The Outlier Lab

Brokerage and Investing

How retail brokerages move cash and securities, why ATO, ACATS, instant buying power and investment scams dominate losses, and how FINRA and SEC rules shape defenses.

Business model and fraud surface

Commission-free brokerage makes money on what customers hold more than on what they trade: interest on swept cash, margin and securities lending, order-flow payments, subscriptions and crypto spreads. That pushes product teams toward three features the fraud team then has to underwrite: instant buying power on deposits that haven't settled, fast digital onboarding, and easy money movement (instant withdrawals, debit cards on the cash sweep, one-tap ACATS).

Diagram: External bank account, Cash and buying power, Wire or check deposit, Other broker, Securities positions, External bank, card or cash, External wallet, Receiving broker

Three structural facts shape every control decision here.

  1. Securities are a second currency. You can monetize a brokerage account without a single withdrawal. In Japan's 2025 wave, attackers who couldn't easily send proceeds to a bank in another name sold victims' holdings and bought illiquid stocks instead, profiting on positions they already held (see Case Study - Japan Brokerage Account Takeovers (2025)). FINRA's 2026 oversight report calls ATO-funded buying of pump-and-dump stocks a new US trend as well. When withdrawal controls are strong, attackers exit through the market, so trading restrictions on suspect accounts belong in the fraud toolkit as well as in surveillance.
  2. Funding is credit. Instant buying power on an ACH pull is an unsecured loan until the debit settles and the return window closes. FINRA's 2021 instant-funds notice described accounts that linked a bank, traded on provisional funds and left the firm with the loss when the ACH came back. Manage the instant limit like a credit line with a loss budget.
  3. Regulation E mostly doesn't apply. Reg E excludes transfers whose primary purpose is buying or selling securities through a registered broker-dealer. Who pays for an ATO liquidation is therefore set by the customer agreement, any firm guarantee, supervisory expectations and reputation. People often forget the exception, which is that a debit card on the brokerage cash account, used for purchases or cash, is covered. Japan shows where the pressure goes. Brokers there agreed to compensate victims even though rules didn't strictly require it, after regulators and the industry association said blanket refusals were unacceptable.

Decision points, in the order money moves: account opening, bank link, deposit availability, contact and credential changes, trade entry, withdrawal or transfer request, and ACATS validation. ACATS validation runs on a short clock: under FINRA Rule 11870 the carrying firm generally validates or takes exception within one business day, then completes the transfer within three business days.

What fraudsters want here

TargetWhy it paysConceptual pathMechanism
Liquid balancesLarge balances, concentrated in older customersTake over → change contact or bank → liquidate → withdrawAccount Takeover (ATO), Payout Redirection
Market accessVictim capital moves thin securitiesTake over → sell holdings → buy the target securityRamp-and-Dump via Account Takeover
PortabilityACATS moves whole accountsStolen-identity account at another firm pulls assets, then moves them outACATS Transfer Fraud
Provisional creditBuying power before settlementNew account → bank link → trade on instant funds → loss on returnInstant Funding Abuse (Kiting)
The customer's own handsPersuaded customers liquidate and sendLure → liquidation → wire or cryptoInvestment Scams (Pig Butchering)
IdentitiesNominee and "profiting" accountsAccounts in others' names, controlled by one partySynthetic Identity Fraud, Fraud Rings and Collusion
IncentivesFree stock and referral cashMany accounts, minimum deposits, quick exitSign-Up Bonus Abuse, Referral Abuse

