Liars and tweets
15 December 2015
Social media platforms are being used to disseminate stolen research and malicious information, all in a bid to manipulate company share prices
Image: Shutterstock
The threat of identity theft in the digital world is a growing and real concern. Victims of these crimes can suffer significant financial loss as well as reputational damage that can be difficult to reclaim, even if the perpetrator is discovered鈥攚hich is far from guaranteed.
A survey on cyber crime conducted by Get Safe Online in October 2014 showed that of the 51 percent of respondents had been the victim of cyber crime, such as fraud or theft, but only 14 percent ever discovered the identity of the person or people responsible.
As the risk of becoming a victim of cyber crime grows so does the cost of investment in protecting your business from the increasingly innovative methods used for fraud and theft.
For financial institutions, this includes closely monitoring social media platforms that are being used to share stolen research and malicious information, all in a bid to manipulate company share prices.
The explosion of social media use in recent years for both personal and professional purposes means it has become an invaluable resource for many but, at the same time, it has given criminals yet another avenue to exploit.
It is not unusual for a major companies to have dedicated LinkedIn, Twitter, Facebook and even Instagram accounts for posting content online and interacting with customers on a daily basis.
However, these platforms are built on attracting users through ease-of-access and the ability to quickly and efficiently set up an account with minimal checks or identity validation required.
The anonymity this offers is being exploited by cyber criminals who are using the lack of checks on user identity or posted content to increase their ill-gotten gains.
In November, James Craig, a 62-year-old trader living in a small town in Scotland was accused by the US 网爆吃瓜 and Exchange Commission (SEC) of using Twitter to commit multiple cases of securities fraud.
According to the SEC, Craig created two false accounts in 2013 that mimicked the existing accounts of reputable securities research firms, Muddy Waters and Citron Research, and then published multiple tweets of malicious and entirely false information relating to two US-based companies, including a claim that one was under regulatory investigation, in an attempt to profit from the resulting market reaction through short selling.
The SEC alleged that Craig鈥檚 tweets caused sharp drops in stock prices and trading in Audience, a technology provider, and Sarepta Therapeutics, a biopharmaceutical company.
Audience鈥檚 share price plunged 28 percent after the first tweet and trading on Nasdaq was eventually halted. The next day, Craig鈥檚 tweets about Sarepta Therapeutics, using a phony Citron Research account, caused a 16 percent drop in its share price.
Both companies鈥� stock prices recovered once the fraud was revealed, but other shareholders caught up in the scam are estimated to have lost between $1 million and $1.8 million, according to official sources.
How do you kill a hydra?
鈥淚t [brand identity theft] is a significant problem because people trust brands and if you鈥檙e a thief you鈥檙e much more likely to be successful if you cloak yourself in a brand that鈥檚 well known and trusted,鈥� says Larry McFarland, a trademark attorney and partner at Kilpatrick Townsend & Stockton in California.
The problem, as McFarland describes it, is two-fold. 鈥淚t can either be fake reports where content is sent out using someone鈥檚 reputable name without their permission or, even more common, is the improper distribution of legitimate and confidential reports to everyone in the world.鈥�
鈥淢y firm represents several large banks that have to deal with the problem of having their newsletters stolen and replicated under someone else鈥檚 name. This comes across my desk at least once every week, where confidential research has been posted all over the internet.鈥�
The SEC鈥檚 claims of market manipulation through social media are just the latest examples of rogue traders capitalising on the platform to potentially access millions of investors.
In June 2010, the SEC brought charges against Carol McKeown and Daniel Ryan, a Canadian couple who used Twitter and Facebook, along with their own website, PennyStockChaser, to spread information that inflated the stock price of microcap companies in which they were significant share holders. They then profited from selling their shares.
A district court ordered the couple and their companies to pay more than $3.7 million in disgorgement for profits gained as a result of the alleged conduct, and聽ordered聽the couple to pay $300,000 in civil penalties.
Lifting the veil
Between January and the end of June this year, Twitter received 12,911 trademark notices, affecting 938 Twitter and Vine accounts.
Although not all of these will relate to direct attempts at fraud or identity theft of financial institutions, as Twitter does not provide such granularity in its statistics, it does highlight the scale of the problem facing social media platforms today.
