The Anatomy of a Coordinated Pump: A Forensic Case Study

Most analyses of pump-and-dump fraud describe the scheme in abstract terms: insiders buy low, promote publicly, sell high, retail investors lose. The abstraction misses the operational precision of a modern coordinated pump. These are not improvised cons. They run on documented playbooks, specific timing sequences, and measurable metrics.

The operators know their costs, their projected returns, and their exit windows before the first promotional message is broadcast. This case study reconstructs the complete lifecycle of a coordinated pump operation, drawing from documented SEC enforcement actions and FINRA investigation records. The company, ticker, and operator names are composite — no single real entity is represented. The operational pattern is not.

Phase 0: Target Selection

The operation does not begin with promotion. It begins with screening. An operator — in this case, an individual with two prior securities fraud settlements and an offshore corporate structure in Belize — identifies target stocks using a specific filter set. The target must have:

1. A public float under 5 million shares

2. A share price under $3.00 (limiting required capital for accumulation)

3. Average daily volume under 100,000 shares (ensuring price sensitivity to coordinated buying)

4. No recent SEC enforcement action naming the company

5. An active SEC registration (OTC or small-cap listed) — the company must be legally tradeable

6. A business with a narrative hook that can be packaged as an investment thesis

The narrative hook matters more than the business. The company need not have real revenue, customers, or operating history — it needs a story that promotional copy can build around. In documented cases, these stories cluster around emerging technology (AI applications, blockchain integration, EV components) or resource discovery (mining claims, oil exploration, cannabis licensing).

The operator identifies 12 candidate companies. Three are eliminated because insiders have recently filed Form 4 selling disclosures (insider distribution is already occurring — the pump would conflict with ongoing insider exit). Two are eliminated because their most recent 10-Q shows auditor going concern qualifications that would generate negative press coverage.

Seven remain. The operator selects the candidate with the most controllable share structure: a company where a single entity controls 72% of shares outstanding, keeping the effective float at approximately 3.2 million shares. This screening process takes two weeks. It generates no visible market activity.

Phase 1: Accumulation

The operator begins acquiring shares in the target company. The accumulation strategy is designed to avoid two outcomes: triggering FINRA's surveillance algorithms with unusual volume, and moving the stock price enough to attract attention before the promotion is ready. Daily purchases are capped at 8,000-12,000 shares — between 8% and 12% of the stock's average daily volume.

At this level, the additional buying blends into normal trading noise. The stock's price drifts up 12% over the accumulation period, consistent with the minor variation that occurs in thinly traded securities without any particular catalyst. Accumulation occurs through multiple brokerage accounts across three jurisdictions, funded through an offshore entity. This structure complicates regulatory tracing but leaves a paper trail that investigators eventually reconstruct from international account records.

After 23 trading days, the operator holds 1.4 million shares — approximately 44% of the company's public float — at an average cost of $0.94 per share. Total capital deployed: $1,316,000. The position cannot be easily liquidated without dramatically depressing the price. The operator is now committed to executing the pump.

Phase 2: Promotion Infrastructure Setup

Six weeks before the planned broadcast date, the operator commissions the promotion infrastructure. This requires:

Email list acquisition: 1.2 million addresses from a data broker, segmented for "financial interest" indicators. The broker provides a delivery guarantee of 85% inbox rate. Cost: $14,000.

Telegram channel preparation: An existing Telegram channel with 48,000 subscribers (purchased five months earlier at $0.08 per subscriber) is primed. The channel has been posting legitimate-looking stock analysis for four months to establish credibility. Its "track record" includes three picks that happened to perform reasonably — the operator monitored the channel's picks and retroactively claimed credit for stocks that moved for unrelated reasons.

Stock promotion newsletter: A contract with a registered investment newsletter operator (an entity that discloses its paid promotion status in 6-point grey text at the bottom of every email). The newsletter reaches 180,000 opted-in subscribers. The compensation: $85,000 in cash plus 100,000 warrants exercisable at the current stock price. This is disclosed — technically. Almost no recipient reads the fine-print disclosure.

Social media account network: Twelve Twitter/X accounts ranging from 8,000 to 22,000 followers each, all with purchased follower bases. Accounts have been posting general financial content for three months. Promotional content will appear coordinated but is timed to post within a 15-minute window.

Paid press release service: A wire service that distributes releases labeled as news stories to thousands of financial websites simultaneously. The release, written to resemble a news article, describes the target company's "breakthrough technology" and quotes a "financial analyst" who does not exist under their provided name. Cost: $4,500. Total promotion infrastructure cost: approximately $115,000.

Phase 3: The Broadcast

The operator selects a Tuesday in late Q3 — historically a day with lighter institutional trading volume in the target's market cap range, maximizing the price impact of retail buying.

