Prefilling forms w. names and addresses

[austin3515]

We have the ability to pre-fill Fund Company distribution forms with names and addresses before sending to terminated participants using an in-house software program.  We would NOT enter DOB's or SS#'s.  Just names and addresses.

What are others doing?  We had been including Names/addresses at one point in time but decided to stop because we felt like once that information was on the form, it was that much closer to being susceptible to theft.  Do others have any insight regarding security audits, etc., that have done studies/analysis on this stuff?  I'm sure others are putting a lot of thought into this.

Part of the discussion of course is that we are mailing them the form, so the envelope and cover-letter does already have their name and address.

[C. B. Zeller]

I would say name yes, address no. Security issues aside - what if they moved?

[austin3515]

Well if they moved, the package we are sending would most likely not reach them anyway.

[MTWeeks]

This just came up with us when a criminal tried to hijack a participant's account (unsuccessfully). We made a determination, just from an abundance of caution, that we will not prefill anything going forward. That's my 2 cents.

[austin3515]

Reminds of my experience with asking clients if they want us to e-file the 5500's for them, even though their signature will be on-line.  100% of those whose identities have been stolen say "absolutely not."

[Pam Shoup]

We are the recordkeeper and we pre-fill in most of our paperwork but have an area for changes.  With that being said, the address that we have is the one supplied by the employer or the payroll company.  If a participant sends back an address change, their distribution is frozen for 18 days, which allows us time to send a notice out to the old address and to the new address and for them to respond to us if they did not authorize the address change.  (The participant is informed on the paperwork that they should contact their employer to update their address, which would remove the freeze when the employer verifies the new address with us.)  We also have procedures in place for when a person is requesting a cash distribution of more than $10,000.  If it is an in-service, we call the particpant at their place of employment and verify.  For a terminee, we start with a phone number provided by the employer and then dig deeper if we need to.

We also don't permit distribution requests online.  They must be done via a request form (loans, in-service, hardship, etc.) or initiated by the employer (terminations).

As one of my IT guys says, "The more secure you want the system, the more inconvenient it is going to be."

[Kphelps]

We used to pre-fill but have a lot of discussion recently about fraud.  So, now we send a blank form (with plan name of course).  We also ask that they return the form to the employer.  That way the employer may be able to verify that they received it from the participant (they would be more familiar with them than we would obviously).