Committed to protecting your data – now and always

Protecting your data

Securing your accounts

Providing customer assurance*

Your information
Play video
Cybersecurity Overview

We protect your personal information

  • TIAA's Security Operations Center provides fast, accurate, thorough and non-stop protection from cyber attacks
  • Stringent security patching practices address vulnerabilities that attackers try to exploit
  • Data loss prevention controls help ensure data doesn't fall into the wrong hands
  • Robust supplier risk management practices help ensure our suppliers adhere to our expectations

How TIAA aligns to DOL’s Cybersecurity Guidelines

We have long made cybersecurity and the protection of participant, plan and financial information a top priority and our processes are aligned and compliant with the DOL guidelines.

Read more Opens pdf
Your accounts

Best Practices - TIAA is going passwordless

TIAA is now offering more secure passwordless access option.

TIAA is going passwordless! That’s right…by making the decision to go passwordless, you will limit the hassle of resetting forgotten passwords. Instead, you will have the opportunity to create a passkey that is unique to your specific device which you can use each time you access your account.

In reality, passwords put you more at risk due to the use of the same password for multiple accounts, especially if your password is ever stolen. Removing the need to use a password will add security to your account and better protect your TIAA assets.

If you choose to go passwordless, the experience is easy. Once prompted, you’ll be guided through a few simple steps to create your passkey using the biometric capabilities of your device.

Once you have created your passkey you now have a simpler, safer, and more seamless way to access your accounts.

For more information on how to stay safe online visit tiaa.org/security.

Accounts are protected from unauthorized access

TIAA's log-in security strategy provides faster and more accurate prevention and detection of cybercriminal access techniques.

  • 24x7 security monitoring alerts us to potential issues
  • Industry threat intelligence helps us stay ahead of attacks
  • Established technologies provide efficient prevention, detection and response
  • Multifactor authentication (MFA) is always on to help ensure only you can log into your account

Something you know

Like your username, password, SSN or date of birth

Something you have

Like your registered laptop, smartphone or tablet PC

Something you are

Like voice, facial or fingerprint biometrics

Further strengthen your authentication

Additional verification factors can be added for increased account security.

Add factors Opens in new window
See how

Add a Trusted Contact

A Trusted Contact is someone age 18 or older who you know and trust who will act as a point of contact should we become concerned about your well-being, whereabouts, or in extreme circumstances, where we suspect you may be the victim of fraud or exploitation.

Add a Trusted Contact Opens in new window
Assurance

TIAA provides assurance if an incident occurs

You are reimbursed for any loss due to unauthorized access.*

  • View TIAA's Customer Protection Policy
  • State and Federal law-based incident response and notifications
  • Credit monitoring and identity theft repair if your data is breached
  • Regulatory oversight, independent audit and certification of alignment with industry expectations
Resources

Resources to protect your online interactions

Strengthen your defenses against cybercriminals by increasing awareness and remaining vigilant.

Cybersecurity Videos

Play video
Keeping Older Adults Secure

Could Your Older Friends and Family be at Risk of Online Exploitation?
Financial exploitation is the most common and widespread form of elder abuse
It often occurs in tandem with neglect and other types of elder abuse
Types of Scams
Government OfficialSchemes
Tech Support Schemes
Catastrophe Schemes
Romance Schemes
Investment/ Lottery Scams
National Council on Aging estimates approximately 1 in 10 Americans aged 60 plus have experienced elder abuse
Last year Americans saw an estimated loss of $28.3 Billion.  An increase of 84% over the prior year
If you suspect abuse, please contact local authors or visit:  www.FBI.gov
TIAA

Play video
Tips for Parents

Cyber Safety Tips for Parents
95% of teens have access to a smartphone
46% of teens report they are online “almost constantly”
Users under 25 are the most fraud susceptible age group
It is important to stay educated and well informed to ensure your child is safe while using the internet
These tips and resources can help
Help your child stay secure in cyberspace
Enable parental controls for device and individual apps
Popular apps provide security pages to guide you
Discuss what personal information not to disclose with online “friends”
Attackers try to build relationships to slowly extract a childs name, address parent’s information and photos
Attackers can often sneak harmful or malicious content into popular apps
Monitor phone usage, including screen time, age, appropriate game content and graphics, and limits on in-app purchases
Read Terms & Conditions that give away Personally Identifiable Information (PII)
What to do if your child victimized
Make it clear that the victimization is not their fault
Save all evidence including emails and instant messages
Contact your local law-enforcement agency
For more information visit TIAA.org/security
TIAA

