Q: Last year, I lost my entire 401(k) — $114,000 — after Paychex mailed me physical rollover checks instead of doing a secure transfer. The checks were intercepted and fraudulently cashed.

I’m now in federal court trying to hold Paychex accountable, but this experience has made it painfully clear how little protection exists for consumers in situations like mine. For some reason, this outdated and insecure method remains standard practice in the retirement industry.

— Dylan Handy, New York City

This is a tale of fraud, responsibility and process. Let’s take them in order.

First comes fraud. The interceptor and casher whom Mr. Handy refers to is a thief still on the loose.

In 2023, Mr. Handy changed jobs and was trying to move his 401(k) money from his old workplace plan to his new one. Paychex, which helped manage his old plan, arranged for him to get two checks in the mail — one for his 401(k) and one for a Roth version. Then, he was supposed to send the checks on to his new plan administrator with a rollover form. He did that, or so he thought.

In fact, a thief somehow took the checks. That thief (or those thieves) took one check to Citizens Bank and another to Chase and successfully cashed or deposited them.