The Outlier Lab

Ramp-and-Dump via Account Takeover

Hijacked brokerage accounts are liquidated and forced to buy a thin stock the attackers already hold, so they can sell into that demand before it collapses.

What it is

The usual Account Takeover (ATO) playbook at a brokerage tries to get value out: change the bank link, liquidate, withdraw (Payout Redirection). Ramp-and-dump turns that around. The compromised account is used as a buyer. The theft is realized on the other side of the trade, by accounts that hold the target security and sell at prices the victims' orders pushed up.

Because of that inversion, every control built around the exit, including Withdrawal and Payout Controls, Bank Account Ownership Verification and payout-change holds, sees nothing: no new payee, no withdrawal, no destination change. The loss shows up as a trade. In many firms trades are reviewed by surveillance on T+1 rather than scored in real time by fraud.

It sits next to two related mechanisms:

  • Social-media ramp-and-dump ("investment clubs"). Victims are coached to buy the target in their own accounts. This is an authorized scam, covered under Investment Scams (Pig Butchering). The FBI reported at least a 300% increase in ramp-and-dump complaints in 2025 compared with 2024.
  • Market-abuse surveillance (out of scope for this vault). This note covers the parts that end up in a fraud team's queue: the account compromise, the trading-pattern anomaly, and the cross-account clustering.

In practice the variants are layered on the same issuers. FINRA's 2026 oversight report lists ATO as a new trend alongside nominee accounts, funneling of shares to foreign omnibus accounts, and investment-club scams. The attackers use every source of demand they can get.

How it works

At a conceptual level there are five stages:

  1. Position. The controlling group accumulates a large share of a low-float security. FINRA describes nominee accounts funded and controlled centrally, shares funneled to foreign omnibus accounts, and large post-IPO private placements.
  2. Harvest access. The group collects credentials and sessions at scale, through phishing sites that impersonate brokers (Phishing and Credential Harvesting), infostealer logs (Session Hijacking and Infostealers), and remote-access malware.
  3. Ramp. Existing holdings in the compromised accounts are sold, and the cash buys the target in a short, concentrated window.
  4. Dump. The controlled accounts sell into those orders.
  5. Exit. Proceeds leave from the attacker-side accounts, often at a different firm or in a different country. Victims are left holding shares that typically fall most of the way to zero.
Diagram: Accumulate low-float shares (nominee or offshore accounts), Harvest brokerage credentials and sessions, Sell victims' existing holdings, Victim cash buys target stock, Attacker accounts sell into the demand, Proceeds wired out from attacker side, Victims hold collapsed position

Transaction footprint

StageWhat you see in the dataDecision point
AccessNew device, IP, ASN or geography at login; sometimes a reset or MFA change. With a stolen session token there may be no login event at allLogin risk scoring and Risk-Based Authentication and Step-Up; phishing-resistant authentication
Pre-tradeChanges to contact, notification or security settings; new trading permissions requestedTreat trading-relevant changes like payout changes, with Contact Change Cooling-Off Periods
LiquidationA long-held, diversified portfolio sold in a single session, often with market ordersReal-time scoring of sells as well as withdrawals; step-up before large liquidations
Target buyPurchase of a low-priced, low-float, often foreign-domiciled issuer the customer has never traded, using most of the available buying powerSymbol-level risk list; block or step up on first-time purchases of flagged symbols
Cross-accountThe same symbol bought by many unrelated accounts within minutes, from overlapping infrastructureFirm-wide symbol restriction; cluster review in Graph Analytics
Price actionAbnormal volume and price moves where your firm's retail flow is an outsized shareEscalate to surveillance; report to FINRA and peers
Aftermath"I didn't place these trades" contacts clustered on one symbol; reimbursement claimsIncident response, customer remediation, label capture

Scale and timing. Japan's FSA reported that, by mid-April 2025, 12 securities firms had seen about 1,454 fraudulent transactions: roughly $350M of unauthorized sales and $315M of unauthorized purchases. Attackers sold victims' stocks and bought Chinese stocks that stayed in the victims' accounts. April 2025 was initially reported at 2,746 unauthorized trades across about 5,000 accounts, close to $2B in sales and purchases combined; the FSA's revised data now puts April at 3,033 trades, and the full year 2025 at 9,861 trades with about ¥395B in sales and ¥347B in purchases (trading totals, not customer losses). The pattern runs at scale, over days, and across many firms at once.

Bank-side view. The FDIC OIG tells banks to watch for rapid, out-of-pattern transfers into brokerage accounts (the investment-club victims funding purchases), and for large deposits from many individuals followed by rapid transfers to another institution or jurisdiction (the dump side cashing out).

Common variants

VariantWhat's differentWhere it shows up
Hijacked existing accountsVictims never traded; the loss shows up as an unauthorized-trade claimSelf-directed retail brokers; the Japan 2025 wave
Pre-staged or nominee accountsAccounts opened with real or synthetic identities, funded centrally, used to buy at IPO and sell laterSmall-cap IPO distribution chains; FINRA's 2026 findings
Investment-club steeringVictims place the trades themselves after social-media groomingUS retail; see Investment Scams (Pig Butchering)
Hybrid "advisor access"Victim hands a "mentor" credentials or screen access, so authorized and unauthorized blurAny broker; Remote Access Tool Detection matters
Cross-marketAccounts compromised in one market buy securities listed in anotherJapanese accounts buying Hong Kong and China-linked small caps (2025)

Where it shows up

  • Brokerage and Investing: the primary venue. Exposure is highest where instant buying power, mobile-first trading and weak authentication coincide.
  • Neobanks and Consumer Fintech: embedded investing carries the same exposure, and these firms also hold the bank side, so they can see funding and proceeds.
  • Payments and P2P and banks: investment-club victims fund their purchases, and dump proceeds exit by wire.
  • Retail and rewards analogs: the core move is using stolen accounts as forced buyers of something the attacker sells. It has analogs elsewhere. Stolen marketplace accounts can buy from colluding sellers (Triangulation Fraud, Fraud Rings and Collusion), and stolen loyalty balances can be redeemed with a colluding merchant (Loyalty and Rewards Redemption Fraud). The same detection approach applies there: watch counterparty and item concentration across accounts as well as behavior within each one.

