How a stock-tip group chat makes money from your order

How it works

The group costs nothing to join, and that is the first thing to understand about it. A paid alert service earns from subscribers whether its calls work or not; the economics of that kind of seller are in what a stock-alert service's track record proves. A free "investment club" earns from what its members buy.

The FBI's public service announcement of 3 July 2025 sets out the sequence. Clubs are promoted "via social media advertisements or messages", some of the members "may be bots or fake accounts", and the promotions "typically direct victims to secure messaging apps where the group operates." The people behind it "secretly control a large volume of a low-priced stock" and inflate its price "by encouraging investment club members to purchase shares over a period of several weeks or months." Then "the criminals sell off ('dump') their shares at a profit, leaving unsuspecting investors with significant losses as the stock value collapses."

FINRA's investor alert of 9 December 2025 adds how a member is walked into it. The group often begins "by promoting investment in a well-known, actively traded stock" and later moves members "to invest in a low-priced and low-volume exchange-listed stock." Members are told "to open an account at a specific broker-dealer" and are guided "on which stocks and how much to purchase and at what times and prices". In FINRA's words, "at some point, the investors become unable to sell, and the price of the stocks inevitably crashes."

FINRA's pump-and-dump page names the three parts: "the setup (where fraudsters choose their target stock), the pump (where they engage in various tactics to increase the share price), and the dump (where they rapidly sell their stock and cash out)." The member's order belongs to the second part. The first well-known stock, the friendly chat and the early small gains are what make it arrive on time.

Why the chat names your broker, your time and your limit

A tip that only named a stock would scatter members' buying across days and prices. The schemes regulators describe are specific because the timing is the point.

FINRA's 2026 oversight report, written for broker-dealers, describes "investment club scams, in which bad actors invite victims into social media-based investment clubs, directing victims on the time and price to buy certain small-cap securities." Those purchases "occur in conjunction with—and likely cause—price increases in the targeted securities through the use of coordinated limit orders", and they "often coincide with liquidations of shares by accounts presumed to be controlled by foreign bad actors." The same report says the selling accounts are "typically centrally controlled by one or more bad actors that fund the accounts and control the activity in the accounts, sometimes remotely", and that takeovers of other people's brokerage accounts have been used to buy the same stocks.

That is why a group may ask for more than your order:

• Access to your account or your details. The FBI treats a request for "access to your financial account(s)", or an offer of "a financial benefit in exchange for sharing your information or opening an account", as a red flag, because "your information could be used to open an account through which another party can engage in manipulative activity."
• A screenshot of your fill. FINRA's advice is direct: "if someone offering you investment advice asks you to send a screenshot from your account confirming you executed a trade, disengage—this is a common scam tactic."
• More money. FINRA warns to "be wary of suggestions that you borrow money, such as through a home equity line of credit (HELOC)".

Why a registered-looking adviser proves nothing here

Groups borrow the credibility of the regulated industry, and two cases show how far that goes.

In an indictment announced on 14 November 2025, the Justice Department alleges that a Hong Kong businessman and his co-conspirators "created at least 10 shell entities and filed fraudulent investment adviser forms with the SEC on behalf of the companies." According to the indictment, the entities were used to draw investors "through social media and WhatsApp chats" into a Nasdaq-listed company, with promised "returns of 300-500%" and assurances that investors "would be fully compensated for any losses." Foreign brokerage accounts sold the stock "for gross proceeds of as much as $211 million", and on 17 April 2024 the price "collapsed by approximately 88%." An indictment is an allegation; the defendant is presumed innocent. The mechanism it describes is the point here: a filing with the SEC was the costume.

In December 2024 the SEC charged three people with creating websites "impersonating nearly two dozen actual securities brokers and investment adviser representatives at well-known U.S. securities firms", promoted with "fictitious comments from purported clients on social media and in investment group chats". The complaint alleges promised monthly returns of up to 25% and more than $2.9 million taken from at least 28 investors.

So a name that checks out on BrokerCheck is the start of a check, not the end. FINRA's alert asks readers to verify that "the names of the person and the firm, along with their addresses or the locations where they do business, align with your own research", and adds that "many brokerage firms in the U.S. specifically prohibit their registered investment professionals from using encrypted chat groups, like WhatsApp, to conduct business." In the UK, the FCA's clone firm guidance says to check the contact details on its Firm Checker against the ones you were given, and to call 0800 111 6768 if there are none.

What the listing does not tell you

An exchange listing is part of the setup, not a defence against it. FINRA's oversight report says the schemes "primarily involved low-priced exchange-listed issuers with operations in foreign jurisdictions", whose IPOs "typically offered a low amount of the issuers' public float". It also notes the timing: the schemes occur "less frequently at the time of the small-cap issuers' IPOs, and more frequently months after these IPOs", and "the same issuer is subject to multiple suspected pump-and-dump schemes."

A small float is what makes a coordinated set of limit orders move a price at all. How float is counted, and why two sites disagree about it, is in why a stock's float differs from one screener to the next.

The SEC can stop trading for a short time. On 26 September 2025 it ordered trading suspended in QMMM Holdings, then listed on the Nasdaq Capital Market, "because of potential manipulation in the securities of QMMM effectuated through recommendations, made to investors by unknown persons via social media", for the period from 29 September to 10 October 2025. The order attributes the recommendations to unknown persons; it names no one. The SEC's trading suspensions list explains that it can suspend trading "for up to 10 trading days when the Commission determines that a trading suspension is required in the public interest and for the protection of investors." Nothing in it returns money to a member who bought the week before.

What it costs

The 2025 IC3 annual report counts "Investment Club Scams" separately: approximately 1,600 complaints and $160 million in losses for the year. The FBI's July 2025 announcement said that "so far in 2025, the FBI has seen at least a 300 percent increase in victim complaints referencing ramp-and-dump stock fraud from 2024."

For a member, the cost is the gap between the price the chat told them to pay and the price at which anyone will buy afterwards. FINRA's description of the last stage is the reason that gap can be nearly everything: "The speed of the dump can make it difficult for other shareholders to sell their holdings without incurring substantial losses."

What you can do about it

Do not place an order whose time and price someone else set. That instruction is the mechanism, whatever the stock. A group that tells members when to buy and at what limit is describing what it needs from them.

Look the company up before the chat does it for you. On SEC EDGAR, the issuer's own filings say where it operates and when it registered its shares; a site with IPO data such as StockAnalysis shows when it listed. A low-priced stock with foreign operations that listed months ago is the profile FINRA describes, which is a reason to stop, not proof of anything about that company.

Check the SEC's trading suspensions list. A suspension in the stock you were sent, or in others the same group pushed, is public and dated.

Verify the adviser, then ignore the contact details you were given. Search BrokerCheck or the SEC's IAPD, and reach the person or firm only through the address and number you found yourself. In the UK, use the contact details on the FCA's Firm Checker.

Send nothing out of your account. No screenshots of trades, no log-in details, no new account opened through a link from the chat, and no borrowing to buy more.

Report it, even if you did not buy. The FBI asks for reports to IC3 "as soon as possible". FINRA takes regulatory tips, and the SEC's tips and complaints system takes reports of "manipulation of a security's price or volume". In the UK, report to the FCA.

If someone then offers to get the money back, do not pay. People who lost money in a group are contacted again. The FTC's advice is: "Never pay up front for a refund…or for help getting one."