Fraud across the customer lifecycle

StageMechanismsKey controls
OnboardingSynthetic Identity Fraud, stolen-identity accounts staged for ACATS Transfer Fraud, Multi-Accounting, Money MulesKYC and Customer Identification Program (CIP), Document Verification and Liveness, Bot Management and CAPTCHA, Negative Lists and Deny Lists
LoginCredential Stuffing, Phishing and Credential Harvesting, Session Hijacking and Infostealers, MFA Bypass and OTP InterceptionPasskeys and Phishing-Resistant Authentication, Risk-Based Authentication and Step-Up, Breached Password Detection, Device Binding and Trusted Devices
Account maintenanceAccount Recovery Abuse, SIM Swap and Port-Out Fraud, Payout RedirectionContact Change Cooling-Off Periods, Secure Account Recovery Design, Bank Account Ownership Verification
FundingACH Funding Fraud, Instant Funding Abuse (Kiting), Check and Mobile Deposit Fraud, inbound ACATS Transfer FraudFunds Availability Holds, Velocity and Exposure Limits, Bank Account Ownership Verification
TradingRamp-and-Dump via Account Takeover, options profiting-account schemes, Business Logic Exploitation in buying-power mathReal-Time Transaction Risk Scoring, Transaction Monitoring, trade restrictions via Velocity and Exposure Limits
RewardsSign-Up Bonus Abuse, Referral AbuseReward Vesting and Clawback, Referral Program Controls
PayoutATO cash-out, outbound ACATS Transfer Fraud, Investment Scams (Pig Butchering), Impersonation Scams, Elder Financial ExploitationWithdrawal and Payout Controls, Trusted Contact and Senior Investor Holds, Customer Education and Scam Warnings
Customer supportSocial-engineered recovery and changes, Insider FraudCustomer Support Verification Protocols, Insider Access Controls
DisputeUnauthorized-EFT claims on cash-management cards, false "I didn't trade" claims (First-Party Fraud)Case Management Systems, Manual Review Queues

Top mechanisms, ranked

  1. Account Takeover (ATO): the enabler behind most third-party loss. Phishing, infostealers and stuffing lead to contact or bank changes, then liquidation and withdrawal, an ACATS request, or manipulative buying. FINRA's ATO notice flags an email change followed by a third-party wire, and withdrawals to newly linked banks.
  2. Investment Scams (Pig Butchering): the biggest dollars per victim, because the account holder liquidates and sends the money. IC3 recorded about $8.65B in investment fraud losses in 2025, about $7.2B of it crypto investment fraud.
  3. Ramp-and-Dump via Account Takeover: victim capital, or victims coached in social-media "investment clubs", buys thin securities so the operators can sell (FINRA 2026; Regulatory Notice 22-25).
  4. ACATS Transfer Fraud: a stolen-identity account at a receiving firm pulls a real customer's assets and moves them out within days. Red flags include repeated rejected transfer requests and quick outbound movement after arrival (Notices 22-21 and 23-06).
  5. Instant Funding Abuse (Kiting): trading or withdrawing on provisional credit, then letting the ACH return. It spikes with volatility and social-media attention (Notice 21-14).
  6. ACH Funding Fraud: linking bank accounts the customer doesn't own, often from ATO'd bank credentials or mules. Losses arrive weeks later as unauthorized returns.
  7. Elder Financial Exploitation: strangers and trusted persons alike. The brokerage sees it as unusual liquidations, new payees and third parties on calls. IC3 put 2025 losses by people over 60 at about $7.7B across all channels.
  8. Impersonation Scams: fake firm, regulator or government contacts, including the gold-bar courier pattern, where victims liquidate securities, buy precious metals and hand them over (FINRA 2026). IC3 counted about 725 such complaints and $311.8M in losses in 2025.
  9. Synthetic Identity Fraud and stolen-identity new accounts: the staging layer for ACATS fraud, nominee accounts, options "profiting accounts" (Notice 20-32) and mule accounts. FINRA and FinCEN both describe GenAI-forged IDs and deepfake selfies aimed at onboarding.
  10. Sign-Up Bonus Abuse: free-stock and referral programs farmed through Multi-Accounting. Each account costs little, but the scheme funds aged, KYC'd accounts that later serve worse schemes (Account Farming and Resale).