Sunday, 7:00 PM ET: The paid newsletter sends its broadcast to 180,000 subscribers. Subject line: "The $3 Stock Our Analysts Believe Could Reach $12 Before Year-End." The fine-print disclosure at the bottom reads: "We received $85,000 for this feature. We may hold warrants. This is not investment advice." Above the fold: a four-paragraph promotional piece describing the company's technology as "positioned to capture a market worth $4.7 billion." No sources for the $4.7 billion figure are provided. The company's most recent 10-Q shows $12,000 in quarterly revenue.

Monday, 6:00 AM ET: The Telegram channel posts: "🚨 ALERT: $TICKER — This is the one I've been waiting to release. 72-hour window. Do your own research. Buying at open." The post receives 847 views in the first hour. The channel's linked group chat fills with positive comments from accounts that also belong to the promotional network.

Monday, 8:45 AM ET: The press release hits the wire. Twenty-seven financial news aggregation sites publish it automatically. Three are significant enough to generate StockTwits mentions. The headline: "NanoX Techologies Announces Partnership Discussion with Regional Utility Provider." Note "partnership discussion" — the word "discussion" is doing legal work, reducing the claim to a level that is technically not false even if the "discussion" is a single email.

Monday, 8:58 AM ET — Two minutes before open: The twelve coordinated Twitter/X accounts post simultaneously. Slight variation in language but identical in structure: "$TICKER breaking out. Float is tiny. First target $2.50. Already in." The coordinated timing triggers the algorithm to surface the posts to users who follow any of the twelve accounts.

Monday, 9:30 AM ET: Market opens. The stock opens at $1.18 versus its $0.94 Friday close — a 26% gap driven up by pre-market activity. Volume in the first minute: 280,000 shares — more than the stock typically trades in three days.

Phase 4: The Pump

The next 90 minutes produce the scheme's most visible artifact.

9:30 to 9:45 AM: Price reaches $1.62. Volume is 1.1 million shares. Retail buyers from the newsletter and Telegram are executing market orders, driving the price higher with each wave. The operator's 1.4 million shares represent 44% of the float; as retail buyers exhaust available supply from market makers and other sellers, the price spikes rapidly.

9:45 to 10:15 AM: Price reaches $2.31. Volume exceeds 2.4 million shares — 24x the stock's average daily volume. StockTwits is now filled with organic posts from retail traders who identified the momentum independently and are buying without any connection to the promotional network. This organic FOMO layer is where the scheme becomes most dangerous: genuine traders chasing momentum legitimize the price move in public discussion, attracting additional buyers who interpret the StockTwits activity as validation.

10:15 AM: The operator begins selling. The position is liquidated in 11-minute increments across the multiple accounts to avoid generating a single large sell order that would collapse the bid. Each sell tranche executes at slightly lower prices as it absorbs buying interest. The total distribution takes 47 minutes.

11:02 AM: The operator's position is fully liquidated. Average sale price: $2.04. Total proceeds: $2,856,000. Total cost of shares: $1,316,000. Gross trading profit: $1,540,000. Minus promotion costs of $115,000: net profit of approximately $1,425,000.

Phase 5: The Collapse

The operator's exit removes the largest single source of buying coordination from the market. Retail buyers who purchased at the peak are now the primary holders. The stock has no fundamental support for its elevated price — the "partnership discussion" mentioned in the press release generates no follow-up 8-K, because no partnership materializes. The newsletter and Telegram channel go quiet on the ticker.

11:00 AM to 12:30 PM: Price declines from $2.04 to $1.31 on declining volume. Buyers who purchased at $2.00-$2.30 begin selling to limit losses. This selling accelerates the decline.

Days 2 through 5: Price retraces fully to $0.87 — 7% below the pre-promotion closing price. Volume collapses to below average levels as retail interest dissipates. No follow-up news from the company appears. The "partnership discussion" is never mentioned again in any filing.

60-day mark: Price is $0.72. Retail participants who purchased at peak prices during the pump have lost between 55% and 70% of their investment.

Phase 6: The Regulatory Aftermath

FINRA's Market Regulation surveillance flagged the volume anomaly on the pump day within 90 minutes of market open. An automated alert was generated. A human reviewer confirmed the volume was anomalous and initiated a preliminary review. The SEC's Market Abuse Unit received a referral 11 days after the event. Investigators subpoenaed Twitter records for the twelve accounts involved in the coordinated post, the Telegram channel's registered account information, and the newsletter operator's compensation records. The newsletter operator's disclosure — though technically compliant — was flagged as misleading because the fine-print location and font size prevented most recipients from identifying it as a paid promotion.

The warrants provided as compensation were not disclosed with their full economic value. The offshore account structure delayed the investigation by 14 months. International cooperation through IOSCO's Multilateral Memorandum of Understanding eventually allowed investigators to identify the operator through their offshore brokerage accounts.

