We are the recordkeeper and we pre-fill in most of our paperwork but have an area for changes. With that being said, the address that we have is the one supplied by the employer or the payroll company. If a participant sends back an address change, their distribution is frozen for 18 days, which allows us time to send a notice out to the old address and to the new address and for them to respond to us if they did not authorize the address change. (The participant is informed on the paperwork that they should contact their employer to update their address, which would remove the freeze when the employer verifies the new address with us.) We also have procedures in place for when a person is requesting a cash distribution of more than $10,000. If it is an in-service, we call the particpant at their place of employment and verify. For a terminee, we start with a phone number provided by the employer and then dig deeper if we need to.
We also don't permit distribution requests online. They must be done via a request form (loans, in-service, hardship, etc.) or initiated by the employer (terminations).
As one of my IT guys says, "The more secure you want the system, the more inconvenient it is going to be."