Capital Fraud Prevention: What securities fraud looks like and Where controls miss it

In 2025, people in the United States reported losing $1.1 billion to investment scams that started on social media, more than half of everything lost to social media fraud that year, according to Federal Trade Commission data published in April 2026.

Nearly all of it passed through a broking, exchange, or trading account that a real person opened, funded, and operated. Most teams treat capital fraud prevention as a surveillance problem, as though the answer sits in the order book. The order book is where a scheme becomes visible, but it’s the account where the fraud actually starts.

What is securities fraud?

Securities fraud is deception connected to the purchase or sale of a financial instrument, committed to win an advantage the market has not yet reflected in the price. Order manipulation, misstated filings, and fake offerings all sit inside that definition, and they are so unalike that firms rarely treat them as one risk category, which is where controls start to slip.

Four broad categories account for most of it:

1. Market manipulation: Trading or messaging designed to move a price away from what genuine supply and demand would produce.
2. Insider dealing: Trading on material non-public information before the market can price it.
3. Disclosure fraud: False, incomplete, or misleading statements about a company’s financial position or prospects.
4. Investment scams: Offerings fabricated outright, where no genuine instrument or return exists behind the pitch.

Manipulation and insider dealing are offences against the market because they distort the price everyone else trades on. Disclosure fraud and investment scams are offences against identifiable investors, who hand over money on the strength of something untrue. 

A pump and dump scheme is both at once, since it inflates a price and takes money from the people who buy at the top. Surveillance owns the first half, fraud and complaints own the second, and the scheme spanning them rarely gets read as one case.

What is market manipulation, and how do the schemes work?

Market manipulation is conduct that creates a false impression of the supply, demand, or price of a financial instrument. The mechanics differ across schemes, yet they share one operational requirement. Each of these techniques needs several accounts that appear unconnected to one another and to whoever is controlling or manipulating the trades.

Pump and dump

A pump and dump scheme accumulates a position in a thinly traded stock, promotes it through coordinated messaging until retail buying lifts the price, then sells into that demand. The promotion is usually run through social media and messaging groups rather than cold calls. Once the organisers exit, the price collapses, and the late buyers are left to absorb the loss.

Spoofing and layering

Spoofing means entering large orders with no intention of executing them, then cancelling once the visible imbalance has nudged the price. Layering stacks several such orders at different price levels so the pressure looks deeper than it is. Both leave a clear signature in the order book, namely high order-to-trade ratios and rapid cancellations, and both work better when the flow is spread across accounts.

Wash trading and circular trading

Wash trading means buying and selling the same instrument with no change in beneficial ownership, to create volume where none exists. Circular trading extends the same idea across a group of colluding parties who pass a position between them. Both create an appearance of liquidity that attracts genuine buyers.

What is trade surveillance, and what does it not see?

Trade surveillance is the monitoring of orders and transactions for patterns that suggest insider dealing or market manipulation. In Europe, the obligation is very clear. Article 16 of the Market Abuse Regulation requires any firm professionally arranging or executing transactions to maintain systems that detect and report suspicious orders and transactions, with the technical standards set out in Commission Delegated Regulation (EU) 2016/957, in force since 2016.

How firms detect insider dealing

Insider dealing detection combines three data sets: 

1. Firms maintain restricted and watch lists of instruments where the firm holds material non-public information
2. Monitor employee and client trading against those lists
3. Reconstruct activity around price-sensitive announcements to see who positioned themselves beforehand

Alerts get ranked on how well the timing and size fit, which are then reviewed by an analyst who decides whether to file a suspicious transaction and order report. The method works well when the person who’s trading is the person the firm believes owns the account.

What surveillance cannot answer

Surveillance systems read orders, transactions, and the account identifiers attached to them. Four questions sit outside that field of view:

• Is the named holder the person actually trading? An account operated by someone other than its owner produces perfectly normal order flow.
• Do two accounts share an operator? Independent-looking counterparties are precisely what wash trading requires.
• Was the holder recruited? A paid nominee carries no adverse history, because they have done nothing wrong until now.
• Did the same operator fail onboarding elsewhere? A rejection at one venue leaves no trace at the next.

Each of those gaps is answerable at account opening and unanswerable from the order book, which is the structural reason why surveillance cannot answer this.

Why capital fraud prevention starts at account opening

A manipulation ring can generate any order pattern it likes, but it cannot generate an unlimited supply of clean, unconnected identities. That scarcity is the constraint worth attacking, and rings solve it in two ways.

1. The first is substitution. Rather than fabricate an identity, the organiser recruits somebody who already has a genuine document and pays them to open the account.

Heard at the Shufti webinar “If Your Verification System Is 99% Accurate“, 17 November 2025

Ray Blake of The Dark Money Files and Risk Alert 24/7, a former Head of Compliance and MLRO, argued that hardening synthetic identity detection does not remove the attack, it reshapes it. A criminal who cannot fabricate an identity finds somebody with an immaculate one and has them onboard instead. No single system registers that substitution, though an analyst reading the combined output of two or three systems alongside the behaviour can spot it. Watch the session.

2. The second route runs through geography. Onboarding standards are not uniform, so a ring assembles its accounts wherever the checks are thinnest, then trades into venues that assume every counterparty arrived through a rigorous process. The weakest link in the chain is frequently a jurisdiction rather than a control.

Both routes survive because onboarding and surveillance are usually different systems owned by different teams. The onboarding record showing that four applicants shared a device never reaches the analyst reviewing a coordinated trading alert six weeks later, so the alert looks isolated and gets closed.

Three controls do most of the work against this:

1. Deduplicate biometrically across the whole book, not per application: A new applicant’s selfie checked against every enrolled face catches the same person returning under a second identity.
2. Link accounts on shared infrastructure: Devices, network signatures and registration timing connect accounts that share no personal data at all.
3. Pass the result to surveillance: A connection score is only useful if the surveillance team can see it at the moment an alert fires.

Firms skip that third step far more often than the other two, which makes it a recurring problem. Firms running investor verification as a fraud control tend to discover the gap during an enforcement review.

Where Shufti fits in capital markets onboarding

If you run onboarding for a broking, an exchange or a trading platform, the accounts that cause the most damage are rarely the ones that fail a check. They pass, they trade normally for weeks, and then you start to notice problems.

Shufti’s Fraud Hub surfaces cross-account coordination signals, including shared devices, correlated registration timing and synchronised activity patterns, so applicants who share no personal details still resolve into one group. That gives you a link between accounts rather than a verdict on a single applicant.