Spoofers Tricked High-Speed Traders by Hitting Keys Fast …

Spoofing, sometimes called “layering,” is a form of market manipulation where you pretend you want to sell a lot of stock, and everyone’s all, “Oh in that case I want to sell a lot of stock too,” and the stock goes down, and you actually buy a bit of stock instead, and you wait like a second and then pretend you now want to buy a lot of stock, and everyone’s all, “Oh well now I want to buy a lot of stock too,” and the stock goes up, and you actually sell back the stock you bought, and you make some money because people are sheep.

This strategy is risky — what if people buy stock from you when you’re pretending you want to sell it? — and also sort of irreducibly stupid, as it relies on people robotically assuming that the stock is in trouble when you pretend you want to sell it, and then assuming that it’s a great buy a second later when you pretend you want to buy it. But since most of the people in stock markets these days are robots, relying on them to act like robots can actually work, and you see the occasional lucrative spoofing case where someone builds a robot to out-spoof the other robots.

And then there is Aleksander Milrud, who allegedly built his spoofing robot out of lots of human traders in China and Korea and maybe elsewhere. Milrud was charged with spoofing today by federal prosecutors and the Securities and Exchange Commission, making him by my count only the second person to be charged with criminal spoofing. The claim is that Milrud recruited lots of traders in China and Korea, and then assigned them to spoof stocks from two accounts each. In the “dirty” account, a trader would enter lots of spoof orders to move the market. In the “clean” account, he’d enter a few orders the other way, to take advantage of the market move. The connections between those accounts, and between them and Milrud, were then further obscured by a series of tubes or whatever. The traders could move fast because “Milrud worked with a gaming software company to develop ‘hot keys’ that allowed his traders to quickly place and cancel multiple orders via their computers with only a few strokes of their keyboards.” Because the next best thing to being an algorithm is being a human with a really fancy keyboard.

Milrud ran into trouble when he allegedly tried to recruit a broker to clear his spoofy trades, and that broker was for some reason working for the Federal Bureau of Investigation, and so the broker recorded their meetings, and they are great.

How crazy? Milrud allegedly claimed that he once made almost $600,000 in a single day, which he extrapolated out to $30 to $50 million a month, and you begin to see why he didn’t program an algorithm to do his spoofing for him. Crazy amount of numbers all right.

The SEC complaint describes one particular trade in detail:

Between 10:42:54 AM and 10:43:19 AM, the “dirty” trader ID placed 51 orders to sell Company A stock, with an average order size of 171 shares, gradually decreasing the order price from $75.32 per share to $75.25 per share and placing multiple orders at each of the price levels along the way. During this time, the national best offer for Company A stock (that is, the lowest price at which market participants were offering to sell Company A stock) declined from $75.29 per share to $75.25 per share. Of the total of 8,700 shares that the “dirty” trader ID had offered for sale during this round of manipulation, only 200 shares (that is, approximately 2%) were in fact sold, at the average price of $75.27 per share; this 200-share short position was covered with a purchase of 200 shares at $75.25 per share (that is, a total gain of $4) before the trading reversed course at 10:43:30 AM.

While the “dirty” trader ID was placing layered sell orders, at 10:43:09 AM, the “clean” trader ID placed four orders to purchase Company A stock at $75.25 per share, each for 1,300 shares. After some of those buy orders were filled and the “clean” trader ID had established a long position of 1,807 shares at $75.25 per share, both trader IDs canceled their outstanding orders.

Between 10:43:30 AM and 10:43:55 AM, the “dirty” trader ID placed 60 orders to buy Company A stock, with an average order size of 193 shares, gradually raising its order price from $75.22 to $75.31 and placing multiple orders at each price level along the way. During this time, the national best bid for Company A stock (that is, the highest price at which market participants were offering to buy Company A stock) increased from $75.24 per share to $75.29 per share. Of the total of 11,600 shares that the “dirty” trader ID bid to buy during this round of manipulation, only 400 (or approximately 3%) were in fact bought, at the average price of $75.295 per share; those 400 shares were sold for $75.29 per share (or a total loss of $2) by the end of this round of manipulation at 10:44:00 AM.

