If you have ever tried to change your TSP direct deposit instructions and been told your change wouldn’t take effect for seven calendar days, you have hit the 7-day security rule. It is one of the most complained-about rules in the TSP system. It is also one of the most important.
The rule exists because account-takeover fraud — where a bad actor gains access to your TSP login and redirects your distributions to their own account — is the single largest fraud vector against the TSP, against IRAs, and against the entire U.S. retirement system. The seven-day window is what gives the legitimate account holder time to notice and stop it.
What the rule actually does.
When a TSP participant changes the bank account instructions for receiving a distribution — whether for a partial withdrawal, an installment payment, or a final distribution — the TSP will not release funds to the new account for seven calendar days from the date the change is confirmed.
During those seven days:
- The new bank account information is on file, but no payment will be issued to it.
- Any pending distribution is held at the TSP.
- If the participant (or the TSP’s fraud team) identifies the change as unauthorized, the change can be reversed and the distribution stopped.
After seven days, if no reversal has been requested, the next scheduled distribution will be sent to the new account.
Why seven days specifically.
The seven-day window is calibrated to a specific threat model. Account takeover fraud typically unfolds in three phases:
- Compromise.The attacker obtains the participant’s username and password, often through a phishing email, a credential-stuffing attack using leaked passwords from other breaches, or a SIM-swap that intercepts two-factor authentication codes.
- Redirect. The attacker logs in, changes the direct deposit information, and submits a distribution request.
- Collection. The attacker waits for the funds to land in the new account, then moves them quickly through a chain of transfers before the participant notices.
The seven-day rule breaks the third phase. Even if the first two phases succeed, the funds do not arrive at the attacker’s account until a week has passed. That week is the window in which the legitimate account holder is most likely to log in, see the changed instructions, and report the compromise.
Seven days is also long enough to be effective but short enough that legitimate participants are not meaningfully inconvenienced. The bulk of TSP distribution requests do not require same-day funding.
What triggers the rule.
The 7-day rule applies to changes in bank account information on file with the TSP. Specifically:
- Adding a new bank account.
- Changing the bank account that an existing distribution is paid into.
- Changing the bank account that a new distribution will be paid into.
The rule does notapply to changes in the participant’s mailing address, in their allocation elections, or in their beneficiary designations. The threat model is specific to the destination of funds.
What does not change during the 7-day window.
The 7-day window is targeted at the destination, not the rest of the request. During the seven days:
- Your TSP balance continues to be invested as previously elected.
- Pending distributions remain in pending status; they have not been cancelled.
- Other TSP services — allocation changes, address changes, contribution changes — remain fully available.
If you reverse the bank account change within seven days, the distribution will eventually be sent to the original account, or to the next instruction you provide after the seven-day window has run on the new instruction.
The fraud you don’t see.
The reason the rule matters more than it feels like it does is that account-takeover fraud is, statistically, the single largest fraud exposure for retirement accounts in the United States. Romance scams, business-email-compromise impersonations, and credential-stuffing attacks all converge on the same weak point: a single bank-account change that releases a participant’s retirement savings to a stranger.
I have personally consulted with federal employees who lost five- and six-figure TSP balances to exactly this pattern. The losses were not recoverable, because by the time the funds reached the attacker’s account, they had been moved through several intermediaries and were effectively gone.
Every one of those losses would have been stopped by a seven-day delay. The participant would have logged in, seen the bank account change, and called the TSP’s fraud line. The distribution would have been reversed.
What to do if you receive an unexpected notification.
The TSP will notify you by mail and (if you have it configured) by email when your bank account information is changed. If you receive such a notification and you did not make the change:
- Call the TSP immediately at the ThriftLine number on your statement. The line is staffed for this kind of issue.
- Ask for the distribution to be reversed. If the change was made within the seven-day window, the reversal is straightforward.
- Reset your login credentials. Use a strong, unique password and a non-SMS-based authenticator for two-factor authentication.
- File a report.With the FBI’s Internet Crime Complaint Center (ic3.gov) and with the Federal Trade Commission (identitytheft.gov).
Speed is the variable that determines whether the funds are recoverable. The faster you act, the more likely the TSP can stop the distribution before the seven-day window closes.
The cost you’re actually paying.
The seven-day delay is, in practical terms, the only cost of the security rule for legitimate participants. It adds a week to any distribution where you change the destination bank account. For most TSP participants, that is a once-or-twice-in-a-career event.
The benefit is the existence of a working circuit breaker for the most common retirement-account fraud in the country. That trade is not even close.