Our own visit statistics are always on. Google Analytics, which helps us understand how people use our public pages (not your signed-in workspace), is enabled only with your permission. See our Privacy policy.

Pump-and-Dump Signals on Social Media: What Data Shows

We tested public social data against cases that the SEC, India's ED and SEBI have acted on. Timing works as a triage signal. Copied text mostly flags news, not schemes.

Illustration: a phone on the left pours out many identical chat bubbles that spread to several social feed cards. Behind them, a stock price line rises steeply and then collapses. On the right, a magnifying glass shows that the bubbles are copies of each other.

Public social data can show part of a pump-and-dump, but mostly the part that spills out of private chat groups. It does not show the recruiting itself. On October 25, 2026, from 06:46 to 07:33 UTC, we sent 28 requests to EveryInfra. 18 were billed, for $0.010008 in total. We compared the results with cases that regulators have acted on.

The SEC suspended TJGC Group on October 15. For the 30 days before that date, X search returned 36 posts, and attention peaked 27 days before the suspension. In India, the Enforcement Directorate (ED) froze about ₹200 crore in one case. There, the first public doubt on X came 43 days before the first 20% lower circuit. It came 276 days before the ED searches.

But "copied text", the signal that people mention most, did not appear across accounts in any promotion window. The highest duplicate rate, 38.5%, came from accounts that reposted the ED's own press release.

In this article, an early-warning monitor for pump-and-dump activity is a daily job. For each ticker and company name, it collects posts once from a few public platforms. It then calculates five values: posts per day, author concentration, copied text across accounts, new accounts and spread across platforms. It compares each value with a same-day large-cap stock and with the ticker's own history. Only tickers outside that range go to a person for review. The output is a review order for a surveillance team, not a finding of manipulation.

Isometric illustration of a closed, locked cabinet that stands for invitation-only chat groups. Five small vents on the lid stand for what leaks out to public platforms such as X, Reddit, YouTube, TikTok and public Telegram channels. A gantry spans the cabinet, and a lit probe hangs from it into one vent with a teal ring. A cable runs from the probe to a dial gauge on the base plate. A monitor can read the vents, but not the inside of the cabinet.

Who this is for, and what it does not do

This article is for four groups: surveillance teams at broker-dealers and exchanges, financial journalists, investor-education programs, and researchers who study market manipulation. It describes data methods and their limits only.

  • It gives no investment advice and does not rate any stock.
  • It does not accuse any person or company. The only stocks named here are ones that a regulator has already suspended, searched or flagged in public. We use the regulator's own words, such as "potential manipulation" and "alleged".
  • We do not show the handles of private users. We name only institutional accounts, such as the ED's own account and news agencies.

What regulators have already acted on

SEC: 16 trading suspensions in 13 months, 15 of them cite social media. We read all 16 suspension releases that the SEC published from September 26, 2025, to October 14, 2026, on its trading suspensions page. In 15 of them, the reason is potential manipulation through "recommendations made to investors by unknown persons via social media". Six of them add that investors were told to send screenshots of their trades. All 16 companies have their headquarters in Asia: 7 in Hong Kong, 5 in Singapore, and 1 each in Malaysia, Indonesia, Japan and Shanghai.

The most recent one is TJGC Group Limited, a British Virgin Islands holding company with headquarters in Hong Kong. Its suspension runs from 4:00 AM ET on October 15 to 11:59 PM ET on October 28, 2026 (SEC release; SEC order). The first suspensions in this series, on September 26, 2025, included QMMM Holdings (SEC release). In June 2026 there was one for Happy City Holdings (SEC release). The SEC page says that the agency can suspend trading for up to 10 trading days. A suspension is not a final finding.

Screenshot of the SEC trading suspension order for TJGC. The highlighted paragraph gives the reason: unknown persons recommended on social media that investors buy, hold or sell TJGC and send screenshots of their trades, which appears designed to inflate the price and volume.
The SEC's October 2026 suspension order for TJGC. The teal box is the reason for the suspension. SEC Release No. 34-106668 (original PDF)
Scatter chart of 16 SEC suspensions by date and headquarters; most fall between late September and December 2025. Hong Kong has 7: QMMM, EFTY, PTNM, MCTA, JMG, HCHL and TJGC. Singapore has 5 (SDM, PLTS, PC, MAGH, TCGL), and Malaysia, Indonesia, Japan and Shanghai have 1 each. Six teal dots mark releases that cite both social media and trade screenshots: LAWR, MCTA, MAGH, TCGL, HCHL and TJGC. Nine grey dots cite social media only, and MAMK is hollow because its release does not mention social media.