While the “dirty” trader ID was placing layered buy orders, at 10:43:39 AM, the “clean” trader ID placed eight orders to sell Company A stock, for a total of 10,000 shares, all priced at $75.29 per share. By 10:43:56 AM, the “clean” trader ID had sold 5,427 shares, realizing a profit of four cents per share on the previously established 1,807-share long position and establishing a short position of 3,620 shares at $75.29. At that point, both trader IDs canceled all their outstanding orders.

That’s from Exhibit 1 of the SEC’s complaint, and it’s followed by seven pages of spreadsheets listing all of the orders and trades. The net result: One stock, just over one minute of work (10:42:54 to 10:43:56), 123 orders and a net profit of $54.

So … what do we think? It’s hard to resist some arithmetic: $54 a minute, 6.5 hours in a trading day, that gets you $21,060 a day if you can do a trade like this once every minute. Of course he had a network of traders; it would only take 29 of them, doing this trade once a minute, to net $600,000 in a day. That’s almost 1.4 million orders a day — 48,000 per trader — but you have hot keys, so it’s not that bad.

If they only had this much success once every five minutes, instead of every minute, then Milrud would need 145 traders, but maybe he had that many? He allegedly told the FBI informant “that he controlled approximately 60 percent of all China-based traders presently engaged in layering,” which is an astonishing claim insofar as, did you know that was an industry? What is the denominator? Are there thousands of people in China spoofing U.S. stock markets, the way that there are thousands of people in China currently working on “gold farming” for computer games? What are the economics of that? How could it be more efficient to employ dozens of human independent contractors on another continent to push buttons than it is to just write some code to automate the pushing of the buttons? Especially since the humans in China are basically trying to deceive robots in the U.S.? And the U.S. robots can push buttons — metaphorical buttons inside their circuits — way faster than the Chinese humans can?

One possibility here is that Milrud was maybe exaggerating his profits by just a weensy little bit. I mean, the $600,000 a day becoming $50 million a month is suspicious, but also there’s a bit of criminal braggadocio in passages like this:

But even if you discount his claims, the SEC does seem to have caught him making money, and if you can make $54 in a minute, however laboriously, you can presumably scale up.

So one upshot of the SEC’s and FBI’s story, if it’s true, is that human beings, acting pretty mechanically, can make risk-free profits by tricking the high-frequency traders who make markets in U.S. stocks. On very liquid S&P 500 stocks. That is quite weird, right? Like, if you told me that some high-frequency traders were defrauding other high-frequency traders, I’d believe you. If you told me that high-frequency traders were defrauding mutual funds, I’d consider it. If you told me that high-frequency traders were defrauding mom and pop investors, we’d have to have a long talk about what it even means to be a “mom and pop investor.” But I don’t even know what to do with the SEC and the FBI telling me that some loosely affiliated guys punching hot keys in China were defrauding high-frequency traders out of millions of dollars. Why would that work?

This is a very appealing case for the SEC and FBI. The problem with prosecuting spoofing is that you need to prove motive: Just entering and canceling a lot of shares, or buying and selling in rapid succession, don’t prove spoofing. Perhaps you had a legitimate motive, and who can look into your heart to find out? But if you conduct multiple conversations recorded by the FBI where you say things like, “[Market participants] see the volume and they see the orders, they are starting to come in … and basically we trade against them. We get them sucked into the stock,” then that is how they get you.

But I have to say that it worries me more than most market manipulation cases. Clever high-frequency-trading firms manipulating each other might be Bad, but you’d expect it to happen sometimes and just hope that the SEC is policing it. But the clever high-frequency-trading firms that run the stock market being out-manipulated by a team of amateurs with fancy keyboards is downright disturbing. I expect that sophisticated manipulation would pose a danger to our markets. But it’s an unpleasant surprise to learn that there’s this much danger from such simple manipulation.

