The tricky part is that most of us don't check our 401(k) accounts all that often, which makes it harder to spot unusual charges. And that gives cybercriminals the upper hand.