advice.

90 min | 6–10 people | Account holders, Benefits leads, Advisors

One-page handout (Letter, PDF)Facilitator plan (PDF)Desk card (PDF)

The desk card is the homework. Print it and keep it where you work.

Join to save this for later.

Join to tell us if this was useful.

72,984investment fraud complaints reported to the FBI in 2025
$8.65Breported lost to investment fraud in 2025
$7.2Bof that reported lost to cryptocurrency investment fraud in 2025
$359.7Mreported lost to about 4,700 account-takeover complaints in 2025

As of 2025. Source: FBI Internet Crime Complaint Center (IC3) 2025 Annual Report

The habits below are summarized from Gerri Walsh, President of the FINRA Foundation, BetterInvesting, December 31, 2023. This session is not investment, tax, or legal advice. 7 Tips for Securing Your Financial Accounts

Outcomes

Open the firm's site or app yourself, and do not tap the link in the message.
Use a different password for each account, and turn on a second factor.
Read the statement, and call the firm at the number on the statement if money or contact details changed.
Name one habit to start before the next payday.

Agenda

Time	Block	What happens
0:00–0:10	Welcome and hook	Read the four IC3 figures. Name the accounts in the room. Agree the hour is about the login and the payment path. This is not investment, tax, or legal advice.
0:10–0:25	Story round	One close call each: a text from the plan, a new login alert, a rollover pitch, or someone who asked for a seed phrase. No account numbers.
0:25–0:50	The seven habits	About three to four minutes each. A seed phrase is never typed into a website, a chat, or a support form. That line is not one of the seven habits.
0:50–1:10	Tabletop scenario	Groups of 3 or 4 work through The Monday rollover, one stage at a time, then report back.
1:10–1:20	Gap check	Yes or not yet on the seven habits, plus the seed phrase stored offline.
1:20–1:30	Commitments and close	Hand out the desk card. Each person names one habit they will start before the next payday and takes the card with them.

Discussion topics

Do not tap the link

A text or email can look like the firm. The link is how the login is taken.

If the message says the 401(k) is locked, where do you open the account?

A different password for each account

One stolen password opens every account that reused it. A password manager can hold them. Do not share them.

Which account still uses a password you also use somewhere else?

A second factor

A code or a fingerprint sits on top of the password.

Which one account can get a second factor before the next payday?

Security updates

The update closes a door the firm already knows about.

What do you do when the phone or the computer asks to install an update?

Your own device

A public computer can keep the login. If you had to use one, clear the history after you log out.

Where would you refuse to sign in to the account?

A network you trust

Cafe and airport Wi-Fi are a poor place to open the account. At home, the router needs its own strong password.

Would you open the account on airport Wi-Fi?

Read the statement

Money that moved, or an address, email, or phone you did not change, is the sign. A missing statement is a sign too.

Which number do you call: the one on the statement, or the one in the message?

The Monday rollover

Give each group one stage at a time, about 5 minutes apart. Groups answer each stage's question before seeing the next.

Monday, 8 a.m.
A text says the 401(k) is locked and a link will open it.
Do you tap the link?
Monday, 9 a.m.
A messaging-app contact offers a better IRA and sends new bank instructions.
Which number do you call?
Monday, 11 a.m.
The real custodian site shows a bank and a beneficiary the person did not change.
Who is called first?
Monday, 2 p.m.
A helper offers to recover crypto that was already sent, for a fee paid in crypto.
Does anyone send more?

Reveal debrief

The account is opened from the firm's own app or from an address you already know. The link in the text is not that path.
A new bank account is confirmed with the number on the statement. The number in the message is not that call.
A bank or a beneficiary you did not change is a call to the firm, at the number on the statement, before anything else.
No one sends more crypto to get the first crypto back. A seed phrase is never typed into a website, a chat, or a support form.

Handout

Habits

Do not tap the link. Open the firm's site or app yourself.
Use a different password for each account. A password manager can hold them. Do not share them.
Turn on a second factor, such as a code or a fingerprint, on top of the password.
Install security updates when they arrive.
Use your own device. Skip a public computer. If you had to use one, clear the history after you log out.
Wait for a network you trust. Skip cafe and airport Wi-Fi for the account. At home, put a strong password on the router.
Read the statement when it arrives. Call the firm if money moved, or if the address, email, or phone changed, and you did not do it. A missing statement is a sign too.

Red flags

A text or email with a link that says the account is locked
New bank instructions from a messaging app
A bank or a beneficiary on the statement you did not change
A missing statement
Someone who asks you to type a seed phrase into a website, a chat, or a form
A helper who asks for more crypto to recover crypto that was already sent

First hour

Firm. Call the firm at the number on the statement, and tell your other firms.
Passwords. Change the password on that account and on any account that used the same one.
Report. File at ic3.gov. Identity theft help is IdentityTheft.gov. Investment-account concerns go to FINRA, the SEC, and your state regulator.
Watch. You can place a fraud alert with the credit bureaus.

Facilitator checklist

2 weeks before

Confirm the date, the room, and who is coming
Print the four IC3 figures and the link to the BetterInvesting article
Send the invite with the ask to bring one close call, and no account numbers

Day of

Print the desk card, one for each person, plus the scenario cards (one stage per card) and sticky notes
Set up a flip chart with three columns: Login, Rollover, Payment
Assign a note-taker

Within 1 week after

Send a thank-you with the desk card and the top 3 gaps raised
Give the host an action list: gap, suggested fix, owner
Log who came and which accounts were named, without account numbers
Schedule the quarterly refresher

ISO 27001:2022

A.5.17 Authentication information
A.8.5 Secure authentication
A.5.14 Information transfer
A.5.34 Privacy and protection of PII
A.6.3 Information security awareness, education and training
A.6.8 Information security event reporting

Want us to run this session for your team?

isms@itrygg.com

Case study examples from nearby

Green Bay Police said on August 30, 2023, that $195,200 had been reported stolen in cryptocurrency scams that year, and $273,893 across 28 cases since 2020. One report was a Green Bay man who lost $37,700 putting cash into a Bitcoin ATM while someone stayed on the phone. WBAY, August 30, 2023.

The Brown County Sheriff's Office has investigated more than $4.6 million lost to cryptocurrency scams since the start of 2024. The same briefing said Wisconsin cryptocurrency ATM scams rose 99% in a year. Green Bay Press-Gazette, October 16, 2025.

A Wisconsin consumer was shown what looked like an AI trading platform, made a small withdrawal, then moved more than $100,000 from a 401(k) and lost it. The Better Business Bureau of Wisconsin said the largest AI-related loss in reports from January 1 through July 31, 2026, was $118,000. WisBusiness, Better Business Bureau of Wisconsin.