To deal with the problem, a spokesperson for Twitter highlighted information on the Twitter help centre, which states: 鈥淲hen there is a clear intent to mislead others through the unauthorised use of a trademark, Twitter will suspend the account and notify the account holder.鈥�
鈥淲hen we determine that an account appears to be confusing users, but is not purposefully passing itself off as the trademarked good or service, we give the account holder an opportunity to clear up any potential confusion.鈥�
鈥淐ompanies like Facebook and Twitter have very robust takedown policies and they respond very quickly to requests so they [social media platforms] aren鈥檛 really the problem,鈥� explains McFarland.
The Twitter spokesperson also stated that the platform鈥檚 policy on legal proceedings allows it to retain user information and tweets even after a user has deactivated the account, and it will release this information to law enforcement personnel if certain requirements are met.
McFarland says: 鈥淚f you鈥檙e the lawyer for a major bank and something gets on Facebook, it can be taken down extremely quickly. It鈥檚 the obscure or smaller sites which are less organised to respond that make it harder.鈥�
鈥淭he big social media companies comply with laws such as the Digital Millennium Copyright Act, which mean they take down reported content in order to get legal immunity for potentially hosting fraudulent or stolen content on their sites.鈥�
Of course, an ounce of prevention is always worth a pound of cure, although that is an unrealistic prospect where social media is concerned. 鈥淥nce it鈥檚 out there on the internet it鈥檚 out there for good,鈥� says McFarland, 鈥渂ut what you can do is get it taken down from sites where consumers go to the most often.鈥�
鈥淎 regular internet user isn鈥檛 likely to scour obscure sites looking for your content so if it鈥檚 down from the obvious places you鈥檝e done a lot. But you can never have full protection.鈥�
The SEC鈥檚 statement on its case against Craig showed that he was clearly aware of the odds of his being caught as, after his initial attempts at market manipulation, he allegedly created another Twitter account under new aliases to taunt law enforcement by claiming it would be too difficult to find the preparatory of the stock price crashes because no real names were used when creating the original accounts.
Once the SEC eventually came to point the finger at Craig, Jina Choi, director of the SEC鈥檚 San Francisco regional office, couldn鈥檛 resist a retort to Craig鈥檚 challenge
He said: 鈥淎s alleged in our complaint, Craig鈥檚 fraudulent tweets disrupted the markets for two public companies and caused significant financial losses for their investors.鈥�
鈥淐raig also said in later tweets that the SEC would have a hard time catching the perpetrators. As today鈥檚 enforcement action demonstrates, those tweets turned out to be false as well.鈥�
What鈥檚 to be done?
Once fraud has been identified and takedown notices have been issued to the relevant platforms, there are still some options left to financial institutions that have had their valuable research leaked or brands hijacked.
鈥淥ften times we try to go [to court] but it depends a lot on the circumstances such as quantity of the information leaked or whether the person is a repeat offender,鈥� says McFarland.
鈥淭he vast majority of cases filed end in a settlement. If you file a lawsuit your main aim is to get an injunction or a court order to get the person to cease their fraudulent action. That way if they repeat it they will be in contempt of court, which is a very powerful thing.鈥�
鈥淭he second aim is to get damages but often these people don鈥檛 have a lot of money so you鈥檙e not always going to be able to get everything you鈥檝e lost.鈥�
Here lies the root of the problem with this brand of crime. Lost profits and damaged reputations are often impossible to reclaim or repair.
Craig reportedly earned less than $100 from selling the stocks of his targets short, which would be little compensation to other shareholders that lost significantly more from the affair.
At the same time, the two securities research firms, whose identities were hijacked to spread the false information, will have suffered reputational damage that is difficult to quantify and even harder to redeem in the short term.
For social media platforms, incidents like those involving Craig or McKeown and Ryan are also damaging as they undermine the credibility of news sources using the platform and may drive users away all together.
The problem for the likes of Twitter and Facebook is that they are, in a way, victims of their own success. The sheer scale of information that is uploaded to these sites on a daily basis makes vetting it before it is published an impossible task. 鈥淎 gatekeeper function for social media sites would be crazy,鈥� comments McFarland.
