NEWYou can now listen to Fox News articles!
An impostor phoned Alight Solutions, the recordkeeper for Colgate-Palmolive’s 401(k) plan, and identified herself as a Colgate employee. She asked to update the contact information on an account. Months later, the entire $751,430 balance had been sent in a single lump sum to a Las Vegas address and bank account. The real account holder, Paula Disberry, was living in South Africa.
Disberry sued Alight, Colgate’s benefits committee and BNY Mellon, the plan’s custodian, to recover the money. The case was later settled on undisclosed terms. The court never ruled on whether Alight had to restore the funds.
In February 2026, the Government Accountability Office told the U.S. Department of Labor to issue new guidance on retirement plan participant data. The GAO cited eleven separate lawsuits filed between 2009 and 2024 under the Employee Retirement Income Security Act, the federal law governing private retirement plans.
When account takeover hits a 401(k), the consumer protections that govern credit card fraud do not apply.
Sign up for my FREE CyberGuy Report
REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS
A stolen 401(k) shows how one phone call, exposed personal details and weak account-change safeguards can drain retirement savings. (Kurt “CyberGuy” Knutsson)
The Disberry case began when an impostor called Alight’s Benefits Information Center. She gave Disberry’s name, the last four digits of her Social Security number, her date of birth and the mailing address Alight had on file. That was enough to clear the call center’s security check.
She then asked Alight to update the contact information on Disberry’s account. Alight did not send an alert to Disberry’s existing email address or phone number, both of which it had on file. Instead, the company issued a temporary password through the mail.
Disberry’s plan had a 14-day waiting period between an address change and any distribution. Her lawsuit alleged that Alight skipped it. Within weeks, the impostor logged in, requested a full payout, and BNY Mellon mailed a check to a Las Vegas address.
Heide Bartnett, a former Abbott Laboratories employee, sued Alight over a $245,000 401(k) distribution. She alleged that a hacker used the plan portal’s “forgot password” feature to reset her credentials and trigger the payout. Other retirement plan recordkeepers have faced similar cybertheft lawsuits.
The problem extends beyond 401(k) accounts. The FBI’s April 2026 Internet Crime Report found that Americans 60 and older lost $7.7 billion to internet crime in 2025, a 59% jump from the year before. Investment fraud accounted for $3.5 billion of those losses, making retirement-age savers a major target for online criminals.
INSIDE A SCAMMER’S DAY AND HOW THEY TARGET YOU
Retirement account takeovers can start with leaked names, birth dates, partial Social Security numbers and reused passwords from past data breaches. (Kurt “CyberGuy” Knutsson)
Account takeovers begin with information someone already has. Names, dates of birth, partial SSNs and email addresses appear in dark web breach dumps, often combined with leaked passwords from unrelated services. When the account holder reuses a password across accounts, hackers can test that breach data directly against the recordkeeper’s login portal.
Disberry’s takeover bypassed the login portal entirely. The impostor never logged in to Disberry’s account directly. She called Alight’s call center, used what she already knew about Disberry to clear identity verification and had the contact information changed. After that, the temporary password Alight mailed went somewhere only the impostor could intercept.
Some thieves skip the recordkeeper and go straight for the account holder. The New York Times documented the case of Barry Heitin, a 76-year-old retired lawyer, who lost $740,000 in 2024 after receiving a call from someone claiming to be a federal fraud investigator. The caller convinced Heitin that his retirement accounts were under attack and walked him through transferring the money out himself. He believed he was helping a federal investigation.
Federal protections for retirement account theft are limited, but several account-level controls cost nothing and may make takeovers harder.
HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET
Multi-factor authentication, account-change alerts, credit freezes and regular statement reviews can help protect your 401(k) before thieves strike. (Kurt “CyberGuy” Knutsson)
Account-change alerts on the recordkeeper portal only work if the recordkeeper sends them. The Disberry case showed what can happen when those alerts go unsent.
A strong identity theft monitoring service can add another layer of protection by watching for suspicious activity beyond the retirement plan portal. Some services let you link bank, credit card and investment accounts so you can receive alerts when unfamiliar transactions appear. In a retirement account takeover, that could help flag suspicious money movement even if the recordkeeper misses the outgoing transfer.