Play video
Working Remotely

Cybersecurity at Home
65% of organizations have seen a measurable increase in the past year and attribute it to the larger potential attack surface caused by remote work
It’s a persistent problem for companies and their workers’ security at home
Here are some tips to protect you and your family while working remotely or using the internet at home
Practice good password hygiene
Set up multi-factor authentication (MFA), including biometric voice recognition and fingerprints on all devices and accounts
Use a strong password or passphrase, don’t write passwords down, and consider using a password manager
Take precautions when using Wi-Fi
Be aware that data can be intercepted
Use a virtual private network (VPN) to provide an additional layer of security when connecting to work or when conducting sensitive activities over free Wi-Fi
Keep your home network secure
Change your router’s default name and password
Don’t leave sensitive information in the open where visitors can see it
Change the default passwords on all purchased appliances
Be sure to only install authorized software and applications from trusted resources
Ensure your devices have the latest antivirus software installed
Ensure device software is up-to-date
Our cybersecurity never sleeps so you can.
TIAA

Play video
Avoiding Malware

- [Voiceover] Are you concerned about the performance of your computer? Maybe you've noticed a sudden change in its speed or more popups. These could be signs your computer is infected with malware. Malware is software used to disrupt a computer, server, or network. It is one of the biggest threats to the security of your devices. Malware includes viruses, spyware, ransomware, and other unwanted software that gets secretly installed onto your device. Malware is installed in several ways. These include infected removable media, like USB thumb drives, internet downloads, clicking on suspicious links and attachments. Cyber criminals use malware to steal sensitive information, gain unauthorized access to files, and interfere with device privacy and safety. They may also be able to gain access to your financial accounts and ultimately steal your money. In addition to performance changes and popups, other signs of malware include repeated, unusual error messages, your device won't shut down or restart, unexpected low battery life and the inability to remove software. What should you do if you suspect your device is infected with malware? One, download a reputable anti-malware software and get offline immediately. Two, stop any shopping, banking, or other online activities that involve usernames, passwords, or other sensitive information. Three, back up any critical files. Be aware of the dangers of malware. Protect your personal information as well as your financial security. Help stay protected by making sure you are up to date on all your anti-virus and anti-malware software. For more information, visit the TIAA Security Center at tiaa.org/security.

Fraud Awareness Videos

Play video
Avoiding Account Takeovers

Account takeovers are on the rise and it is important you understand what it is and how to protect yourself.

An account takeover occurs when someone uses your stolen personal information to gain unauthorized access to your online accounts or to impersonate you over the phone without your permission.   Once they are able to access your account, they can make changes to your account profile, withdraw funds, make changes to lock you out of your account, or make purchases.

To protect against account takeovers, financial institutions and other companies have increased security of accounts through multifactor authentication and biometric verification but there are steps you can take to protect your accounts and assets. 

* Always use the strongest form of authentication available

And for accounts that require passwords:

  • Use strong, hard to guess passwords consisting of both letters, numbers, and symbols and don’t use the same password across all your accounts.
  • Change your passwords periodically, especially for your financial accounts.
  • When communicating with your financial institution, only use verified, published contact information.
  • Ensure your anti-virus and anti-malware software is up to date and run regular scans of your devices.
  • Review financial accounts regularly for any suspicious activity.

To learn more about how TIAA protects your accounts visit the TIAA Security Center at tiaa.org/security

Play video
Tax Scams

It’s tax season and scammers are using this time to impersonate the IRS to steal your money or personal information. It is important to familiarize yourself with typical scam tactics, prevention techniques, and what to do if you believe you or someone you know has been impacted. Their schemes can start with a call, text, email, or even a social media message. Often, scammers use spoofing to make their calls look like a legitimate IRS phone number. They will try to convince you that you owe back taxes or there’s a problem with your tax return. Scammers play on your fears and try to convince you to rectify the problem by paying immediately…and if you don’t, will threaten you with jail or large monetary penalties. They might even use the opportunity to convince you to share your personal information. The IRS will always begin communication with an official letter in the mail…never a call, text, email or social media message. Additionally, the IRS will never ask for payment in the form of gift cards, money transfers, or cryptocurrency. You can call the IRS at 1-800-829-1040 to verify the legitimacy of any IRS related communications you receive. If you receive an unsolicited communication from a scammer do not respond. Instead, visit the IRS website for information on how to make a report.  Also, consider reporting to the Federal Trade Commission, and lastly, for more information on how to protect yourself, visit the TIAA Security Center at TIAA.org/security.

