In March, The Pensions Regulator (TPR), in collaboration with City of London Police, issued a warning urging the pensions industry to take immediate action to protect millions of people’s retirement savings after a rise in reports of impersonation fraud. TPR’s analysis warned that fraudsters are using people’s personal details to take over their pension accounts and steal their savings. Recently, the Pensions Ombudsman has also put out a warning about the risk of it being impersonated by criminals attempting to defraud members of the public.

These warnings are a timely reminder that pension scams do not go away but rather keep evolving. While sums lost to this type of fraud so far may currently appear modest compared with scams in the past, TPR’s focus signals a growing and more sophisticated threat.

Impersonation fraud relies on fraudsters obtaining personal data and using it to bypass security checks, change bank details and divert pension funds. Ultimately, it is trustees and administrators that are on the front line of defence for members.

For trustees and administrators, this is not simply a matter of awareness but one of governance and risk management, with TPR’s intervention effectively establishing a benchmark against which their actions may be assessed. Where trustees and administrators cannot demonstrate that they have taken appropriate and proportionate steps to mitigate fraud risk, the scope for scrutiny and potential member complaints is likely to increase.

As fraudsters refine their methods, so too must schemes refine their controls. This means moving beyond static processes and ensuring that administrative practices are capable of adapting to emerging threats. As outlined in TPR’s alert, trustees and administrators should carry out regular and documented reviews of identity verification procedures, such as encouraging members to adopt two-step verification and use stronger passwords, and ensure that data security measures for correspondence – particularly where documents are sent overseas – remain robust.

There is also a clear expectation that schemes engage actively with the wider anti-fraud framework. TPR has emphasised the importance of reporting suspicions promptly through the new Report Fraud service, recognising that intelligence shared by trustees and administrators is central to identifying patterns and disrupting criminal activity. In practice, this requires schemes to have clear internal escalation processes and to ensure that administrators are trained to identify and act on warning signs.

At the same time, trustees should be alert to the fact that risk is not uniform across their membership. TPR’s analysis highlights increased targeting of members based overseas, but the underlying vulnerabilities – weak credentials, compromised email accounts and gaps in verification processes – are common across all schemes. A targeted and proportionate approach to risk assessment will therefore be key.

However, even robust systems cannot eliminate the risk of scams entirely, and some fraudsters will inevitably succeed despite reasonable precautions. In those circumstances, the quality of a scheme’s processes will be judged not only by whether fraud occurred, but by whether those processes were actually adhered to, how well risks were managed, and how effectively the response is handled.

Regular system checks and updates serve a dual purpose, first and foremost reducing the likelihood of fraud occurring while also mitigating the administrative and legal consequences in the event that it does. Trustees and administrators should therefore treat TPR’s warning as an indication of regulatory expectation, and a prompt to reassess whether their existing safeguards remain fit for purpose.

Ben’s article was originally published in Pensions Expert, here.