India: WhatsApp "multibagger" groups and a ₹200 crore freeze. On October 16, 2026, the ED's Mumbai Zonal Office-I searched 29 premises in Mumbai, Nashik, Ahmedabad, Gandhinagar, Surat and Bhavnagar. The case concerns the shares of R M Drip and Sprinklers Systems and R&B Denims. The ED press release of October 19 says the following:

  • From April 2023 to March 2024, the two companies issued over 3.5 crore shares and convertible warrants to selected persons. Most of the money came from a small circle of connected persons, firms and lenders.
  • From the end of December 2025 to February 2026, WhatsApp communities with names such as "Multibagger Stocks" sent daily buy tips. The SIM cards were in other people's names in Haryana and Mumbai, but the groups were run from Bhavnagar, Gujarat.
  • The campaign also used X, SMS and other channels.
  • The ED froze trading accounts worth about ₹200 crore.

The ED also posted the news on its own X account. The release says that the investigation continues. A freeze is not a conviction. Moneycontrol reports that investors in the two stocks rose from about 3,400 to more than one lakh (100,000) in a short time. It also reports that SEBI searched the promoters in April.

On October 22, SEBI issued PR No. 65/2026 about invitation-only WhatsApp tip groups. Operators often use overseas numbers and pose as experts. Planted members post false profit claims and praise the "expert", which SEBI calls astroturfing. When a group is shut down, members get a message from a new number. It says that the old group "has been banned" and asks them to join a new one. SEBI says that this message is itself a red flag.

Screenshot of the first page of SEBI press release PR No. 65/2026, which cautions investors about invitation-only WhatsApp stock tip groups and names the practice of fake profit posts astroturfing. The teal box holds the message members get from a new number after a group is banned.
SEBI's caution of October 22. The teal box is the "our previous group has been banned, please join the new group" message. SEBI PR No. 65/2026 (original)

The test criteria we wrote before we collected data

We wrote down five signals and a pass line for each before we called any API. These lines are our own test thresholds, not regulatory standards:

  1. Timing. Public attention peaks at least 7 days before the regulator acts.
  2. Author concentration. One author writes more than 25% of the posts in the window.
  3. Copied text across accounts. At least 10% of posts in the window are near-duplicates from different accounts. Near-duplicate means at least 80% of the words are the same after we remove links and @handles.
  4. New accounts. Accounts younger than 180 days write at least 20% of the posts.
  5. Spread. At least 3 of 5 platforms have relevant posts about the ticker.

Results: signal 1 passed for all three cases. Signal 2 passed on paper, but we cannot interpret it (see below). Signals 3 and 4 failed. Signal 5 passed in part: 3 platforms had relevant posts and 2 did not.

SignalPass lineResult
TimingPeak at least 7 days before the regulator actsPassed: TJGC 27 days, QMMM 20 days; in the Indian case, the first public doubt came 43 days before the first lower circuit
Author concentrationOne author writes more than 25% of postsPassed on paper (TJGC's top account: 30.6%), but it is an Arabic-language list account, so we cannot interpret it
Copied text across accountsAt least 10% near-duplicates from different accountsFailed: none across accounts in any promotion window
New accountsAccounts younger than 180 days write at least 20%Failed: TJGC 2.8%
SpreadAt least 3 of 5 platforms have relevant postsPassed in part: 3 platforms did, 2 did not

Test 1: what X showed in the 30 days before the TJGC suspension

At 06:46 UTC we used the Twitter (X) Search API with the query $TJGC since:2026-09-15 until:2026-10-16 and a limit of 100. It returned 38 posts. Two came after the suspension started, which leaves 36. We ran the same test for QMMM in 2025 ($QMMM since:2025-08-15 until:2025-09-30). It returned 22 posts, 18 of them before the suspension. The X Help Center describes date filters for search. But X search returns a ranked subset, not every post. So all numbers below describe what search shows, not the full conversation.