Charges filed 18 months after the event: securities fraud, market manipulation, and failure to comply with disclosure requirements. The operator agreed to a settlement requiring disgorgement of $1,425,000, a civil penalty of $712,500, and a five-year bar from acting as an officer or director of a public company. Criminal referral was made but not prosecuted — the margin between civil settlement and criminal prosecution in market manipulation cases frequently falls on the question of documented intent.

The 2,000 retail investors who purchased at elevated prices received no recovery from the civil settlement. Disgorgement goes to the SEC's Fair Fund, which may distribute to investors — but the distribution process takes years, and many investors do not file claims.

The Pattern's Diagnostic Fingerprints

Every phase of this operation left detectable traces. Reconstructed in sequence, they form a recognizable pattern:

Before the pump:

1. 23 days of slightly elevated volume without a catalyst (accumulation signature)

2. No company news or 8-K filings during accumulation period

3. Float structure with one dominant controlling shareholder

At the pump:

1. Multi-channel promotional burst (email, Telegram, Twitter, press release) within a 12-hour window

2. Opening price gap significantly above prior close

3. Volume exceeding 10x average daily volume in first 30 minutes

4. Press release language using hedged, technically-deniable claims ("discussion," "exploring," "potential")

After the pump:

1. Full price retracement within 5 trading days

2. No follow-up company announcements validating the promoted catalyst

3. Promotional accounts go silent on the ticker

4. Continued promotion of a new ticker in the same channels within 2-4 weeks

Frequently Asked Questions About Coordinated Pump Operations

How do operators avoid triggering FINRA surveillance during accumulation?

By keeping daily purchase volumes below the threshold that generates anomaly flags — typically below 10-15% of average daily volume. Spreading purchases across multiple accounts and jurisdictions adds complexity that delays correlation analysis. The accumulation phase is the most technically careful part of the operation; the broadcast phase generates unavoidable anomalies that surveillance systems catch, but the operator is already exiting by then.

Why do retail traders continue buying into pumps that are already moving sharply?

Momentum trading is a legitimate strategy in normal market conditions: stocks often continue moving in the direction of initial momentum when driven by genuine catalysts. Pump-and-dump operations exploit this rational behavior by manufacturing the appearance of a momentum catalyst. The retail trader's error is not irrational — it is the application of a reasonable heuristic in a context where the momentum is manufactured.

What happens to operators who are caught?

Civil enforcement results in disgorgement of profits, civil penalties, and industry bars. Criminal prosecution requires evidence of intent to defraud, which investigators must establish through communications, account records, and the timing sequence of trades relative to promotional activity. Many operators settle civil cases without admitting wrongdoing. Criminal prosecution resulting in prison time occurs in cases with documented fraudulent intent evidence — usually internal communications or cooperating witnesses.

Can the same operators run multiple pumps?

Yes, and documented cases consistently show that caught operators ran 3-12 separate schemes over multi-year periods before prosecution. The five-year bar from serving as an officer or director, which appears in many civil settlements, does not prevent an individual from directing a manipulation scheme through nominees.

What is the typical return profile for retail investors in pumped stocks?

SEC enforcement complaints consistently document that retail investors who purchased at or near the peak of a coordinated pump — the most common entry point for unsolicited-tip recipients — suffer losses exceeding 50% of their invested capital within 30 days as the price fully retraces. Investors who purchased during accumulation — before the broadcast — sometimes saw gains if they sold during the pump, but the majority held through the collapse. -

The Operational Reality

The scheme described in this case study required less than $1.5 million in capital, $115,000 in promotion costs, and approximately six weeks of preparation. It generated a net profit of $1.425 million in a single morning. The 2,000 retail investors who provided that profit received no advance warning, no disclosure of the operator's position, and no restitution beyond a theoretical claim in an SEC Fair Fund that may take years to process.

This is not an exceptional scheme. It is a representative one. FINRA's 2025 Annual Regulatory Oversight Report confirms that pump-and-dump schemes continue to operate continuously across U.S. equity markets — with the agency flagging their persistence and evolution as an ongoing supervisory priority — with the majority too small to generate prosecution-level evidence and too fast-moving for real-time regulatory intervention.

The regulatory system responds after the fact. The only defense that operates before the fact is investor recognition of the pattern before the buying pressure begins. Every element of this scheme — the volume accumulation pattern, the multi-channel broadcast timing, the float structure, the press release language, the coordinated social media posts — was detectable using publicly available information.

EDGAR filings showed the float. BrokerCheck showed the newsletter operator's registration status (which was compliant, technically). The Twitter accounts' creation dates and engagement ratios were visible to anyone who checked. The operator's competitive advantage was not information asymmetry. It was attention asymmetry. The operator studied the company carefully before acting. Most victims did not look at it at all.