How a stranger's brokerage account becomes someone else's pump

In four SEC matters from 2016 to 2025, hijacked brokerage accounts were allegedly used to buy a stock while the perpetrators sold. Account holders lost money; the 2025 complaint adds that sales met other participants' purchases. Cross-border reach appears from 2016, and only the 2022 case charges a large group.

Published 2026-09-15 · 8 min read

In the SEC’s complaint against Idris Mustapha, one paragraph carries most of the mechanism. On 17 May 2016, it says, he caused a victim’s hacked brokerage account to buy the stock of a public company at rising prices, and then sold other shares of the same stock from his own account at a profit. The same computing device, the complaint adds, was used both to get into the victim’s account and to place his own trades that day.

Nothing about the trade in that paragraph is exotic. What is unusual is who was buying.

The technique page sets out the mechanism and the law. This post asks a narrower question of the four SEC matters the library holds: is the harm really two-sided, and did the conduct change over time from a lone actor to organised networks? The first claim survives. The second needs qualifying.

What the four documents say

Each matter, as the SEC’s documents describe it.

Mustapha (2016). The SEC filed on 22 June 2016 in the Southern District of New York. It alleges that Mustapha, a resident of the United Kingdom, hacked accounts of customers of U.S. and non-U.S. brokers in April and May 2016 and traded in the same stocks through his own account, making at least $68,000 while victim accounts lost at least $289,000 (releases LR-23580 and LR-23592; case record). On 5 July 2016 the court granted a preliminary injunction and continued an asset freeze. The library records nothing after that.

Willner (2017 to 2020). The SEC’s October 2017 press release alleged that Joseph Willner, of the Philadelphia area, accessed accounts of more than 100 unwitting victims and made at least $700,000, and noted parallel criminal charges. The October 2020 release describes “dozens” of victims, records a final consent judgment entered on 9 October 2020, and records his guilty plea to conspiracy to commit securities fraud and computer intrusions, and a sentence of six months. Restitution of $897,517 and forfeiture of $350,000 were ordered in the criminal case; the SEC’s disgorgement and interest of $418,581 was deemed satisfied by those orders (case record).

Mohamed, Wong and sixteen others (2022). The SEC filed on 15 August 2022 in the Northern District of Georgia against 18 individuals and entities, naming two further relief defendants. It alleges hackers used at least 31 retail brokerage accounts in late 2017 and early 2018 to buy two microcap stocks, letting holders of large blocks sell at inflated prices for more than $1 million (case record). The library records this as filed.

Kushnarev (2025). The SEC filed on 22 September 2025, also in the Northern District of Georgia. It alleges a scheme from no later than March 2014 to at least May 2021: hundreds of hacked U.S. and some Canadian accounts at no fewer than 10 brokerages, forced purchases in more than 380 securities, and about $31 million in gross proceeds and $1.5 million in net profit from Kushnarev’s own trades (case record). The library records this as filed. Every figure here is an allegation, apart from the Willner outcomes.

The first victim is the account holder

The account holder is the plain case. In the Mustapha complaint, victims did not previously trade the stocks bought in their accounts, the trades were not authorised, and the SEC puts their losses at more than $289,000. It also alleges that his own profit was at least $68,000. The two figures measure different things: the loss to the account holders and the gain to the perpetrator need not match.

In Willner’s criminal case the court ordered restitution of $897,517, per the SEC’s release, which is a court-ordered amount in the criminal case and not an allegation. The release does not break it down by victim.

The second victim is harder to document

The argument that a counterparty is also a victim is a claim about the counterparty’s trade, and the record is thinner on it.

The clearest support is in the Kushnarev complaint. It says his sales of stock would often execute against both the forced purchases in the hacked accounts and purchases by other uninvolved market participants. If that is right, some buyers took the other side of his sales at a price the hacked buying had raised. That is a documented mechanism. It is not a documented loss: none of the four SEC documents read for this post quantifies losses to anyone other than the hijacked account holders.

The legal framing points the same way. Section 9(a)(2), cited in the Willner and Kushnarev matters, prohibits a series of transactions that creates apparent trading or raises a price, for the purpose of inducing others to buy or sell. The provision presupposes those others. That is the law’s account of who else is harmed, and it does not need a measured loss to be charged.

Did lone actors give way to networks?

Partly. The record does not support a clean before and after.

What supports it. The 2022 matter is the only one of the four to charge a large group: 18 defendants and entities, from Alberta, British Columbia, Illinois, the Dominican Republic and Nevis-registered companies, with the SEC alleging that Mohamed coordinated the hacking while others controlled the stock that was sold. The 2025 complaint alleges Kushnarev used more than 20 fake identities to open over 100 accounts, and the release thanks a long list of foreign regulators.

What does not. The 2016 case was not purely local: Mustapha was a UK resident hacking U.S. customers, and the SEC’s description of May 2016 says he acted “alone or in concert with others”. The 2017 release describes a profit-sharing arrangement between Willner and another person. And the 2025 complaint names a single defendant even while alleging that he worked with hackers or unknown persons. What changes from 2016 to 2025 is mainly the period and breadth alleged: weeks in April and May 2016, then late 2017 to early 2018, then more than seven years and over 380 securities. Counts of accounts do not rise in a line: ‘numerous’ in 2016, more than 100 in Willner’s 2017 release, at least 31 in 2022, hundreds in 2025. Whether any trend reflects the conduct or the SEC’s investigative reach, four cases cannot say.

What this tells an investor, and what it does not

It tells an investor that an unexplained rise in a small stock can be built from orders that were never a real investor’s decision, and that the account behind the order may be someone else’s. It does not tell anyone how often it happens. These are four announced actions. The library is not a random sample of manipulation and cannot be used to size it.

For account holders, the practical protection is the dull one: two-factor authentication and trade alerts, and a call to the broker about any trade in a stock you never held. For the rest of the market, the protection is surveillance that looks across accounts, and the SEC’s 2016 release credits its analytics staff with helping the investigation.

One boundary is worth restating. Hijacked-account ramping steals control of accounts to move a price. It is not the theft of an unpublished press release or filing, which is a different technique on this site, and it is not the theft of the account’s cash, which does not need a stock price at all.

Techniques referenced

• Hijacked-account ramping — Hijacked-account ramping is using other people's brokerage accounts, accessed without their consent, to place buy orders that raise the price of a stock the perpetrator already holds, then selling into that price.

Cases referenced

Reviewed September 15, 2026. Spotted an error? Tell us.