Fake Fidelity / Vanguard / Schwab / TIAA / Empower / Principal / Voya / Transamerica / John Hancock / Merrill Edge / T. Rowe Price retirement-account breach-framing lure — "401k / 403b / IRA / Roth / pension accessed by unauthorized device, verify within 24 hours or positions liquidated / rollover pending" targeting 43M+ Fidelity + 50M+ Vanguard + 35M+ Schwab + 18M+ Empower participants ($40T US retirement assets); typical 55+ account $200K-$2M; post-compromise = IRA-to-attacker-IRA rollover (ACATS + plan-to-plan) which is IRREVERSIBLE once funds clear — distinct from brokerage-suspension phish (active trading) and early-withdrawal-scam phish (promising payouts); users check retirement accounts quarterly so attacker has LONG window

Fake "your Fidelity / Vanguard / Schwab / TIAA / Empower / Principal / Voya / Transamerica / John Hancock / Merrill Edge / T. Rowe Price retirement account (401k / 403b / IRA / Roth IRA / pension) has been accessed by an unauthorized device — verify your account within 24 hours or your positions will be liquidated / rollover is pending" email targeting retirement-account holders. Program reach is massive: Fidelity 43M+ retirement accounts (avg 401k balance $127K, avg IRA $109K, age 55-64 avg $232K, 65+ avg $269K), Vanguard 50M+ investors (heavy retirement concentration), Schwab 35M+ combined brokerage + retirement, TIAA 5M+ (academic/nonprofit), Empower 18M+ plan participants, Principal 6M+. Total US retirement assets ~$40 trillion across 401k + IRA + pensions (Federal Reserve + ICI 2024 data). Why this is higher-stakes than general brokerage phish: typical 55+ balance is $200K-$2M — FAR above typical bank or active-trading brokerage balance, so a single successful account takeover is life-savings catastrophic. Post-compromise path is distinct: the attacker initiates an IRA-to-attacker-controlled-IRA rollover (ACATS transfer + plan-to-plan IRA rollover forms), which is IRREVERSIBLE once funds clear because a completed IRA rollover transfers tax-advantaged status permanently — unlike a bank wire which can sometimes be recalled. By the time the quarterly-checking retirement-saver notices the missing balance, the money is gone. Distinct from `fake-robinhood-brokerage-suspension-lure` (covers active-trading brokerage-suspension framing with Robinhood/Fidelity/Schwab/E*TRADE/TD Ameritrade/Webull vendors) and `fake-401k-retirement-early-withdrawal-phish` (covers scams that PROMISE illegitimate payouts from a retirement account — opposite attack shape). Fires when body references Fidelity / Vanguard / Schwab / TIAA / Empower / Principal / Voya / Transamerica / John Hancock / Nationwide / MetLife / Prudential / T. Rowe Price / Merrill Edge / 401k / 403b / 457b / Roth IRA / Traditional IRA / IRA account / retirement account / retirement savings / pension account AND contains unauthorized-access / breach / rollover-pending / positions-liquidated / verify-account / 24-hour urgency. Excludes fidelity.com, fmr.com, vanguard.com, schwab.com, charlesschwab.com, tiaa.org, tiaa-cref.org, tiaa.com, empower.com, empower-retirement.com, principal.com, voya.com, transamerica.com, johnhancock.com, nationwide.com, metlife.com, prudential.com, troweprice.com, wellsfargoadvisors.com, merrilledge.com, merrilllynch.com. Auto-classified as danger via the `-lure` suffix.