Screenshot of one real EveryInfra request and response: POST /api/v1/social with platform twitter, action search and the query $TJGC with a date range. The response is 200 with 38 results and a charge of $0.000556. Two posts from September 18 are shown with posting time, account creation date, follower count, likes and views. Usernames, names, avatars and post IDs are masked.
The raw request and response from test 1 (2 of 38 results; usernames, avatars and post IDs masked). Twitter (X) Search API
  • Timing. For TJGC, 14 of the 36 posts are from one day, September 18. September 17 to 19 hold 19 posts. The peak came 27 days before the suspension. For QMMM, the peak was 10 posts on September 9, 2025, 20 days before its suspension.
  • Authors. 15 accounts wrote the 36 posts. The most active account wrote 11 (30.6%). The top three wrote 47.2%.
  • Account age. Accounts younger than 180 days wrote 1 post (2.8%). For QMMM, the figure was 0.
  • Language. 21 posts are in English and 10 in Arabic, with 1 each in German and Portuguese. The most active account writes in Arabic and posts lists of "strongest stocks".
  • List posts. 9 posts (25%) are top-gainer lists that name 4 or more tickers. A few list accounts posted them.
Bar chart. The horizontal axis shows days from the start of the SEC suspension, from minus 35 to 0. Teal bars are TJGC (2026): a tall bar of 14 posts at minus 27 days, then 0 to 5 posts a day. Grey bars are QMMM (2025): one tall bar of 10 posts at minus 20 days, then 1 to 3 per day. Attention peaked 27 and 20 days before the two suspensions.

The two cases have the same shape: public attention rises first, and the regulator acts two to three weeks later. This is not a forecast. In both cases, the peak days were also the days of the largest price moves. The talk followed the price; it did not lead it. For a surveillance team, the value is triage. When public attention on a small-cap ticker jumps far above its own history, pull the trade data for that ticker.

Why signal 2 "passed but cannot be interpreted": the most active account has about 28,000 followers and posts lists of strong US stocks every day. TJGC was one of many. A high single-author share here shows the habits of a foreign-language list account, not a coordinated push. Without trade data, public data cannot separate the two.

Test 2: one ticker, five platforms

In the same session, we searched four more platforms once each. We used the Reddit Search API, YouTube Search API, TikTok Search API and Telegram Search API:

  • Reddit. All 15 results mention TJGC. 9 are from before the suspension; the first is from September 24. 5 results are bot posts from one automated "sweep" community.
  • YouTube. 18 of 20 results mention TJGC in the title or description. 8 mention it only in the description; most of these are auto-generated "daily top gainers" videos. The median view count of the 18 videos is 51.
  • TikTok. For "TJGC stock", 0 of 30 results are about TJGC. The results are about TJX, TGC and general trading content.
  • Telegram. Public channel search returned 0 posts, and the empty result was not charged. To check the tool, we searched "nifty" at 07:18 UTC. It returned 12 posts, so the capability works.
Horizontal bar chart of search results for the ticker TJGC on five platforms. X has 38 of 38 results that mention TJGC, Reddit has 15 of 15 and YouTube has 18 of 20. TikTok has 0 of 30, because all results drift to unrelated keywords. Telegram returns 0 results.

This matches what regulators describe. The SEC and SEBI say the recommendations happen on social media and in invitation-only chat groups, and SEBI names WhatsApp. Public search cannot see inside closed groups. It sees what comes after: top-gainer lists, skeptical posts and recap videos. Signal 5 passed only in part.

Test 3: the Indian case, where public doubt came before the crash

The ED release gives no daily prices, so we took time anchors from X. At 06:51 and 06:52 UTC we searched "RM Drip" OR "R M Drip" OR RMDRIP and "R&B Denims" OR RBDENIMS for December 15, 2025, to March 1, 2026. The searches returned 100 and 42 posts. But 22 and 26 of them fell outside the window: with OR, the date filter did not apply to every term. We filtered again by each post's own timestamp. Inside the window, there were 78 posts about RM Drip (47 accounts) and 16 about R&B Denims (9 accounts).

We read each post in the window once and labeled it by hand. We keep the rules and post IDs on file.

  • 5 skeptical posts came before the first 20% lower circuit on February 25. January 12: "I have seen this price action before. This won't end well." January 27: "One more pump and dump on the way." February 10: two posts. One predicts that there will be no exit when the price falls. The other does the free-float math for R&B Denims. Holders with less than 1% own 2.09% of the shares. The day's traded value was about twice that float, but the price moved only 1%. February 16: "Stay away from such seemingly manipulated stock."
  • 4 "return story" posts, such as "60x in 3 years". These look the same as ordinary investor excitement, so we count them but draw no conclusion.
  • 2 complaint posts after the fall. On February 26, a user asked SEBI, NSE and BSE to investigate. On February 27, a finance website said that more than 100 readers had reported being pushed R&B Denims through WhatsApp or Telegram.

The first skeptical post (January 12) came 43 days before the first lower circuit and 276 days before the ED searches on October 16.