Many identity theft monitoring services also watch for changes across your credit reports, scan the dark web for exposed personal information and search data broker or people-search sites for your details. Some plans also include fraud resolution support and identity theft insurance for eligible recovery costs.
If you are unsure whether criminals have already exposed your information, take action now. Start with a free identity breach scan to see whether your data appears in known leaks. Early detection gives you more control and helps you respond before fraud spreads. You can also check whether your personal information is already being used for identity theft, fraud or appearing on the dark web.
See my tips and best picks on Best Identity Theft Protection at CyberGuy.com
Retirement accounts can feel separate from the everyday fraud risks we hear about with credit cards, email accounts and bank logins. But this case shows how quickly a 401(k) can become a target when someone has enough personal information to fool a call center or reset account access. The scary part is that a stolen retirement account may not come with the same consumer protections people expect from credit card fraud. That makes prevention and early warning signs even more important. Turn on multi-factor authentication, enable every account alert your plan offers and ask your employer or plan administrator what happens after an address, phone number or bank account change. No one should have to find out months later that their life savings disappeared. The earlier you spot suspicious activity, the better your chances of stopping the damage before it becomes a financial nightmare.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Should retirement plans be required to send stronger alerts before any major account change or distribution, especially when someone’s life savings are on the line? Let us know by writing to us at CyberGuy.comCyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
Alex Murdaugh’s upcoming retrial faces significant challenges in finding an impartial jury, as discussed by criminal defense attorney Josh Ritter. Prosecutors warn that the case’s extensive public attention will complicate jury selection, potentially requiring a change of venue. Murdaugh’s original conviction was overturned due to jury interference, adding to the complexities of securing a fair trial.
NEWYou can now listen to Fox News articles!
The South Carolina Supreme Court wiped away Alex Murdaugh’s double-murder conviction on May 13, ruling unanimously that the trial was irredeemably tainted by the conduct of Colleton County Clerk of Court Rebecca “Becky” Hill.
Last week, the South Carolina Supreme Court delivered an account of how Hill’s conduct during the 2023 double-murder trial crossed ethical and constitutional lines, ultimately unraveling the state’s conviction of Murdaugh.
“Both the State and Murdaugh’s defense skillfully presented their cases to the jury as the trial court deftly presided over this complicated and high-profile matter,” the court wrote. “However, their efforts were in vain because Colleton County Clerk of Court Rebecca Hill placed her fingers on the scales of justice, thereby denying Murdaugh his right to a fair trial by an impartial jury.”
ALEX MURDAUGH: TIMELINE OF THE ONCE POWERFUL SOUTH CAROLINA LAWYER’S SPECTACULAR DOWNFALL
Rebecca Hill placed her fingers on the scales of justice, thereby denying Murdaugh his right to a fair trial by an impartial jury.
The South Carolina Supreme Court said Becky Hill allegedly engaged in “shocking jury interference” during the proceedings in which Alex Murdaugh was accused of murdering his wife and son. (Andrew J. Whitaker/The Post And Courier/AP)
The opinion described Hill’s actions as a “breathtaking and disgraceful effort” to interfere with the jury process, conduct the justices called “unprecedented in South Carolina.”
ALEX MURDAUGH’S DOUBLE MURDER CONVICTION UNANIMOUSLY OVERTURNED BY SOUTH CAROLINA SUPREME COURT
At the center of the case were repeated allegations that Hill improperly commented on Murdaugh’s testimony and credibility to jurors during the six-week murder trial.
Jurors testified Hill told them not to be “fooled” by Murdaugh’s defense and instructed them to “watch him closely,” “look at his actions,” and “look at his movements” while he testified.
One alternate juror recalled Hill warning jurors: “They’re going to say things that will try to confuse you. Don’t let them confuse you or convince you or throw you off.”
ALEX MURDAUGH ATTORNEY ARGUES STATE SUPREME COURT SHOULD OVERTURN GUILTY VERDICT
Clerk of Court Becky Hill speaks with law enforcement before Alex Murdaugh is found guilty on all counts for the murder of his wife and son at the Colleton County Courthouse on March 2, 2023. (Joshua Boucher/The State/Tribune News Service via Getty Images)
The Supreme Court said the comments went beyond casual conversation between staff and jury members, writing that she “essentially implored the jurors to find him guilty.”
“Hill became a character witness on behalf of the State, encouraging the jurors to question Murdaugh’s credibility” the opinion said.