Regulatory environment

Rule or regimeWhat it doesWhy the fraud team cares
FINRA Rule 4512Reasonable efforts to obtain a trusted contact for non-institutional accountsYour best ally in exploitation and scam cases. A 2026 proposal allows "emergency contact" wording and one contact across all accounts
FINRA Rule 2165Temporary holds on disbursements or transactions for specified adults (65+ or impaired). Currently 15 business days plus extensions of 10 and 30Lets you stop money leaving while you investigate. A 2026 proposal would allow up to 145 business days when authorities need time
Proposed FINRA Rule 2166Short delay on a transaction or disbursement when fraud is reasonably suspected, for any adult customer. Up to 10 business days as filed in August 2026Would close the gap for scam and ATO victims under 65. Pending SEC approval
FINRA Rule 11870ACATS validation and completion timelinesSets the window for outbound ACATS fraud review
FINRA Rules 3110 and 3310Supervision and AML programsFINRA expects risk-based verification of transmittal instructions and allows limiting transfers from compromised accounts
SEC Regulation S-IDWritten identity theft red flags program for covered accounts at broker-dealers, funds and RIAsThe formal home for ATO and new-account fraud controls
SEC Regulation S-P (2024 amendments)Incident response program, customer notice within 30 days of an unauthorized-access incident, service-provider notice within 72 hoursCompliance dates were December 3, 2025 (larger entities) and June 3, 2026 (smaller). ATO incidents can trigger it
BSA/AMLCIP, SARs, FinCEN alerts (e.g., pig butchering FIN-2023-Alert005, deepfakes FIN-2024-Alert004)SAR obligations and key terms for scam and deepfake activity
Regulation EExcludes securities transfers. Covers debit card use of brokerage cash for goods or cashKnow which of your money movement paths are covered
Nacha rulesACH return thresholds and 2026 fraud monitoring dutiesInstant-funding losses show up as ACH returns

For detail, see Broker-Dealer Obligations (FINRA and SEC), US Regulatory Overview, BSA-AML and SAR Filing, Regulation E and Unauthorized Transfers, Nacha Rules and ACH Risk, Privacy and Data Use in Fraud Prevention.

Key metrics

MetricDefinitionWhy it matters here
ATO rate and conversionConfirmed ATOs per 10k active accounts, and the share that reach money or trade movementSeparates login hygiene from transaction defense
Loss by exit pathDollars lost via withdrawal, ACATS out, manipulative trading, crypto, cardAttackers shift exits as you close them. See Loss Taxonomy and Attribution
Risk-to-movement dwell timeTime from first risky event (new device, contact change, bank link) to first outbound movementThis is your control window. Short dwell times call for automated holds
Instant-credit loss rateLosses on returned deposits as bps of instant buying power extendedPuts a real price on the growth feature
Unauthorized ACH return rateR10/R29-style returns versus Nacha's 0.5% thresholdNetwork standing and a funding-fraud early warning
Outbound ACATS review coverageShare of risky outbound transfers reviewed before validation, and fraud rate by receiving firmConcentration on one receiving firm is a classic tell
Scam intervention outcomesHolds placed, share who proceed after warnings, dollars recalledMeasures whether scam friction works, beyond detection alone
Senior protection coverageTrusted contact coverage and Rule 2165 hold outcomesFINRA examines both
Good-customer frictionWithdrawal hold rate, false positives, complaintsSee Friction and Customer Experience Tradeoffs

General definitions live in Fraud Metrics and KPIs. Label maturity for ATO and scams is long, so see Fraud Labeling and Feedback Loops.

How fraud teams are typically organized here

Most broker-dealers grew fraud out of a FINRA-mandated AML program, so fraud often sits inside financial crimes compliance. That gives good SAR discipline. The risk is a team measured on filings rather than on prevented loss. A common mid-size shape:

  • Account security / identity, usually in security engineering: login, MFA, recovery, device trust.
  • Fraud strategy and analytics: rules, models, instant-funding limits, money movement scoring.
  • Operations queues: new accounts, money movement review, ACATS and transfers, and a senior investor desk. FINRA cites dedicated specialists as an effective practice.
  • AML investigations and SAR filing.
  • Trade surveillance, a separate compliance function, whose overlap with fraud is ramp-and-dump.

Most losses happen at the seams between these teams. Security sees the phishing login, money movement sees the new bank link, and surveillance sees the odd buy in a thin stock, all on the same account. Introducing brokers add another seam because the clearing firm owns some controls. FINRA's compromised-account checklist includes notifying the clearing firm. Design notes: Fraud Operating Model, Three Lines of Defense, Cross-Functional Partnerships, Alert Review Operations, Fraud QA Program, Support Team Fraud Training.

