It takes decades to build a pension, but only a single instruction to lose it. According to identity verification firm Identomat, the threat to retirement savings is evolving: fraudsters are no longer just talking savers into bad decisions, they are increasingly bypassing savers altogether by pretending to be them.
That shift matters for the entire pensions industry. Identomat argues that pension fraud exploits two distinct weaknesses, trust and access, and that each demands a different defence. Providers that treat every scam as a persuasion problem risk leaving the door open to impersonation, and vice versa.
The traditional approach has not gone away. Pensions are complex, and transfers involve unfamiliar decisions about providers, investments, access rules and tax. That complexity gives a convincing stranger room to manoeuvre.
The FCA lists unsolicited pension reviews, guaranteed returns and unusual investments among the most common tactics, with a supposed review frequently serving as a route to persuading savers to move their money.
Clone firm scams are more sophisticated still. Criminals borrow the name and regulatory reference number of a genuine authorised business, replace its contact details with their own and sometimes even claim the regulator’s records are out of date.
Meanwhile, offers to unlock pensions early, dressed up as a “loan” or a “loophole”, prey on those facing mounting bills.
Identomat’s advice to savers is that the real test is not whether an offer sounds appealing, but whether they can independently confirm who is behind it, what that party is authorised to do and where the money will end up.
The more troubling trend involves cutting the saver out entirely. The Pensions Regulator has documented criminals breaking into members’ email accounts, collecting personal details and impersonating them to redirect funds, in some cases opening fake pension accounts in their names. Access to genuine correspondence makes these impersonations far more convincing.
Danger also persists once money leaves the pension. Fraudsters posing as bank fraud teams pressure victims to move funds into a “safe account”, a tactic MoneyHelper warns no bank, police force or regulator would ever use. Here, Identomat notes, the genuine account holder approves the payment. The fraud lies entirely in the story that persuaded them.
Identomat recommends checking firms through the FCA Firm Checker, contacting them only through independently sourced details, demanding written explanations of charges and risks, and treating pressure to sign as a reason to walk away. Two-step verification on email and pension accounts adds a further barrier. Anyone who suspects a scam should alert their provider and bank immediately, keep all evidence and report it through the appropriate reporting channel, such as Action Fraud or Police Scotland, depending on their location. Victims should also beware fee-charging recovery services, which MoneyHelper says often target people who have already lost money.
For providers, Identomat breaks the problem into three questions. Is the requester the genuine member? Is the destination legitimate? Is the member acting freely and on accurate information? Crucially, no single check answers all three. A passed identity check cannot prove a member is free from coercion, and a recognised firm name cannot prove the person using it is genuine.
The Pensions Regulator has already urged schemes to review their identity checks in response to impersonation fraud. Identomat argues verification must extend beyond onboarding to high-risk moments such as account recovery, payout detail changes and withdrawals. Its platform combines identity verification, an iBeta Level 2-certified liveness check, face matching and AML screening, allowing providers to confirm that a real person is present and matches a trusted identity before sensitive requests are completed, with concerns escalated for human review.
As Identomat puts it, protecting retirement savings starts not with checking where the money is going, but with checking who is asking for it.
For more insights, read the full story here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