Timeline in three lanes, with a grey band for the WhatsApp tip period (late December 2025 to February 2026). In the X lane, five teal dots mark skeptical posts before the crash, and two grey dots mark later complaints. In the price lane, a diamond marks the first 20% lower circuit on February 25. The regulators lane shows SEBI searches on April 27 (as reported) and ED searches on October 16. The ED release follows on October 19 and the SEBI caution on October 22.

So experienced retail investors on public platforms often see the problem before enforcement does. But there are two limits. Skeptical posts are rare (5 of 94 posts) and come from different accounts. Automated lists are far more common: the most active account in the RM Drip window (14 posts, 17.9%) posts "new 52-week high" lists.

Test 4: copied text gives more false alarms than signals

"Many accounts post the same words" is the pump signal that people mention most. We looked for near-duplicates with the 80% word-overlap rule. The result goes against intuition:

  • TJGC, 36 posts before the suspension: 5.6% duplicates. All of them are one list account that posted the same list twice. There are 0 duplicates across accounts.
  • RM Drip, 78 posts in the promotion window: 2.6%, again one account's repeated list. R&B Denims, 16 posts: 0.
  • After the ED release: 22.7% of 22 RM Drip posts and 38.5% of 26 R&B Denims posts are duplicates. All of them are different accounts that repost the ED's text, including the news agencies ANI and UNI.
  • As a control, at 06:57 UTC we searched $NVDA for two days in the same period (September 17 and 18). Of 100 posts, 9% are duplicates. Those 9 posts come from 4 groups of different accounts that post the same "last chance to get in" template.
Horizontal bar chart of the share of duplicate posts. TJGC in the 30 days before the suspension: 5.6%; NVDA on September 17 and 18 (control): 9.0%. In the promotion window, RM Drip has 2.6% and R&B Denims has 0. After the ED release, RM Drip has 22.7% and R&B Denims has 38.5%. These last two bars are teal, because most copied text came from news reposts after enforcement.

In our sample, copied text across accounts came mainly from two normal sources. One is reposts of news and enforcement releases. The other is template posts that ride on popular large-cap tickers.

Research has a name for the second one: cashtag piggybacking. Cresci and co-authors studied about 9 million stock tweets. They found coordinated bot groups that put popular tickers and low-value tickers in the same tweet to promote the low-value ones. Up to 71% of the authors of suspicious financial tweets were classified as bots (ACM Transactions on the Web, 2019). A 2026 survey of coordinated online behavior also lists cashtag co-occurrence networks as a detection target (ACM Computing Surveys).

Where the false alarms come from

Each item on this list appeared in our data:

Illustration with two platforms. On the left, an official document with a seal sends identical copies to many different accounts: a news story being reposted. On the right, a closed group inside a dashed boundary pushes identical messages through a narrow gap to a few public posts, with a rising bar chart behind: a coordinated promotion. Both look like many copies of the same content.
News reposts and a coordinated push look the same on the "copied text across accounts" signal.
  1. Reposts of news and enforcement releases. After the ED release, dozens of accounts reposted it word for word (22.7% to 38.5% duplicates).
  2. Top-gainer and new-high list bots. In the TJGC window, 25% of posts are multi-ticker lists. In the RM Drip window, the most active account posts new-high lists. They raise post counts and author concentration, but they only follow the price.
  3. Template promotion posts on large caps. NVDA had 9 cross-account template posts in two days, more than any promotion window in our cases.
  4. Keyword drift and ticker collisions. On TikTok, 0 of 30 results for TJGC were relevant. Short tickers also match company initials and common words.
  5. Query side effects. An X query with OR did not apply the date filter to every term. 48 posts fell outside the window. Always filter again by timestamp.
  6. Wrong place to look. The real recruiting happens in closed groups. Four related searches on public Telegram channels all returned 0. SEBI's "previous group has been banned" message returned 1 post on X, from a legal-news account that quoted SEBI.

When the signals work, and when they do not

They work in three situations:

  1. Triage for surveillance. Keep a watchlist of low-float small caps. Each day, compare public attention with each ticker's own last 8 weeks. Send tickers that jump out of range to a reviewer. For TJGC and QMMM, attention peaked two to three weeks before the suspension.
  2. Leads for trade surveillance. Exact post timestamps can be matched with order data that only the broker-dealer or exchange has. Recent research shows why the precision matters. If timestamps lose their seconds, estimates of the mean pump peak range from 2.16% to 42.64% (SSRN 7607818).
  3. Investor education and fact-checking. The phrases that SEBI quotes can become a keyword list. Examples are the "new group" message and profit screenshots. Such a list finds public reposts and posts by victims.

