Keeping your super account secure

Recent cyber‑attacks on several large Australian super funds have raised concerns about protecting retirement savings. If you hold a super account, taking proactive steps now can help reduce the risk of unauthorised access and financial loss.

Why Super Accounts Have Become a Target

Over recent years, major data breaches at well‑known Australian companies have exposed large volumes of personal information. Cyber criminals have used this stolen data to target superannuation accounts through a technique known as credential stuffing.

Credential stuffing occurs when attackers reuse email addresses and passwords obtained from earlier breaches to try to access other accounts. In the recent super fund attacks, criminals attempted logins during the early hours of the morning, when members were less likely to notice suspicious activity. They also targeted members in the pension drawdown phase, who can request lump sum withdrawals.

What Happened During the Attacks

Most affected super funds reported that member accounts and retirement savings remained secure and that members did not lose money. One fund disclosed that a small number of members lost a combined $500,000 during the attack and confirmed it would compensate those losses from fund reserves.

While these incidents were limited, they highlight the importance of personal account security.

Practical Steps to Protect Your Super

You can take several practical steps to help keep your superannuation account secure.

Monitor Your Super Account Regularly

Regular monitoring provides one of the strongest defences against fraud. Check your account balance, confirm employer contributions are arriving, review your insurance cover, read your annual statement, and keep your contact details up to date.

Use Strong Passphrases Instead of Passwords

Avoid reusing passwords across different accounts. Create a passphrase using a sentence or a combination of four or more words that you can easily remember but others cannot guess. Include upper and lowercase letters, numbers and symbols, and aim for at least 14 characters.

Enable Multi‑Factor Authentication

Multi‑factor authentication adds an extra layer of protection by requiring more than one form of verification to access your account. This usually combines something you know, something you have or something you are. If your super fund offers this feature, enable it as soon as possible.

Secure Your Devices

Protect any device you use to access your super account. Use strong passcodes, enable biometric security where available, activate automatic screen locking, and turn on device‑tracking features so you can lock or wipe your device if it is lost or stolen.

Treat Unexpected Messages with Caution

Always verify the identity of anyone who contacts you unexpectedly about your super. Avoid clicking on links in suspicious emails or text messages. Instead, contact your super fund directly using official contact details.

Report Suspicious Activity Immediately

If you notice unusual account activity or receive suspicious communications, notify your super fund straight away. Early reporting can help prevent further damage and improve the chances of recovery.

Staying Vigilant Protects Your Retirement Savings

Cyber threats continue to evolve, but staying informed and taking simple security measures can significantly reduce your risk. By actively managing your super account security, you help protect your retirement savings and maintain peace of mind.