The Outlier Lab

Trading Pattern Signals

Order and position behavior in brokerage accounts (liquidations, illiquid security purchases, coordinated orders, liquidation-to-withdrawal sequences) that reveals account takeover, ramp-and-dump and cash-out.

What it measures

In a brokerage, value can leave in two ways: as cash (sell, then withdraw) or as price (use the victim's money to buy a security the attacker is selling). Trading signals cover both.

Feature familyExamples
LiquidationShare of portfolio sold in one session; sale of long-held positions the customer never trades; sale across many positions at market orders; selling at a loss with no apparent reason
Illiquid purchasesBuys in low-float, low-price or recently listed securities; order size relative to the security's average daily volume; first-ever trade in that market segment for this customer; market or aggressive limit orders that move the price
CoordinationMany unrelated accounts buying the same thin security within a short window; layered limit orders above the prevailing price; odd-lot orders at similar times; concentration of your customers in a small share of total market volume
Behavioral mismatchTrading inconsistent with age, stated objectives, experience or source of funds (from account-opening data); first options or margin activity
SequenceLogin anomaly → liquidation → illiquid buy; or liquidation → bank link change → withdrawal; or ACH deposit → instant buying power → trade → withdrawal before settlement
OutcomeImmediate unrealized losses on the bought position as price collapses; complaint or dispute shortly after

Why it matters

Brokerage ATO monetization has two dominant paths, and each needs a different signal:

Diagram: Account compromised, Sell existing holdings, Monetization path, Change bank link or payout, Withdraw proceeds, Buy thin security attacker holds, Attacker sells into the inflated price
  • Cash-out path: liquidation followed by a withdrawal to a new destination. Combining trading signals with Account Change Events and Fast In Fast Out Patterns catches it.
  • Ramp-and-dump path: the attacker never withdraws. The victim's own account buys the attacker's position at inflated prices, so withdrawal controls never fire. FINRA's 2026 Annual Regulatory Oversight Report describes this as a new trend: bad actors take over a victim's account, sell legitimate holdings and use the proceeds to buy targeted small-cap securities. FinCEN saw the same pattern years earlier. Its analysis of identity theft SARs from securities firms found that between late 2006 and early 2008, 20–40% of quarterly filings reported attempts to use stolen funds to manipulate thinly traded securities.

The broader small-cap manipulation context matters for interpreting signals. FINRA's Regulatory Notice 22-25 (November 2022) flagged ramp-and-dump schemes in small-cap IPOs, with red flags including multiple accounts placing layered buy limit orders at similar times above the IPO price (often in odd lots), centrally controlled nominee accounts sharing opening dates, contact details, bank information and IP addresses, and trading inconsistent with the customer's profile. FINRA's 2026 report notes schemes increasingly occur months after IPO rather than at listing, and that social-media "investment club" scams coordinate victims' limit orders while foreign-controlled accounts sell. SAR filings tagged securities/futures/options rose 14.3% in 2025, per an EPCOR summary of FinCEN data.

The same signal family covers other brokerage loss paths: instant buying power on unsettled deposits (Instant Funding Abuse (Kiting)); logic flaws in buying-power or options calculations (Business Logic Exploitation, Case Study - Robinhood Infinite Leverage Glitch (2019)); and scam victims liquidating portfolios to fund "investments" elsewhere (Investment Scams (Pig Butchering)).

How to collect it

  • Order and execution events, alongside positions, with session, device and channel. Order entry is where pre-trade controls can act.
  • Market data: average daily volume, float, price, listing date, spreads, and halts for each security, refreshed intraday. Thinness is relative; static lists of "risky tickers" go stale within days.
  • Customer profile data from account opening and suitability records: age, objectives, experience, income/net worth bands, source of funds.
  • Cross-account aggregation: per security, the set of your accounts buying it in a window, their share of market volume, and their linkage (Entity Link Analysis).
  • Build vs. buy: market surveillance platforms exist but are tuned for market abuse by the account holder; ATO-driven trading needs your session, device and change-event data joined to orders, which is usually built in-house. Market data is bought.

How to use it

  • Score pre-trade for high-risk combinations, such as an anomalous session plus a first-ever thin-security buy plus size large relative to ADV. Responses include step-up authentication on the order, soft blocks requiring confirmation, and temporary trading restrictions in specific securities. FINRA Rule 2165 permits temporary holds on securities transactions (not just disbursements) for specified adults when exploitation is reasonably suspected.
  • Run a cross-account sentinel that alerts when several unrelated accounts buy the same thin security within minutes, especially after anomalous logins. It often means a wave of compromised accounts is being used in one pump. The response may include restricting purchases of that security platform-wide while you investigate.
  • When a large liquidation is followed by a destination change or a withdrawal request, hold the withdrawal for verification (Withdrawal and Payout Controls).
  • Trading inconsistent with stated objectives and experience supports Elder Financial Exploitation and nominee-account detection. Route it to review, with trusted contact outreach where appropriate.
  • Settle remediation in advance: who can bust or reverse trades (generally limited and venue-dependent), how losses are attributed, and when to file SARs (Playbook - Ramp-and-Dump Members, Broker-Dealer Obligations (FINRA and SEC)).

Strengths and limitations

Strengths: catches the ramp-and-dump path that bypasses withdrawal controls; strong cross-account signal during coordinated waves; profile data adds context no other industry has.

Limitations: pre-trade latency budgets are tight; illiquidity thresholds need constant recalibration; per-account trading signals can be degraded by adaptive attackers, though cross-account aggregation and session signals compensate. Once a trade executes, recovery is difficult; prevention at order entry or before the session reaches the order ticket is far more valuable than post-trade detection.

False positives and fairness

  • Active and speculative retail traders who legitimately trade small caps, momentum names and meme stocks, often in herds after social-media attention. Their orders look coordinated but are placed independently.
  • Customers rebalancing or liquidating for life events (house purchase, retirement, divorce, tax bills).
  • Inexperienced new investors whose first trades look "out of profile" because there is no profile.
  • Older investors making their own risky decisions; autonomy matters, and holds should follow rule-based process and documentation.

Privacy and compliance considerations

Broker-dealers must run a written identity theft prevention program under Reg S-ID; trading-based ATO red flags belong in it. Trusted contact (Rule 4512) and temporary hold (Rule 2165) rules govern senior investor interventions, including notification within two business days and defined hold durations. Trading restrictions must be applied consistently and documented. SAR obligations apply to suspected manipulation and ATO. See Broker-Dealer Obligations (FINRA and SEC) and BSA-AML and SAR Filing.

Mechanisms it helps detect

Ramp-and-Dump via Account Takeover · Account Takeover (ATO) · ACATS Transfer Fraud · Instant Funding Abuse (Kiting) · Investment Scams (Pig Butchering) · Elder Financial Exploitation · Fraud Rings and Collusion · Business Logic Exploitation

Login Anomalies · Account Change Events · Fast In Fast Out Patterns · Transaction Pattern Anomalies · Entity Link Analysis · Funding Source Signals · Real-Time Transaction Risk Scoring · Withdrawal and Payout Controls · Trusted Contact and Senior Investor Holds · Playbook - Ramp-and-Dump Members · Playbook - ACATS Transfer Fraud Members · Brokerage and Investing · Case Study - Japan Brokerage Account Takeovers (2025)

Sources and further reading