They do not work in four situations:

  1. To decide that manipulation happened from social data alone. Three of five signals failed or could not be interpreted, and public data has no trades.
  2. To treat copied text as evidence. In our sample, cross-account duplicates were almost all news reposts and large-cap templates.
  3. To monitor short tickers by keyword on short-video platforms. TikTok: 0 of 30.
  4. To see inside closed groups. Public Telegram search returned 0; WhatsApp groups have no public index.

The monitoring loop: one lap a day, six stations

Animated 9-second loop: a teal dot travels past six cards and lights each in turn. 1 Watchlist: regulator suspension and alert lists plus your own low-float small caps; 2 Collect: X, Reddit, YouTube, TikTok and Telegram, once each. 3 Measure: volume, author share, copied text, new accounts and spread; 4 Compare: a same-day large cap and the ticker's own 8 weeks. 5 Remove noise: news syndication, list bots, ticker collisions and old news; 6 Human review: only out-of-range tickers go to compliance. The center says 5 searches per ticker per day, about $0.00278.
  1. Build the watchlist. Start with public regulator lists (the SEC suspension page, SEBI and other alerts) and add your own low-float small caps. FINRA Regulatory Notice 22-25 describes typical features that you can use as filters. Examples: IPOs under $25 million, a valuation under $100 million, under 20 million shares, and operations outside the US. Expected result: a table of tickers, company names and listing dates.
  2. Collect once a day. Search each ticker once on X, Reddit, YouTube, TikTok and Telegram. On X, use $TICKER since:DATE; elsewhere, use the ticker plus the company name. Expected result: 5 raw responses per ticker per day, stored as they are.
  3. Measure five values. Post count, top-author share, cross-account duplicate share, new-account share and number of relevant platforms. Expected result: one row per ticker.
  4. Compare. Compare each value with one large cap on the same day and with the ticker's own last 8 weeks. FINRA's 2026 oversight report says that these schemes now happen more often months after the IPO. So do not watch only new listings. Expected result: a percentile for each value.
  5. Remove known noise. Tag posts with the six false-alarm types above. Expected result: usually only a few out-of-range tickers remain.
  6. Send to a reviewer. Send only out-of-range tickers to the compliance team, with links and timestamps of the original posts. Each team sets its own thresholds from its own history; we do not set numbers for you.

The cost of a 200-ticker watchlist

We read the capability catalog on October 25, and the pricing page is the reference. In it, twitter/search, reddit/search, youtube/search, tiktok/search and telegram/search each cost $0.000556 per call. The price is per call, not per returned post.

  • Each ticker per day: 5 × $0.000556 = $0.00278.
  • 200 tickers per day: 1,000 calls × $0.000556 = $0.556.
  • 30 days: $0.556 × 30 = $16.68.

This is an upper limit. Empty results and failed calls are not charged. In our five-platform test for TJGC, the empty Telegram result was refunded. All tests in this article took 28 requests, 18 of them billed, for $0.010008.

Get the same data with code or an AI client

One curl request searches X for a ticker in a date range (the key is a placeholder):

bash
curl -s https://api.everyinfra.com/api/v1/social \
  -H "Authorization: Bearer <API Key>" \
  -H "Content-Type: application/json" \
  -d '{"platform":"twitter","action":"search","params":{"keyword":"$TJGC since:2026-09-15 until:2026-10-16","sort":"latest","limit":100}}'

The response fields that the five values use (all are in the response_fields list for twitter/search in the catalog):

  • id, url: the post ID and link, so a reviewer can open the original.
  • posted_at: the post time in UTC. Daily counts and "days before" use it, and it removes posts outside the window.
  • text: the post text, for copied text, keywords and list posts.
  • author_username, author_id: for author concentration.
  • author_created_at: the account creation date, for the new-account share.
  • author_follower_count: separates large accounts from small ones.
  • language: in this test, 10 TJGC posts were in Arabic.
  • is_repost, retweet_count, quote_count: separate original posts from reposts.
  • links, mentions: outbound links and mentioned accounts, to find links that lead to chat groups.

In Claude Code, create a key with the quickstart, then add the remote MCP server:

bash
claude mcp add --transport http everyinfra https://api.everyinfra.com/mcp \
  --header 'Authorization: Bearer ${EVERYINFRA_API_KEY}'

Then ask: "Use everyinfra_call_api to search X for $TJGC since:2026-09-15 until:2026-10-16. Count posts per day, calculate the top-author share and the cross-account duplicate share, and list the peak day before the suspension."

