Schwab 401k &#39;hacked&#39;; somehow they added/linked an unknown bank account and transfered out ~10% of my balance!! How
<p>I recently received a couple of 'notification' emails from Schwab re. the approval/completion of various changes I supposedly requested to an old 'inactive' (past employer) 401k account, including:</p>

<ol>
<li>the addition of a bank account linked to my Schwab 401k;</li>
<li>the successful transfer of 10% of my 401k to the linked bank account;</li>
<li>and the required IRS 'penalty' forms resulting from my 401k early withdrawl.</li>
</ol>

<p>Having significant Network/IT related experience, my first reaction was to 'trace/track' any info I could find to help ID the thief, however, I noticed that the transferred funds had just cleared that same day (literally, ~6 hours earlier) AND the added/linked unknown bank account was still active; so, I immediately set up a reverse transfer back to my 401k (~10% +$50 to cover any potential fees I might need to cover as a result). 
I contacted Schwab next, and explained what I had done.  They all seemed to get a kick out of my reverse transfer, but also informed me that my funds would be returned regardless and they would handle reverting my account to its original status with additional security protocols. In the end, my reverse transfer went through and the unknown bank account was deleted.  About a week later Schwab subtracted the extra $50 reverse transfer portion.  I contacted them to find out why (-$50), and what the status was with my ID/Bank Fraud (victim) case. I was shocked to find that their position/policy in such security breach / fraud cases was; <em>"these ID Theft rings are highly sophisticated and nearly impossible to catch....it very well may have been an 'inside' job scenario, and there really is not anything more Schwab can do unless the police get involved...which typically is a dead end anyway...".</em>  </p>

<p>So...my general question(s):</p>

<ol>
<li>Is there any truth to Schwabs' responses or are they just trying to avoid any bad publicity?</li>
<li>It's been over 3 months now and I am still feeling an excessive insecurity regarding all my internet financial accounts, and a continuous suspicion that it may have been a 'personal attack'.  Any advice or suggestions on dealing with this situation or my options (legal or otherwise) should I choose to pursue this matter would be gratefully appreciated.</li>
<li>And, where did the extra $50 go?  Why does Schwab get to profit from my loss (do I still have to pay the penalty for early withdrawl or do I need some documentation from Schwab?).</li>
</ol>

<p>In essence, Schwab is stating that they are not a law enforcement agency and they have neither the interest nor the legal right to pursue criminals. They state that they will assist law enforcement but also tell you that, from their experience, law enforcement while they have the legal right also don't have any interest in doing so.</p>

<p>This is completely correct.</p>

<p>I'm not going to comment on what you should do to protect yourself from identity theft.</p>

<p>With respect to the reverse transfer: you are on very shaky legal ground here - you transferred funds without authorization and you are not legally allowed to do this even to recover your own losses. If you had limited this to just recovering your own funds then you would be extremely unlikely to be prosecuted but by taking more than was yours you have technically committed a theft of your own. That said, it seems unlikely that law enforcement will be interested - Schwab are not making a complaint and I doubt that the original thief will - for obvious reasons. </p>

<p>However, its possible (even likely) that this was not the thief's bank account - this is likely to be an innocent third party's account  that the thief was using to obfuscate their crime. If so, the money you took (both the original amount and  the extra $50) you took actually belongs to that innocent party - your money had probably spent very little time in that account. </p>

<p>This answer only addresses your question #3 about the early withdrawal penalty.</p>

<p>There is a general provision that if funds withdrawn from a retirement account are <a href="https://www.irs.gov/retirement-plans/plan-participant-employee/rollovers-of-retirement-plan-and-ira-distributions" rel="nofollow noreferrer">"rolled over"</a> into another retirement account within 60 days, then the 10% tax penalty won't apply.  The tax might be withheld by the broker, but you can get it refunded when you file your taxes for the year.  <a href="https://finance.zacks.com/60day-grace-period-withdrawals-retirement-accounts-2002.html" rel="nofollow noreferrer">This article</a> suggests that this also applies when you deposit funds back into the same account from which they were withdrawn, though I can't find explicit confirmation of that from an official source.</p>

<p>But if you can't find another way to avoid the penalty, you might be able to take advantage of this provision.  You'd want to discuss it with the people at Schwab as well as your own tax advisor.</p>

united-states tax-law fraud finance