Staying safe in a digital world

The internet makes daily life easier — from following the news and staying connected with loved ones to managing your bank account and UC retirement benefits. Unfortunately, it also opens the door to scammers, who are becoming more sophisticated every year.

In 2024, seniors lost $4.8 billion to online fraud, according to the FBI. That figure doesn’t include unreported cases, and estimates suggest actual losses could be over $80 billion.

The UC community must be vigilant and work together to defend against these threats — including attacks that have targeted UC retirees. Here’s more information about what UC is doing and how to protect yourself.

Attacks against UC retirees

The UC Retirement Administration Service Center (RASC) has learned of recent attempts to defraud UC retirees by changing their direct deposit information in UC Retirement At Your Service (UCRAYS), and/or by initiating transactions on their behalf.

It is critical that you monitor your benefit payments carefully and contact the RASC immediately if you suspect fraud. (See below for contact information.) The RASC conducts a thorough investigation into the specific facts and circumstances of each case of fraud (or suspected fraud) that impacts our members to determine how to address the situation and reduce future risks.

How UC is working to protect you

The RASC continuously reviews and updates their security protocols to prevent fraud. For example, UC deploys:

• Multiple safeguards to block fraudulent transactions.
  • When you make a change online or by phone (to your contact or direct deposit information, for example), you’ll receive an immediate confirmation email. If you didn’t make that change, call RASC right away.
  • Advanced analytics identify potential fraud and unusual patterns in real time.
  • If a transaction raises red flags, you may receive a verification call from a RASC representative. Unsure if the caller is legitimate? Contact RASC directly to confirm.
• Active monitoring for fraudulent websites. Cybercriminals place deceptive ads in search engine results (like Google and Bing) for terms like “UCRAYS,” linking to fraudulent websites designed to steal usernames and passwords. By staying on top of these threats, we can respond immediately to ensure fake websites are taken down.
• Strengthened identity verification. The RASC is enhancing multi-factor authentication and deploying new verification tools that will work together to block unauthorized access and reduce fraud risk.

UC also provides comprehensive identity protection through Experian for retirees and their dependent children up to 18. Enrollment is automatic, but if you have not set up your account, contact Experian’s member services team at 855-797-0052. If Experian cannot find your eligibility record, call the UC Retirement Administration Service Center (RASC) at the number below. If your account is set up, sign in at: experian.myfinancialexpert.com/login

How you can protect yourself

Keep your login credentials safe by following these three rules:

1. Set strong passwords. A strong password doesn’t have to be complicated — it just needs to be unique to you. A long meaningful phrase like “I love my garden in spring,” is often stronger than a short jumble of characters. And if you find it difficult to keep track of multiple passwords, a trusted password manager can help.
2. Think before you click. Messages that are urgent or emotional, especially those that ask for personal information or money, are red flags. Don’t click links or attachments — instead, go directly to the organization’s official website for more information. And remember: UC won’t ask for your password or other personal information over email, and neither will other legitimate organizations.
3. Verify the source.
   • Only enter your username and password on UCRAYS after verifying the URL address is correct: https://retirementatyourservice.ucop.edu/
   • Check email senders, website URLs, and login pages closely. Look for misspellings, inconsistencies, or anything unusual. When in doubt, don’t proceed — report it instead.
   • Bookmark websites that you visit often, such as UCRAYS, to avoid landing on fake pages from malicious ads or search results.

Cyberattacks keep increasing in frequency and complexity, and UC cybersecurity teams work around the clock to mitigate risk and protect UC data. We all have a role to play in protecting ourselves and UC. Play it safe, and, if you have the slightest suspicion that something may be potentially threatening, report it to the RASC right away.

Get more tips on protecting your data from the National Cybersecurity Alliance. If you have experienced fraud, please report the incident to the Internet Crime Complaint Center (IC3) managed by the FBI.

UC cannot guarantee that no fraud will ever occur, but we will continue to strengthen controls, monitor emerging threats, and respond appropriately when new risks are identified.

Contact RASC

1-800-888-8267 (international callers: 1-510-987-0200)
Monday through Friday, 7:00 a.m. to 4:30 p.m. (PT)