Create a strong, unique password for your benefits account. Avoid using the same password you use for email, banking, or other websites.
Never share your password with anyone.
Never share verification codes or one-time passcodes with anyone who contacts you unexpectedly.
Use multi-factor authentication (MFA) when available.
Be cautious of unexpected emails, texts, or phone calls asking you to verify account information. When in doubt, access your benefits account using your normal login method rather than clicking an unfamiliar link.
Protect Your Benefits Card
Never share your benefits card with anyone, including friends or family members.
Keep your physical card secure and treat it like a payment card.
If your card is lost, stolen, or you believe someone has obtained the card information, report it immediately and follow the instructions for replacing or blocking the card.
Review card activity regularly and watch for purchases you don't recognize.
Do not wait to report suspicious card activity. Report it as soon as you notice something unusual.
Submit a card dispute for any transaction that you did not make within 60 calendar days of the card transaction.
Monitor Your Account Regularly
Make it a habit to check your account and transaction history. Look for:
Card transactions you don't recognize
Unusual or unexpected reimbursements
Changes to your personal information
Changes to your email address
Changes to your mailing address
Changes to your bank account or direct deposit information
Unexpected HSA Bill Pay activity
Other account activity you did not authorize
Turn On Fraud & Security Alerts
Make sure important account notifications are configured to reach you through your preferred delivery method: email, SMS/text, or both.
Pay particular attention to alerts for:
Address changes
Email address changes
Direct deposit/bank account changes
Card approved
Card denied
Other account or security notifications available through your account
HSA Account Takeover: Know the Warning Signs
Your HSA can contain significant funds, making it especially important to protect your online account.
Be alert for unexpected:
Changes to your bank account information
Changes to your email address or other contact information
HSA Bill Pay activity you did not initiate
Large payments you don't recognize
Notifications about transactions or account changes you didn't make
Watch Out for Phishing & Scams
Fraudsters may impersonate your benefits administrator, employer, financial institution, or other trusted organizations.
Be cautious when someone:
Asks for your password or verification code
Requests your full card or account information
Pressures you to act immediately
Sends an unexpected link asking you to log in
Asks you to "verify" or "update" your banking information through an unfamiliar website
If You See Something Suspicious, Act Quickly
If you believe your account or card has been compromised:
Report it immediately to your benefits administrator using the official contact information provided with your account.
If your card is involved, report the suspected unauthorized transaction and follow the card dispute process.
Submit card disputes within 60 calendar days of the transaction.
If you suspect an online account takeover, tell the administrator that you believe your online account credentials may have been compromised.
Review your account for additional unauthorized activity.
Change your password and take any other security steps recommended by your benefits administrator.