Skip to main content


The SEC has noticed a dramatic rise in fraud against online brokerage accounts. This is a very interesting article in that it shows how an attacker can take over accounts and make money without necessarily removing money from those accounts. All they need is a couple of "legitimate" account that the fraudsters open, a thinly traded small-cap stock and to control a couple of pwned accounts with enough money to manipulate the targeted stock. The article describes "pumping" as using pwned accounts to drive up the price of stocks that you hold. However, you can also make money on the way down:

  • First, open the two online brokerage accounts. In Account A purchase the targeted stock. You will have to do it in such a way that the stock price doesn't rise. In Account B, do nothing for now.
  • Second, use your nefarious means to gain control of some accounts. Sell all their existing holdings and start buying shares in the targeted company.
  • As the stock price rises, sell all your shares in Account A, probably to the poor guy in the pwned account.
  • After you sell all the stock in Account A at high prices, start short-selling in Account B. You will need to pay attention to the short-selling rules for the exchange. For example, on the NYSE you can only short-sell a stock on an up tick.
  • Dump all the stock in the pwned account as quickly as possible
  • Clear out your short positions in Account B.
  • Start laundering your profits.

There are a number of interesting points:

  • One, it is harder to track because of the number of accounts used. The attacker also now has three or more different accounts probably at different brokerages with money for laundering, so it is more likely that they will successfully get cash.
  • The fraudster can make money as the stock rises and falls.
  • It is yet another reason for a small cap stock to not be a public company. The main reason being meeting regulatory requirements.

As a side note, this confirms one of my predictions for 2006 which is good, because it doesn't look like any of the others will come to pass any time soon. It also points to the need for improved transaction authentication.

Current rating: 1

Recent Posts







RSS / Atom