Errors and charges (all from this test):

  • A single-post request with a link in url: 422 missing_param. The response says to send the numeric id and includes a working example. Not charged.
  • A request body with a JSON error (an extra comma): 422 validation_error. Not charged.
  • A Telegram search with a limit of 100 that took more than 85 seconds: 503 timeout. Not charged. The response suggests a smaller limit or "mode":"async".
  • The same search in async mode: 202 with a job_id and one pre-charge. When the job came back empty, refund_state was refunded and the pre-charge was returned.
  • An empty sync result: 200 with count 0 and billing.reason empty_result_refunded. Not charged. For line-by-line reconciliation, see failure refunds and reconciliation.

What changed in the last 60 days

  • October 23: the SEC's Division of Examinations published its FY2027 priorities. For broker-dealer anti-money-laundering programs, it lists the risks of trading in foreign-based companies. These include "potential market manipulation, such as pump-and-dump/ramp-and-dump schemes". The work is coordinated with the Cross-Border Task Force (SEC press release; priorities report). What it means for you: examiners will ask broker-dealers how they monitor this risk.
  • October 22: SEBI cautioned investors about invitation-only WhatsApp tip groups (PR No. 65/2026, above). What it means for you: the "new group" message is a ready-made keyword.
  • October 19: the ED announced the ₹200 crore freeze (above). What it means for you: the case gives a public, dated timeline to test methods on.
  • October 15: the BC Securities Commission warned about an international ring that promotes stocks with "news" articles. The ring buys Google search ads that lead to 14 news-style websites, which also carry articles that appear AI-generated (BCSC release). What it means for you: monitoring must cover paid search ads and fake news sites, not only social platforms.
  • October 14: the SEC suspended TJGC (above), the 16th suspension in this series. What it means for you: the regulator's list is the best starting watchlist.
  • October 5 and 7: Nasdaq filed two rule changes. SR-NASDAQ-2026-081 moves the start date of a new delisting rule. Under that rule, a company is delisted when its market value of listed securities stays below $5 million for 30 business days. The rule will start only after the SEC's stay ends (SEC notice). SR-NASDAQ-2026-082 removes the $2 to $4 alternative price test on the Nasdaq Capital Market, so every initial listing needs at least $4. Nasdaq says that low prices make securities more susceptible to manipulation (SEC notice). The SEC approved the $5 million rule on July 22 (approval order). On September 11, it granted petitions for review and kept the stay (SEC order; law-firm summary). Nasdaq, SIFMA, Citadel Securities and a small-company coalition filed statements from October 2 to 6 (SEC comment page). Bloomberg reported on October 15 that US small companies oppose a rule aimed at tiny foreign issuers (Bloomberg, paywall). What it means for you: fewer very low-priced listings in the future, but current listings stay on your watchlist.
  • October 6: FINRA fined Revere Securities $800,000. The firm was a lead underwriter or selling group member for small-cap IPOs of foreign-based issuers. More than 40 of these IPOs were for issuers that operated in Hong Kong or China. In one IPO, the stock rose 318% and then fell more than 50% by the close. Eight customers got almost all of the firm's allotment. They sent sell instructions on the same day, from IP addresses outside the countries where they said they lived (FINRA release; AWC). What it means for you: account data and trading patterns remain stronger evidence than social data.
  • October 7 and 13: two new papers. One monitored 83 Telegram channels and 3,677 pump events on decentralized exchanges. It found that many "pumps" were honeypot tokens that buyers could not sell (arXiv 2610.10149). The other is the timestamp study cited above (SSRN 7607818). What it means for you: keep timestamps to the second when you match posts with trades.

Limits of this article

  • X search returns a ranked sample, not every post. Counts and concentration describe what search shows. A formal study needs continuous collection, as in Renault's study. He analyzed millions of tweets about small-cap firms. Abnormally high message activity came with a large price rise on the day and a sharp reversal over the next week.
  • We tested 3 cases that regulators acted on and 1 control. We had no group of stocks without regulatory action, so we cannot calculate a false-alarm rate.
  • One person labeled the 5 skeptical posts and 4 return-story posts in the Indian case, once. Nobody checked the labels a second time.
  • Research on subscription tip services shows the harm to followers. Green and co-authors studied option recommendation services on Discord and found that subscribers earn significantly negative returns after transaction costs (SSRN 7123840). But that study is about options, not the small caps in this article.
  • The SEC set up its Cross-Border Task Force in September 2025 to focus on foreign-based companies and pump-and-dump schemes (SEC press release). The Canadian Securities Administrators' April alert also says these scams often target small foreign-based companies with a limited public float (CSA alert). FINRA's investor guide describes the same move toward encrypted group chats. These are regulator descriptions; we did not check each company ourselves.