The opinion also painted a portrait of a public official consumed by the attention surrounding the nationally televised trial.
FORMER SOUTH CAROLINA CLERK IN MURDAUGH MURDER TRIAL ARRESTED ON MULTIPLE FELONIES
Hill co-authored a book about the proceedings, “Behind the Doors of Justice: The Murdaugh Murders,” while also granting favors to media members and cultivating celebrity around the case, according to testimony cited by the court.
According to the book’s synopsis, Hill had known the Murdaugh family for decades and was aware of “the rumors of corruption and crime surrounding the Murdaugh family.”
“These accusations came and went, nothing sticking long enough to bring clarity or a clear conviction. Becky had also known of good deeds done by the Murdaughs,” the synopsis stated. “She was there when Randolph Murdaugh received the Order of the Palmetto, the highest honor bestowed on a civilian by the Governor of South Carolina.”
MURDAUGH COURT CLERK BECKY HILL RELEASED ON BOND AFTER ARREST ON PERJURY, MISCONDUCT CHARGES
A fellow court official testified Hill said she hoped the book would earn enough money to buy a lake house and believed a guilty verdict would improve sales.
The justices concluded Hill “was attracted by the siren call of celebrity” and “allowed her desire for the public attention of the moment to overcome her duty to her oath of office.”
Colleton County Court Clerk Becky Hill crosses the street in Walterboro, S.C., on Sept. 7, 2023. Hill is involved in a motion for a retrial in the Alex Murdaugh double-murder case. (Larry Paci/Fox News Digital)
Although Hill denied many of the allegations during a 2024 evidentiary hearing, the Supreme Court wrote that “Hill’s denial of making any inappropriate comments lacked credibility.”
ALEX MURDAUGH TRIAL: EXPERTS WEIGH IN ON POSSIBILITY OF AN OVERTURNED MURDER CONVICTION
The opinion also referenced Hill’s later guilty plea to perjury related to her denial that she allowed members of the media to view sealed exhibits.
The unraveling began publicly in October 2023 when Murdaugh’s attorneys filed a motion for a new trial accusing Hill of jury tampering.
WATCH: Becky Hill walks into Colleton County Courthouse
FOLLOW THE FOX TRUE CRIME TEAM ON X
By January 2024, jurors were testifying under oath about Hill’s comments and behavior.
The Supreme Court ultimately ruled that Hill’s actions triggered the legal presumption that the jury had been improperly influenced and that prosecutors failed to prove the verdict was unaffected.
SIGN UP TO GET TRUE CRIME NEWSLETTER
“As noted at the outset,” the justices wrote, “Hill’s shocking jury interference” forced the court to reverse the conviction and order a new trial.
Prior to Wednesday’s ruling, Hill had previously pleaded guilty to four charges — obstruction of justice and perjury for showing a reporter photographs that were sealed court exhibits and then lying about it, plus two counts of misconduct in office for taking bonuses and promoting a book she wrote on the trial through her public office.
“There is no excuse for the mistakes I made. I’m ashamed of them and will carry that shame the rest of my life,” Hill said in a statement read to the court.
She was sentenced to three years of probation.
LISTEN TO THE NEW ‘CRIME & JUSTICE WITH DONNA ROTUNNO’ PODCAST
WATCH: Hill reads Murdaugh’s 2023 guilty verdict
At the conclusion of Murdaugh’s 2023 trial, Hill notably read the guilty verdict.
LIKE WHAT YOU’RE READING? FIND MORE ON THE TRUE CRIME HUB
Despite the legal win Wednesday, Murdaugh will not be walking free. He remains behind bars serving lengthy sentences for a string of financial crimes that cemented his fall from power.
For his financial crimes, Murdaugh was sentenced in state court to 27 years in prison after pleading guilty to 22 counts including money laundering and breach of trust. In federal court, he received a 40-year sentence for conspiracy to commit wire fraud and bank fraud, which he is serving concurrently with his state time.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Though his murder convictions and subsequent life sentences were overturned by the South Carolina Supreme Court on Wednesday, he remains in prison to serve the financial sentences.
Fox News Digital has reached out to Hill, her attorneys and Colleton County for comment.
NEWYou can now listen to Fox News articles!
The FBI announced on Thursday that it is offering $200,000 for information that leads to the arrest and prosecution of a former active-duty U.S. Air Force intelligence specialist and special agent for the Air Force Office of Special Investigations who is accused of espionage.