Impact

  • Customers: forced liquidation (taxable events, lost positions) and a collapsed holding. In Japan, ten major brokerages agreed through the JSDA in May 2025 to compensate victims case by case, regardless of their terms of service; SBI and Matsui disclosed a flat 50%, and others set amounts by circumstances. Either way, a fraud event became a direct P&L hit.
  • Firms: reimbursement, trade-correction costs, regulatory exposure under identity-theft and customer-protection obligations (Broker-Dealer Obligations (FINRA and SEC)), and attrition.
  • Market-wide: a House Financial Services ranking-member letter (July 2026) cites one industry estimate of about $15B in 2025 retail losses to ramp-and-dump schemes. It also says schemes targeting at least four China-based Nasdaq issuers in July 2025 cost US investors at least $3.7B, with those stocks falling 80–93%. Treat these as third-party estimates.
  • Regulatory momentum: the SEC formed a Cross-Border Task Force on September 5, 2025, focused partly on pump-and-dump and ramp-and-dump schemes involving foreign issuers. The SEC suspended trading in 14 Asia-based issuers between September 2025 and February 2026. In May 2026 it approved Nasdaq Rule 5210(l), which requires China-based IPOs to raise at least $25M. The approval cited data that about 70% of Nasdaq's manipulation-related referrals from August 2022 to April 2025 involved Chinese companies, which made up under 10% of listings.

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventPasskeys and Phishing-Resistant AuthenticationRemoves the main access vector (phished credentials and OTPs)
PreventRisk-Based Authentication and Step-Up at the trade as well as the loginCatches stolen sessions that never log in
PreventVelocity and Exposure Limits on flagged symbolsCaps how much buying power can be pointed at a manipulated issuer
DetectReal-Time Transaction Risk Scoring for liquidations and first-time thin-symbol buysMoves the decision before the order executes
DetectGraph Analytics across accounts buying the same symbolTurns many small anomalies into one obvious cluster
RespondFirm-wide symbol restriction, account lock, Fraud Incident ResponseStops the bleed across the whole book within minutes
RespondConsortium and Data Sharing and regulator reportingThe same issuer is usually being ramped through several firms at once

Emerging variants and adversary adaptation

  • Crews pivot to whatever monetization is least defended. KrebsOnSecurity (August 2025) reported that phishing operations previously focused on loading stolen cards into mobile wallets (Digital Wallet Provisioning Fraud) moved toward brokerage accounts after banks tightened wallet-enrollment checks. Expect access-harvesting groups to keep re-pointing the same credential supply at whichever transaction type pays best.
  • Timing has shifted away from the IPO. FINRA says suspected pumps now happen less often at the IPO and more often months later, and the same issuer is often hit repeatedly. Watchlists keyed only to recent IPOs will miss them.
  • Session theft undercuts login controls. As firms adopt stronger login authentication, infostealer-harvested session tokens let attackers skip the login entirely. That pushes the control point to the trade itself.
  • The issuer pool is being squeezed. Nasdaq's new listing rule, SEC suspensions and the Cross-Border Task Force raise the cost of the current issuer supply. Expect migration to other venues and jurisdictions, other low-liquidity instruments, and markets with weaker authentication.
  • Concentration rules will be diluted against. When firms add per-account or per-symbol concentration checks, expect buying to spread more thinly across accounts and time. That argues for cross-account and cross-firm views over per-account thresholds.
  • Regulators now mandate the login fix. After Japan's 2025 wave, the FSA amended its supervisory guidelines on October 15, 2025 to require phishing-resistant MFA at securities firms, due in principle by the end of June 2026. At a November 2025 meeting with the Japan Securities Dealers Association, the FSA asked firms to move faster, citing a rise in affected firms and incidents from September. It also placed responsibility for these measures on management. We didn't find a primary-source count of how many firms had made MFA mandatory, so treat the figures circulating in secondary coverage as unconfirmed. See Case Study - Japan Brokerage Account Takeovers (2025).

Real-world examples

  • Japan, 2025: a phishing-driven ATO wave across many online brokers. See Case Study - Japan Brokerage Account Takeovers (2025).
  • US, March 2025: federal authorities in Chicago seized about $214M and indicted seven people over alleged manipulation of a Cayman-incorporated, China-focused issuer. Individuals posing as US investment advisors on social media and messaging apps allegedly drove the demand. This is the investment-club variant on the same kind of issuer.
  • US, December 2025: the SEC suspended trading in a Singapore-headquartered Nasdaq issuer. It cited social-media recommendations from unknown persons who asked recipients to send screenshots of their trades.
  • Case Study - SDNY Ramp-and-Dump Forfeitures (2025-2026): a compromised advisor login attempted $22.9M in buys that the broker canceled; SDNY seized $19.5M in proceeds

Sources and further reading