Indeed, the rise of platforms such as Twitter and Facebook has been directly attributed to US law providing safe harbours from litigation. The Digital Millennium Copyright Act, for example, removes liability for copyright infringement committed by users if a platform responds promptly to takedown requests.
Following its allegation against Craig, the SEC published an investor alert outlining the most common risks of using social media as investment information tool.
鈥淥ne way fraudsters may exploit social media is to engage in a聽market manipulation, such as spreading false and misleading information about a company to affect the stock鈥檚 share price. Wrongdoers may perpetuate stock rumours on social media, as well as on online bulletin boards and in Internet chatrooms,鈥� stated the notice.
鈥淭he false or misleading rumours may be positive or negative. For example, in a pump-and-dump scheme, promoters 鈥榩ump鈥� up the stock price by spreading positive rumours that incite a buying frenzy and they quickly 鈥榙ump鈥� their own shares before the hype ends.鈥�
鈥淭ypically, after the promoters profit from their sales, the stock price drops and the remaining investors lose money. In other instances, fraudsters start negative rumours urging investors to sell their shares so that the stock price plummets and the fraudsters take advantage of buying shares at the artificially low price.鈥�
The SEC advises anyone who receives investment information through social media to verify the identity of the underlying source. They should look out for slight variations or typos in the sender鈥檚 account name, profile, email address, screen name or handle, or other signs that the sender may be an imposter. 鈥淒etermine whether information appearing to be from a particular company or securities research firm is authentic.鈥�
鈥淲hen contacting a company or attempting to access its website, be sure to use contact information or the website address provided by the company itself, such as in the company鈥檚 SEC filings.聽Carefully type the website鈥檚 address into the address bar of your web browser.鈥�
The SEC also outlined common red flags for investors to look out for when using social media for market information. These include: looking out for a limited history of posts that may indicate the account was relatively new; receiving an urgent message stressing the need to buy or sell specific stocks, especially from unsolicited sources; and unmasking unlicensed sellers or firms using the SEC鈥檚 Investment Adviser Public Disclosure website or the Financial Industry Regulatory Authority鈥檚 BrokerCheck service.
A survey on cyber crime conducted by Get Safe Online in October 2014 showed that of the 51 percent of respondents had been the victim of cyber crime, such as fraud or theft, but only 14 percent ever discovered the identity of the person or people responsible.
As the risk of becoming a victim of cyber crime grows so does the cost of investment in protecting your business from the increasingly innovative methods used for fraud and theft.
For financial institutions, this includes closely monitoring social media platforms that are being used to share stolen research and malicious information, all in a bid to manipulate company share prices.
The explosion of social media use in recent years for both personal and professional purposes means it has become an invaluable resource for many but, at the same time, it has given criminals yet another avenue to exploit.
It is not unusual for a major companies to have dedicated LinkedIn, Twitter, Facebook and even Instagram accounts for posting content online and interacting with customers on a daily basis.
However, these platforms are built on attracting users through ease-of-access and the ability to quickly and efficiently set up an account with minimal checks or identity validation required.
The anonymity this offers is being exploited by cyber criminals who are using the lack of checks on user identity or posted content to increase their ill-gotten gains.
In November, James Craig, a 62-year-old trader living in a small town in Scotland was accused by the US 网爆吃瓜 and Exchange Commission (SEC) of using Twitter to commit multiple cases of securities fraud.
According to the SEC, Craig created two false accounts in 2013 that mimicked the existing accounts of reputable securities research firms, Muddy Waters and Citron Research, and then published multiple tweets of malicious and entirely false information relating to two US-based companies, including a claim that one was under regulatory investigation, in an attempt to profit from the resulting market reaction through short selling.
The SEC alleged that Craig鈥檚 tweets caused sharp drops in stock prices and trading in Audience, a technology provider, and Sarepta Therapeutics, a biopharmaceutical company.
Audience鈥檚 share price plunged 28 percent after the first tweet and trading on Nasdaq was eventually halted. The next day, Craig鈥檚 tweets about Sarepta Therapeutics, using a phony Citron Research account, caused a 16 percent drop in its share price.