Monica Witt, 47, also known to use the aliases Fatemah Zarah and Narges Witt, was federally indicted in Washington, D.C. in 2018 and charged with espionage. She is accused of defecting to Iran and turning over classified information to the Iranian Revolutionary Guard Corps (IRGC).
Here’s what we know about Witt’s alleged descent from American warfighter to suspected Iranian asset.
FBI OFFERS $200K REWARD FOR FORMER AIR FORCE INTELLIGENCE AGENT ACCUSED OF SPYING FOR IRAN
Split of Monica Witt, who is wanted by the FBI for sharing sensitive information with Iran. (FBI)
Witt was born in El Paso, Texas, and enlisted in the Air Force in 1997, shortly after her 18th birthday. According to the New York Times, she was assigned to an RC-135 reconnaissance airplane crew.
Her 2018 indictment says she was assigned to the U.S. Defense Language Institute in Monterey, California, between 1998 and 1999, where she learned Persian Farsi.
From May 1999 to November 2003, Witt was deployed to “several overseas locations in order to conduct classified missions collecting signals intelligence.”
In 2002, she reportedly deployed to Saudi Arabia.
EX-AIR FORCE PILOT ARRESTED FOR ALLEGEDLY TRAINING CHINESE MILITARY PILOTS WITHOUT AUTHORIZATION
The indictment says Witt was assigned as an Air Force Office of Special Investigations (AFOSI) special agent criminal investigator and counterintelligence officer, where she deployed elsewhere in the Middle East, including Iraq in 2005 and Qatar in 2006.
Monica Witt is believed to be living in Iran, according to FBI officials. (FBI)
She was part of a “Special Access Program” (SAP) that gave her access to classified information, including “details of ongoing counterintelligence operations, true names of sources, and the identities of U.S. agents involved in the recruitment of those sources.”
“This SAP was known within the USIC by a code name,” the indictment says. “The code name allowed agents to communicate in the open without disclosing the true nature of their operations.”
GOVERNMENT EMPLOYEE HELD AFTER ATTEMPT TO SHARE CLASSIFIED INFORMATION WITH FOREIGN COUNTRY
Witt’s time as a member of the Air Force came to an end in 2008.
From 2008 until 2010, Witt was employed as a government contractor but worked with AFOSI.
The New York Times reported that Witt received a bachelor’s degree from the University of Maryland in 2008, just about the same time she left the Air Force. Thereafter, she enrolled in a graduate program at George Washington University in Middle East studies.
Witt was described as “withdrawn” and “alienated” by classmates, who also mentioned “drone strikes, extrajudicial killings and atrocities against children.”
It was in February 2012, just before she graduated from George Washington University, that the government says Witt set her plans to betray the United States and defect to Iran in motion.
A bridge damaged by U.S. airstrikes is seen in Karaj, west of Tehran, Iran, on April 3, 2026. (Vahid Salemi/AP Photo)
She traveled to Iran that month to attend the International Conference on Hollywoodism in Tehran, an anti-western event held during the Fajr International Film Festival each year “aimed at condemning American moral standards and promoting anti-U.S. propaganda,” according to the indictment.
FORMER FBI AGENT ROBERT LEVINSON’S DISAPPEARANCE STILL UNSOLVED AS BUREAU PRESSES FOR NEW TIPS
During that trip, she is accused of providing her “bona fides” to the IRGC in order to establish that she was a credible source of American national defense intelligence and that she disclosed government secrets to them.
She was not invited to the Hollywoodism, but was allowed to speak anyway, according to The New York Times. The indictment says she “was identified as a U.S. veteran and made statements that were critical of the U.S. government, knowing these videos would be broadcast by Iranian media outlets.”
At the same time, her public conversion to Islam was filmed and broadcast on Iranian state television.
CIA URGES IRANIANS TO USE BURNER PHONES, TOR TO CONTACT US IN PERSIAN-LANGUAGE VIDEO
In May, at about the same time she received her graduate degree, the FBI reached out to Witt, telling her she was a prime target for recruitment by Iranian intelligence officials.
An Iranian flag is planted in the rubble of a police station, damaged in airstrikes on March 3, 2026 in Tehran, Iran. (Majid Saeedi/Getty Images)
By then, it was too late.
