Security Center: Understand How the TSP Secures Your Account

The TSP computer system uses Secure Sockets Layer (SSL) and 128-bit encryption to access personal account information online. Encryption is a process by which your TSP account number (or user ID), Web password, and all information relating to you and your TSP account is scrambled and locked with a mathematical key during an electronic transaction. In order to access your account, your browser must support SSL version 3.0 or higher, and 128-bit encryption.

To assist TSP participants accessing their accounts from overseas, the website uses an encryption technique - Global Secure Site ID - that establishes temporary 128-bit encryption. It is accessible from the latest versions of any Web browser.

This is a technology that makes it possible for you to verify that you have safely accessed the actual TSP website rather than a fraudulent imitator. If you use a high security browser, you can be certain that you have reached the TSP website if some portion of your address bar is highlighted in green, as in the example below.

You can only gain access to your account by entering your account number (or a user ID that you create to use instead of the account number) and your TSP Web password.

When you log into your account, the TSP automatically masks the digits of your account number (or user ID) and Web password with asterisks.

The TSP will never send your name, TSP account number, Social Security number, ThriftLine PIN, or Web password over the Internet or give them out over the telephone. (If you forget or lose your account number, PIN, or Web password, you must request to have new numbers mailed to you.) Also, the TSP will never ask you for information about your account through e-mails, text messages, or telephone. If you receive such a request, do not respond, and report it to the TSP immediately.

Once you have entered your user ID (or account number) and password and been “authenticated,” that is, been granted access to our secure system, your temporarily assigned Internet connectivity Internet Protocol (IP) address must remain the same during the entire My Account session. From a security perspective, this prevents someone using the same computer after you from circumventing the log in process by tracing your Web browsing history, for example.

You will receive the error message, "You cannot access this account for one hour," any time three attempts are made to access your TSP account information using an incorrect TSP account number or Web password. This feature discourages unauthorized users from making repeated attempts to gain access to your account. If you do not know your account number or Web password, you will have to ask the TSP to mail them to your address of record.

The secured areas of the TSP website have an automatic timer that terminates access to your account information after 30 minutes.

When you log into your account, you will see the date of your last login at the top right of the Web page. Pay attention to this date. It is a way for you to know whether someone else has had access to your account.

You can block all online (or ThriftLine) access to your account through this website, by calling the ThriftLine and speaking to a Participant Service Representative, or by letter. Access to your account will remain blocked until you write to the TSP to remove the block. Your letter must include your name, account number (or Social Security number), your date of birth, signature, and the date you signed the letter. The TSP will also automatically block access to an account upon notification that a participant is deceased.

The TSP will mail you a confirmation notice when you make changes to your account information, such as making interfund transfers, changing your contribution allocation, changing your name or address, or designating beneficiaries to your account. Be sure to open and promptly read all information you receive from the TSP. If you receive confirmation of an action on your account that you did not request, contact the TSP immediately.