Both companies鈥� stock prices recovered once the fraud was revealed, but other shareholders caught up in the scam are estimated to have lost between $1 million and $1.8 million, according to official sources.
How do you kill a hydra?
鈥淚t [brand identity theft] is a significant problem because people trust brands and if you鈥檙e a thief you鈥檙e much more likely to be successful if you cloak yourself in a brand that鈥檚 well known and trusted,鈥� says Larry McFarland, a trademark attorney and partner at Kilpatrick Townsend & Stockton in California.
The problem, as McFarland describes it, is two-fold. 鈥淚t can either be fake reports where content is sent out using someone鈥檚 reputable name without their permission or, even more common, is the improper distribution of legitimate and confidential reports to everyone in the world.鈥�
鈥淢y firm represents several large banks that have to deal with the problem of having their newsletters stolen and replicated under someone else鈥檚 name. This comes across my desk at least once every week, where confidential research has been posted all over the internet.鈥�
The SEC鈥檚 claims of market manipulation through social media are just the latest examples of rogue traders capitalising on the platform to potentially access millions of investors.
In June 2010, the SEC brought charges against Carol McKeown and Daniel Ryan, a Canadian couple who used Twitter and Facebook, along with their own website, PennyStockChaser, to spread information that inflated the stock price of microcap companies in which they were significant share holders. They then profited from selling their shares.
A district court ordered the couple and their companies to pay more than $3.7 million in disgorgement for profits gained as a result of the alleged conduct, and聽ordered聽the couple to pay $300,000 in civil penalties.
Lifting the veil
Between January and the end of June this year, Twitter received 12,911 trademark notices, affecting 938 Twitter and Vine accounts.
Although not all of these will relate to direct attempts at fraud or identity theft of financial institutions, as Twitter does not provide such granularity in its statistics, it does highlight the scale of the problem facing social media platforms today.
To deal with the problem, a spokesperson for Twitter highlighted information on the Twitter help centre, which states: 鈥淲hen there is a clear intent to mislead others through the unauthorised use of a trademark, Twitter will suspend the account and notify the account holder.鈥�
鈥淲hen we determine that an account appears to be confusing users, but is not purposefully passing itself off as the trademarked good or service, we give the account holder an opportunity to clear up any potential confusion.鈥�
鈥淐ompanies like Facebook and Twitter have very robust takedown policies and they respond very quickly to requests so they [social media platforms] aren鈥檛 really the problem,鈥� explains McFarland.
The Twitter spokesperson also stated that the platform鈥檚 policy on legal proceedings allows it to retain user information and tweets even after a user has deactivated the account, and it will release this information to law enforcement personnel if certain requirements are met.
McFarland says: 鈥淚f you鈥檙e the lawyer for a major bank and something gets on Facebook, it can be taken down extremely quickly. It鈥檚 the obscure or smaller sites which are less organised to respond that make it harder.鈥�
鈥淭he big social media companies comply with laws such as the Digital Millennium Copyright Act, which mean they take down reported content in order to get legal immunity for potentially hosting fraudulent or stolen content on their sites.鈥�
Of course, an ounce of prevention is always worth a pound of cure, although that is an unrealistic prospect where social media is concerned. 鈥淥nce it鈥檚 out there on the internet it鈥檚 out there for good,鈥� says McFarland, 鈥渂ut what you can do is get it taken down from sites where consumers go to the most often.鈥�
鈥淎 regular internet user isn鈥檛 likely to scour obscure sites looking for your content so if it鈥檚 down from the obvious places you鈥檝e done a lot. But you can never have full protection.鈥�
The SEC鈥檚 statement on its case against Craig showed that he was clearly aware of the odds of his being caught as, after his initial attempts at market manipulation, he allegedly created another Twitter account under new aliases to taunt law enforcement by claiming it would be too difficult to find the preparatory of the stock price crashes because no real names were used when creating the original accounts.
Once the SEC eventually came to point the finger at Craig, Jina Choi, director of the SEC鈥檚 San Francisco regional office, couldn鈥檛 resist a retort to Craig鈥檚 challenge
He said: 鈥淎s alleged in our complaint, Craig鈥檚 fraudulent tweets disrupted the markets for two public companies and caused significant financial losses for their investors.鈥�
鈥淐raig also said in later tweets that the SEC would have a hard time catching the perpetrators. As today鈥檚 enforcement action demonstrates, those tweets turned out to be false as well.鈥�
What鈥檚 to be done?