Witt had become ensnared by a “spotter” — someone who recruits on behalf of a foreign intelligence service — in this case, Iran.
IRANIAN-AMERICAN JOURNALIST TESTIFIES AGAINST MEN ACCUSED OF MURDER-FOR-HIRE PLOT
The indictment refers to the “spotter” as “Individual A,” named by The New York Times as Louisiana-born journalist turned naturalized Iranian citizen and state television broadcaster Marzieh Hashemi.
Hashemi allegedly traveled to the U.S., and along with Witt, filmed an anti-Western propaganda film that was later distributed in Iran.
Over the course of the next year, according to the indictment, Witt bounced around from country to country while she worked with Hashemi to gain permanent residence in Iran. Some of that time was spent in Dubai and Afghanistan.
Around that time, the FBI put out a missing persons declaration for Witt, saying that as of July 2013, she was believed to be in either Afghanistan or Tajikistan teaching English.
Iranians set fire to United States and Israel flags during a gathering at Enghelab Square in Tehran on March 17, 2026, to commemorate those killed from the Dena naval vessel sinking. (Getty Images)
Text messages between the pair chronicled their efforts, including Iranian suspicion of Witt and alleged plans to “slip into Russia quietly” and expose U.S. secrets via WikiLeaks if she couldn’t gain access to Iran. Witt explicitly said in one message that she would not go to Turkey for fear of the country’s extradition agreement with the United States.
But on Aug. 25, 2013, according to the indictment, Witt sent an email titled “My Bio and Job History” to Hashemi, which contained more “bona fides,” her Certificate of Release or Discharge From Active Duty DD-214 form, and her Islamic “conversion narrative.” The indictment alleges that around the same time, she searched on Facebook for the names of U.S. intelligence services assets.
IRAN HACKERS TAUNTED ‘MR. MUSTACHE’ JOHN BOLTON ABOUT STOLEN FILES THAT WERE ALLEGEDLY CLASSIFIED
The same day, that email was forwarded to an email address associated with the Iranian government.
On Aug. 28, 2013, she boarded a flight to Iran.
“I’m signing off and heading out! Coming home,” she texted Hashemi.
Motorists ride past the Imam Sadiq (AS) mosque with a giant Iranian flag installed on its front at the Palestine Square in Tehran on April 19, 2026. (ATTA KENARE / AFP via Getty Images)
Immediately after defecting, Witt was accused of providing Iranian government officials with the code name for a Department of Defense SAP.
Throughout 2014 and 2015, she is accused of helping create “target packages,” defined as, “a document, or set of documents, assembled to enable an intelligence or military unit to find, fix, track, and neutralize a threat,” for the Iranian government.
Those “target patches” have allegedly included the names of U.S. counterintelligence agents.
FEDERAL JUDGE GIVES MAN 15 YEARS FOR IRAN-BACKED ASSASSINATION PLOT ON US SOIL
Later, she is accused of linking up with Iranian hackers and producing malware “designed to capture a target’s keystrokes, access a computer’s web camera, and monitor other computer activity.”
This technology was turned against U.S. intelligence assets whom Witt identified, according to the indictment. Witt and her co-defendants concocted schemes to implant malware on the computers of U.S. military intelligence workers known to Witt, mostly by reaching out to them through Facebook.
Mourners wave Iranian flags and hold a poster of Ayatollah Mojtaba Khamenei during a funeral procession in Tehran, Iran, on March 11, 2026. (Vahid Salemi/AP)
She was indicted alongside four other co-conspirators accused in the hacking operation.
Witt is officially charged with conspiracy to deliver and delivering national defense information to representatives of the Iranian government, delivering national defense information to representatives of the Iranian government, conspiracy to commit computer intrusion, computer intrusion, aggravated identity theft and aiding and abetting.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
“Monica Witt allegedly betrayed her oath to the Constitution more than a decade ago by defecting to Iran and providing the Iranian regime National Defense Information and likely continues to support their nefarious activities,” Daniel Wierzbicki, special agent in charge of the FBI Washington Field Office’s Counterintelligence and Cyber Division, said in Thursday’s announcement about the $200,000 reward.
“The FBI has not forgotten and believes that during this critical moment in Iran’s history, there is someone who knows something about her whereabouts. The FBI wants to hear from you so you can help us apprehend Witt and bring her to justice.”