Play video
Fraud and Scams

It happens to all of us and if it hasn't happened to you, it eventually will. You receive a phone call, text, or email you weren't expecting, but the contents make you pause and pay attention. The message you receive makes your heart race or you might wonder if you're in trouble. The message seems urgent, and wants your attention and action immediately. It seems bizarre, but the message is convincing you that you should act and fast. You're not alone with these types of messages. These are all common traits of scams. Scammers use common tactics no matter what the scam is. Scams utilize common tactics such as a sense of urgency. The message, whether email, text, or phone will convince you that you must act and rectify a situation or take advantage of some benefit. With the sense of urgency, tactics might also be used. This could include convincing you that something has happened to a loved one or that you must send money right away. The sender, a caller might request payment in unusual payment methods such as gift cards or tell you that you've been overpaid for a product or service and must return the extra amount. If you receive a phone call, text, or email with any of these common trades, hang up, delete, or ignore the message altogether. Someone is trying to scam you. Remember, being informed and vigilant is the best way to avoid scams. Stay safe and never give into these fraudulent schemes. If you are the recipient of a scam attempt you can report it to the Federal Trade Commission. Visit the TIAA Security Center for more resources on how to protect yourself and your accounts.

Play video
Government Scams

Avoiding Government Authority Scams
Scammers are calling individuals pretending to be government officials from agencies such as the FBI, IRS, or SSA
Scammers will call, text, or email
You may also receive a spoofed phone call that appears to be from the government agency
The scammer may say you owe back taxes, have an outstanding warrant, or have a problem with benifits
They may threaten you with jail, penalties, or the loss of benefits
Here are some things you should know to protect yourself from these scams
Things you should know
Legitimate government agencies will always initiate contact by mail
Government agencies will never ask you to pay with gift cards, money transfers, or cryptocurrencies
Contact the government agency using an official published number to verify if there is an issue.
Report these scams to the Federal Trade Commission.  For more information on how to protect yourself online, visit tiara.org/security
TIAA

Play video
Romance Scams

Red Flags of Romance Scams
As the online nation user base continues to rise, so do the chances of someone falling victim to a romance scam
In 2022, over 19,000 people reported being victim to romance scams and the losses hit a staggering $736 million
Here is how to identify a romance scam
Spotting romance scams
They provide countless excuses on why they can’t meet you in person
They ask for money for emergencies or some type of trouble they are in
They want money in the form of gift cards, money transfer, or cryptocurrency
What should you do if you or others become involved in a Romance Scam?
Actions you can take
Talk to a trusted family member or friend about new online love interests and pay attention if they seem concerned
A legitimate love interest will not ask for help in the form of gift cards, money transfer, or cryptocurrency
Do a reverse image search of any profile pictures immediately
If the details and pictures don’t match up or make sense, it could be a scam and you should discontinue contact
You can report romance scams to the Federal Trade Commission.  To learn more about protecting yourself while online, visit tiaa.org/sercurity
TIAA

Play video
Tech Support Scams

Avoiding Tech Support Scams
A common scam you might experience is the tech support scam
Tech Support Scams
The scam may start with a pop-up message indicating a problem requiring technical support
Alternatively, you may receive a phone call, email, or text indicating a similar scenario
Scammers may convince you to install software enabling remote access to your computer
Scammers will try to convince you to send them money
Here are some thing you should know to protect yourself from these scams
Things you should know
Legitimate tech companies will never contact you by phone, email, or text to tell you there is a problem with your device
Always be suspicious of urgent pop-up warnings
If concerned, call the company directly using the number listed on the official website.
Legitimate tech companies will never ask for payment methods like gift cards, money transfers, or cryptocurrencies
What should you do if you think you are a victim of a tech support scam?
What should you do?
Run updated anti-virus software immediately
Contact your financial insinuation to stop any payments you might have made
Update your passwords for your online accounts
Report scams to the Federal Trade Commission.  For more information on how to protect yourself online, visit tiaa.org/security

Report a security concern

Suspicious account activity

Let us know about unauthorized access, issues with your balance, or other security issues.

Call us at 800-842-2252, weekdays, 8 a.m. – 10 p.m. (ET)

Suspicious email

To report a suspicious email, please email us at abuse@tiaa.orgOpens Email.

Resources

We gathered a list of fraud investigative agencies, major credit bureaus and other resources.Opens dialog

Responsible Disclosure policy**

If you are a security researcher and believe you have identified a vulnerability affecting TIAA, please submit a report here.Opens in a new window For other technology related security issues, you can contact us at security@tiaa.orgOpens Email

*Our practice is to reinstate a client's TIAA account in full if there is a loss that is determined to be the result of unauthorized activity through no fault of the client.

**You are about to leave TIAA’s website and access a website that is unaffiliated with TIAA.  TIAA does not assume responsibility or liability for the content or privacy policies of external sites.

4282900