Frequently asked questions

How do you spot a pump and dump in public data?

Look for a sudden jump in attention, list bots and skeptical posts that appear at the same time, and posts on several platforms. For TJGC, attention peaked 27 days before the suspension. In the Indian case, the first public doubt came 43 days before the crash. Use these signals to rank tickers for review; a decision needs trade data. (Question from the search suggestion "how to spot pump and dump".)

Can a pump and dump stocks screener run on social data alone?

It can rank tickers, but it cannot confirm anything. In our test, copied text across accounts came from news reposts and large-cap templates, not from the promotion windows. A screener that flags copied text will mostly flag news. (Question from the search suggestion "pump and dump stocks screener".)

Where is the SEC trading suspension list, and what does a suspension mean?

The SEC publishes it on its trading suspensions page. A suspension can last up to 10 trading days, and the release says "potential manipulation". It is not a final finding. Of the 16 suspensions in our count, 15 cite recommendations on social media. (Question from the search suggestion "sec trading suspension list".)

Related reading

References

  1. U.S. SEC, Trading Suspensions, read on 2026-10-25, https://www.sec.gov/enforcement-litigation/trading-suspensions
  2. U.S. SEC, TJGC Group Limited, trading suspension release (Release No. 34-106668), 2026-10-14, https://www.sec.gov/files/litigation/suspensions/2026/34-106668-ts.pdf
  3. U.S. SEC, TJGC Group Limited, order of suspension of trading (Release No. 34-106668), 2026-10-14, https://www.sec.gov/files/litigation/suspensions/2026/34-106668.pdf
  4. U.S. SEC, QMMM Holdings Limited, trading suspension release (Release No. 34-104113), 2025-09-26, https://www.sec.gov/enforcement-litigation/trading-suspensions/34-104113-ts
  5. U.S. SEC, Happy City Holdings Limited, trading suspension release (Release No. 34-105675), 2026-06-11, https://www.sec.gov/files/litigation/suspensions/2026/34-105675-ts.pdf
  6. U.S. SEC, Order approving SR-NASDAQ-2026-004 (Release No. 34-105971), 2026-07-22, https://www.sec.gov/files/rules/sro/nasdaq/2026/34-105971.pdf
  7. U.S. SEC, Order Granting Petitions for Review (Release No. 34-106338), 2026-09-11, https://www.sec.gov/files/rules/other/2026/34-106338.pdf
  8. U.S. SEC, Notice of SR-NASDAQ-2026-081 (Release No. 34-106594), 2026-10-05, https://www.sec.gov/files/rules/sro/nasdaq/2026/34-106594.pdf
  9. U.S. SEC, Notice of SR-NASDAQ-2026-082 (Release No. 34-106614), 2026-10-07, https://www.sec.gov/files/rules/sro/nasdaq/2026/34-106614.pdf
  10. U.S. SEC, Comments on SR-NASDAQ-2026-004, read on 2026-10-25, https://www.sec.gov/rules-regulations/public-comments/sr-nasdaq-2026-004
  11. U.S. SEC, "SEC Announces Fiscal Year 2027 Examination Priorities" (2026-109), 2026-10-23, https://www.sec.gov/newsroom/press-releases/2026-109-sec-announces-fiscal-year-2027-examination-priorities
  12. U.S. SEC Division of Examinations, "Examination Priorities: Fiscal Year 2027", 2026-10-23, https://www.sec.gov/files/2027-exam-priorities.pdf
  13. U.S. SEC, "SEC Announces Formation of Cross-Border Task Force to Combat Fraud" (2025-113), 2025-09-05, https://www.sec.gov/newsroom/press-releases/2025-113-sec-announces-formation-cross-border-task-force-combat-fraud
  14. FINRA, "FINRA Fines Revere Securities $800,000 for Small-Cap IPO-Related AML and Supervisory Failures", 2026-10-06, https://www.finra.org/media-center/newsreleases/2026/finra-fines-revere-securities-800000-small-cap-ipo-related-aml-and
  15. FINRA, Letter of Acceptance, Waiver and Consent, Revere Securities LLC, 2026-10-05, https://www.finra.org/sites/default/files/2026-10/revere-awc-100526.pdf
  16. FINRA, "2026 FINRA Annual Regulatory Oversight Report: Manipulative Trading", read on 2026-10-25, https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/manipulative-trading