1. The first being Michael Coscia, who has argued that the criminal spoofing laws are “hopelessly vague.”

2. From the SEC complaint:

   17. During an August 27, 2014 meeting with the Broker, Milrud explained that each of his traders used at least two accounts. In one account, each trader primarily placed multiple non-bona fide “buy” or “sell” orders in order to create the upward or downward pressure on the stock price. Milrud described this aspect of the scheme as “the dirty work.” Milrud further explained that each of his traders also used a second account, in which the trader primarily executed the bona fide or “clean” trades — that is, purchases and sales of stocks at prices affected by the “dirty work” of the first account.

   18. To further conceal his scheme, Milrud arranged for each trader’s “dirty” and “clean” accounts to be held at different clearing firms, to mask the illicit coordination between the two accounts.

   19. In addition, Milrud instructed his traders to access the “dirty” and “clean” accounts using different trader IDs (user names associated with the trading software that the traders utilized) and different computers at different IP addresses.

   20. On October 8, 2014, during a meeting with the Broker, Milrud compared his and his traders’ tactic of using multiple accounts, trader IDs, computers and IP addresses to shredding documents. Milrud commented that this “shredding” tactic makes it difficult for anyone to uncover the scheme.

   21. Milrud also inserted multiple layers of middlemen at various stages of the scheme, to mask the true ownership of funds and the true control of various trading accounts that engaged in this manipulative scheme.

3. “CW” is for “cooperating witness,” the broker. Incidentally, the recorded meetings took place at the broker’s office, which seems not to have been in the U.S. (The SEC calls it “offshore”; the FBI says it was “located outside of the United States.”) Milrud is Canadian, so maybe it was in Toronto. He did meet the broker at a New York restaurant in June 2014, and the recording happened in August. I don’t know.

   Also the broker started working with the FBI in July 2012, and I don’t know what that’s about.

4. Remember a month is like 22 trading days, and that $600,000 was an exceptional day and “the profits are not always that high and usually fluctuate.” (This is all paragraph 18 of the criminal complaint.) To be fair he might have meant that he was making six figures a day in his current scheme, but with the new broker he could scale up significantly. Or maybe his math was right and the FBI’s was wrong. I don’t know.

   Incidentally, Virtu Financial, the never-lose high-frequency-trading firm that almost went public last year, makes about $441,000 a day trading U.S. equities, and here is an estimate that total U.S. equity revenue for all high-frequency traders is around $10 million a day.

5. The SEC just says “Company A,” but the FBI explains that it’s Baxter International, a $39 billion market cap S&P 500 company that trades something like $200 million a day with a bid-offer spread of 1 or 2 cents. So these are not fly-by-night penny stocks that he was (allegedly) scamming.

6. Err it might be a bit more than that, the SEC’s bookkeeping in the description isn’t entirely scrupulous. (The “dirty” accounts had some contra-side orders that aren’t specifically counted in the narrative.) But it’s at least 123, and not much more.

7. My initial reaction was that it’s weird that the “dirty,” spoof orders weren’t for many more shares than the “clean,” real orders. How do you move a stock by bidding to buy 11,600 shares at the same time you’re offering to sell 10,000 shares? Part of it — you can read in the FBI complaint — is that the smaller lots on the “dirty” side were meant to mimic retail orders. Part of it might be that the “clean” orders might have been hidden and the “dirty” ones lit, though the complaints don’t allege that.

8. I mean, “net” as in “net revenue,” not “net profits.” Presumably he had expenses? Like — employee compensation? The SEC and FBI are pretty quiet about how he split the money with the people doing the actual trading.

9. Paragraph 10 of the criminal complaint, alterations in original.

To contact the author on this story:
Matt Levine at [email protected]

To contact the editor on this story:
Zara Kessler at [email protected]

Original post: 

Spoofers Tricked High-Speed Traders by Hitting Keys Fast …