Once fraud has been identified and takedown notices have been issued to the relevant platforms, there are still some options left to financial institutions that have had their valuable research leaked or brands hijacked.
鈥淥ften times we try to go [to court] but it depends a lot on the circumstances such as quantity of the information leaked or whether the person is a repeat offender,鈥� says McFarland.
鈥淭he vast majority of cases filed end in a settlement. If you file a lawsuit your main aim is to get an injunction or a court order to get the person to cease their fraudulent action. That way if they repeat it they will be in contempt of court, which is a very powerful thing.鈥�
鈥淭he second aim is to get damages but often these people don鈥檛 have a lot of money so you鈥檙e not always going to be able to get everything you鈥檝e lost.鈥�
Here lies the root of the problem with this brand of crime. Lost profits and damaged reputations are often impossible to reclaim or repair.
Craig reportedly earned less than $100 from selling the stocks of his targets short, which would be little compensation to other shareholders that lost significantly more from the affair.
At the same time, the two securities research firms, whose identities were hijacked to spread the false information, will have suffered reputational damage that is difficult to quantify and even harder to redeem in the short term.
For social media platforms, incidents like those involving Craig or McKeown and Ryan are also damaging as they undermine the credibility of news sources using the platform and may drive users away all together.
The problem for the likes of Twitter and Facebook is that they are, in a way, victims of their own success. The sheer scale of information that is uploaded to these sites on a daily basis makes vetting it before it is published an impossible task. 鈥淎 gatekeeper function for social media sites would be crazy,鈥� comments McFarland.
Indeed, the rise of platforms such as Twitter and Facebook has been directly attributed to US law providing safe harbours from litigation. The Digital Millennium Copyright Act, for example, removes liability for copyright infringement committed by users if a platform responds promptly to takedown requests.
Following its allegation against Craig, the SEC published an investor alert outlining the most common risks of using social media as investment information tool.
鈥淥ne way fraudsters may exploit social media is to engage in a聽market manipulation, such as spreading false and misleading information about a company to affect the stock鈥檚 share price. Wrongdoers may perpetuate stock rumours on social media, as well as on online bulletin boards and in Internet chatrooms,鈥� stated the notice.
鈥淭he false or misleading rumours may be positive or negative. For example, in a pump-and-dump scheme, promoters 鈥榩ump鈥� up the stock price by spreading positive rumours that incite a buying frenzy and they quickly 鈥榙ump鈥� their own shares before the hype ends.鈥�
鈥淭ypically, after the promoters profit from their sales, the stock price drops and the remaining investors lose money. In other instances, fraudsters start negative rumours urging investors to sell their shares so that the stock price plummets and the fraudsters take advantage of buying shares at the artificially low price.鈥�
The SEC advises anyone who receives investment information through social media to verify the identity of the underlying source. They should look out for slight variations or typos in the sender鈥檚 account name, profile, email address, screen name or handle, or other signs that the sender may be an imposter. 鈥淒etermine whether information appearing to be from a particular company or securities research firm is authentic.鈥�
鈥淲hen contacting a company or attempting to access its website, be sure to use contact information or the website address provided by the company itself, such as in the company鈥檚 SEC filings.聽Carefully type the website鈥檚 address into the address bar of your web browser.鈥�
The SEC also outlined common red flags for investors to look out for when using social media for market information. These include: looking out for a limited history of posts that may indicate the account was relatively new; receiving an urgent message stressing the need to buy or sell specific stocks, especially from unsolicited sources; and unmasking unlicensed sellers or firms using the SEC鈥檚 Investment Adviser Public Disclosure website or the Financial Industry Regulatory Authority鈥檚 BrokerCheck service.
NO FEE, NO RISK
100% ON RETURNS If you invest in only one securities finance news source this year, make sure it is your free subscription to 网爆吃瓜 Finance Times
100% ON RETURNS If you invest in only one securities finance news source this year, make sure it is your free subscription to 网爆吃瓜 Finance Times