  17. FINRA, Regulatory Notice 22-25, December 2022, https://www.finra.org/rules-guidance/notices/22-25
  18. FINRA, "Avoiding Pump-and-Dump Scams" (Investor Insights), read on 2026-10-25, https://www.finra.org/investors/insights/pump-and-dump-scams
  19. Directorate of Enforcement (India), "ED conducts searches at 29 premises in 6 cities in a WhatsApp-based 'pump and dump' fraud in the shares of two listed companies", 2026-10-19, https://enforcementdirectorate.gov.in/media/press-release-documents/45d094ae-454f-4990-859a-8dda735ea2e5_PR_Searche%203%20.pdf
  20. Directorate of Enforcement, X post on the searches, 2026-10-19, https://x.com/dir_ed/status/2112130938616594788
  21. SEBI, "Caution to Investors against Stock Tips offered through Invitation-only WhatsApp Groups" (PR No. 65/2026), 2026-10-22, https://www.sebi.gov.in/media-and-notifications/press-releases/oct-2026/caution-to-investors-against-stock-tips-offered-through-invitation-only-whatsapp-groups_105389.html
  22. BC Securities Commission, "Investor Alert: International ring using 'news' articles to promote stocks" (2026/71), 2026-10-15, https://www.bcsc.bc.ca/about/media-room/news-releases/2026/71-investor-alert-international-ring-using-news-articles-to-promote-stocks
  23. Canadian Securities Administrators (published by BCSC), "Investor Alert: Ramp-and-dump scams surge as fraudulent 'investment groups' target unsuspecting investors" (2026/024), 2026-04-16, https://www.bcsc.bc.ca/about/media-room/news-releases/2026/24-investor-alert-ramp-and-dump-scams-surge-as-fraudulent-investment-groups-target-unsuspecting-investors
  24. Cernera, La Morgia, Mei, Sassi, "Pump-and-Dump meets Honeypot Tokens: Detection and Analysis of Telegram Bait-and-Trap Schemes", arXiv 2610.10149, 2026-10-07, https://arxiv.org/abs/2610.10149
  25. TJ Canann, "When Seconds Are Lost: Timestamp Coarsening in Pump-and-Dump Event Studies", SSRN 7607818, 2026-10-13, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7607818
  26. Green, Jame, Oliphant, Roseman, "Speculation by Subscription: Finfluencers and Retail Option Trading", SSRN 7123840, posted 2026-07-30, revised 2026-09-14, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7123840
  27. Cresci, Lillo, Regoli, Tardelli, Tesconi, "Cashtag Piggybacking: Uncovering Spam and Bot Activity in Stock Microblogs on Twitter", ACM Transactions on the Web 13(2), 2019, DOI 10.1145/3313184, https://dl.acm.org/doi/10.1145/3313184
  28. Thomas Renault, "Market Manipulation and Suspicious Stock Recommendations on Social Media", SSRN 3010850, 2017, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3010850
  29. Mannocci, Mazza, Monreale, Tesconi et al., "Detection and Characterization of Coordinated Online Behavior: A Survey", ACM Computing Surveys, 2026, DOI 10.1145/3839225, https://dl.acm.org/doi/abs/10.1145/3839225
  30. X Help Center, "How to use advanced search", read on 2026-10-25, https://help.x.com/en/using-x/x-advanced-search
  31. EveryInfra, capability catalog GET /api/v1/social/catalog, read on 2026-10-25 at 06:34 UTC, https://api.everyinfra.com/api/v1/social/catalog
  32. Moneycontrol (secondary), "After SEBI, ED crackdown against 'pump and dump' operators, ED raids 29 premises in 6 cities", 2026-10-19, https://www.moneycontrol.com/news/business/markets/after-sebi-ed-crackdown-against-pump-and-dump-operators-ed-raids-29-premises-in-6-cities-14055639.html
  33. Bloomberg (secondary, paywall), "US Pump-and-Dump Crackdown Aimed Abroad Meets Local Protests", 2026-10-15, https://www.bloomberg.com/news/articles/2026-10-15/us-pump-and-dump-crackdown-aimed-abroad-meets-homegrown-protests
  34. Bevilacqua PLLC (secondary), "SEC Grants Petitions for Review of Nasdaq's $5 Million MVLS Listing Standard…", 2026-09-17, https://www.bevilacquapllc.com/blog_/sec-grants-petitions-for-review-of-nasdaqs-5-million-mvls-listing-standard-and-extends-review-period-for-nyse-americans-proposed-5-million-average-market-capitalization-requirement

Reference BL-39