Industry-specific signals and controls

Signals that matter more here than elsewhere

  • Trading Pattern Signals: liquidation of long-held, diversified positions followed by a concentrated buy in a thin security. Options bought far above recent prints from one counterparty. First-ever crypto purchase sized to the whole balance.
  • Account Change Events: email, phone or bank changes shortly before outbound movement (FINRA's core ATO red flag).
  • Identity Element Consistency and Entity Link Analysis: phone numbers, addresses, emails or bank details repeated across applications with different names. Clusters of accounts with shared opening dates, IPs and funding amounts (FINRA 23-06 and 22-25).
  • Funding Source Signals: a new bank link and immediate trading on instant funds. Funding from third parties.
  • Scam Victim Indicators and Customer Contact Signals: early CD-style liquidations, questions about wire limits, a third party on the call, transfers labeled "taxes" or "fees" (FinCEN's pig-butchering red flags).
  • Payee and Counterparty Risk: receiving-firm concentration for ACATS out, and destination banks for wires.

Controls with a brokerage-specific shape

  • Passkeys and Phishing-Resistant Authentication for login and for high-risk actions. Japan's 2025 wave is the clearest public example of why.

  • Withdrawal and Payout Controls: cooling-off on newly linked banks and on changed contact details. Confirmation calls to established numbers.

  • Trading restrictions on accounts with active compromise indicators, plus a fast path to unwind manipulative positions.

  • Instant-buying-power tiers by tenure and funding history (Velocity and Exposure Limits, Funds Availability Holds).

  • Customer notification of ACATS transfer requests, and obtaining the latest statement before submitting inbound ACATS (FINRA 23-06).

  • Trusted Contact and Senior Investor Holds, with documented training and hold rationale.

  • Consortium and Data Sharing: 314(b) sharing and industry information networks. FINRA explicitly encourages joining them.

  • Can a newly linked bank receive a withdrawal the same day?

  • Does a password or contact change restrict trading as well as withdrawals?

  • Is the instant-funding limit owned by someone with a loss budget?

  • Is there a playbook for an outbound ACATS to a receiving firm you've seen in prior fraud?

Members: Playbook - Account Takeover Members, Playbook - Ramp-and-Dump Members, Playbook - ACATS Transfer Fraud Members, Playbook - Instant Funding Abuse Members, Playbook - Scam Intervention Members, Playbook - Elder Exploitation Response Members.

Notable public cases

  • Case Study - Japan Brokerage Account Takeovers (2025): phishing and infostealer ATOs at Japanese online brokers. The FSA's current full-year 2025 data counts 9,861 unauthorized trades, with about ¥395B in sales and ¥347B in purchases (trading totals rather than customer losses). The widely cited mid-2025 figures (7,139 transactions, ¥571B) were interim and appear to combine sales and purchases. Sixteen firms were affected by the end of May 2025. Outcomes: case-by-case partial compensation agreed by ten major firms in May 2025 (SBI and Matsui disclosed a flat 50%), and mandatory phishing-resistant MFA by the end of June 2026.
  • Case Study - Robinhood Infinite Leverage Glitch (2019): a buying-power calculation flaw exploited by retail users. It shows that Business Logic Exploitation in margin math is a fraud-team problem.
  • Case Study - Prince Group Pig Butchering Enforcement (2025): the industrial scam operations behind many investment-scam liquidations that brokerages see.
  • FINRA's ACATS alerts (Regulatory Notices 22-21 and 23-06): public descriptions of the stolen-identity, transfer and liquidation pattern.
  • FINRA Regulatory Notice 20-32: options "profiting account" schemes using ATO'd and fraudulently opened accounts.
  • Adjacent: Case Study - FTX Theft via SIM Swap (2022) for crypto custody, and Case Study - DraftKings Credential Stuffing (2022) for stuffing leading to withdrawals on a stored-value platform.

Sources and further reading