Industry alert: impersonation fraud

Published: September 2025

Summary

This alert is aimed at pension scheme trustees and administrators. It highlights a pension fraud technique identified from Action Fraud reports, involving unauthorised access to pension scheme members’ accounts using hacking and impersonation techniques. You are urged to be vigilant and report any suspicions. 

Findings

An analyst from The Pensions Regulator (TPR), seconded to the National Fraud Intelligence Bureau (NFIB), part of City of London Police, analysed Action Fraud reports received between October 2024 and March 2025. The analysis identified a common theme, with almost a third of reports referencing attempts to bypass pension scheme defences and exploit security vulnerabilities to gain unauthorised access to members’ accounts.

Methods include:

• Hacking members’ email accounts - obtaining access to correspondence between the member and the pension scheme. Once sufficient personal information about the member has been obtained, contact is initiated with the scheme and impersonation of the member takes place to change details of beneficiary bank account, with the aim of withdrawing pension funds.
• Accessing members’ account information - to set up fake pension accounts in the member’s name. Funds are then moved from the real account to the fake account without challenge.
• Account access via poorly secured or unsecured account credentials - in these instances the member and individual committing the act were known to each other.
• Deceased members’ pension funds - have been diverted to an alternative bank account without the next of kin’s knowledge. 

Recommendations

Educate members:

• On the importance of online security and ensuring their pension account details are up to date. Encourage your members to strengthen their online security by asking them to turn on two-step verification now.
• The analysis found that members between the ages of 50 and 69 are at the greatest risk of these impersonation techniques, with 55% of the reported victims in this age range. Schemes should signpost their members to City of London Police Identity fraud guidance.
• Signpost members to the Stop! Think Fraud website for further information on fraud.  

Review scheme systems and controls:

• Review measures you have in place to adequately prevent identity fraud such as member identity and verification checks.
• For additional information, read The Pension and Administration Standards Association Protecting Identities During High Risk Events (PDF, 612KB, 21 pages) guidance. 

Report fraud or cybercrime to Action Fraud:

• Using the online reporting tool to submit an information report, or a crime report at any time of the day or night - reports that are made online get treated with the same urgency as those made over the phone.
• By calling 0300 123 2040 Monday to Friday between 8am to 8pm. If reporting by phone you will also be given the options to register or be a guest.

This threat was identified as a result of analysis of Action Fraud reports, with 67% of the impersonation fraud reports made by the pension saver or a relative.

You play a critical role in the fight against pension scams – and reporting is our best defence. As frontline professionals, it is vital you report pension scam suspicions to Action Fraud. Each report enables relevant authorities to analyse trends, disrupt criminal networks and implement effective prevention measures. Every report counts, adding an important piece to the intelligence puzzle.