How to Hide a Spoof: Inside the Mingran Wang Case

Blog • Surveillance • 13 Oct 2026

Conor Jones

Welcome to the next instalment in Data Intellect’s Market Misconduct Case Files series.

This week, we look at the SEC’s case against Mingran Wang, a California-based day trader accused of conducting a multi-year spoofing scheme across more than 150 thinly-traded American Depositary Receipts (ADRs).

According to the SEC, between October 2021 and at least November 2024, Wang placed thousands of orders that he never intended to execute. Those orders allegedly moved the National Best Bid or Offer in his favour, allowing him to buy or sell ADRs at artificial prices through accounts held at a different brokerage. The SEC claims the scheme generated approximately $1.3 million in illegal profits.

The mechanics of the alleged wrongdoing are interesting, but what makes this case particularly striking is the evidence of intent and concealment. The SEC’s complaint refers to a series of documents stored on Wang’s personal computer in which he allegedly describes how to push prices, select suitable securities, disguise his trading pattern, explain away cross-trades if challenged, and potentially resume the strategy in 2026 or 2027. In one note, Wang allegedly wrote that the “most important thing is to hide”. These documents represent a unique glimpse into the thought process of a spoofer, and are potentially of great value to trade surveillance analysts and those designing detection models, so we hope they will see the light of day in due course.

The scale of Wang’s involvement in some of the affected securities is equally remarkable. In the SEC’s detailed example involving the ADRs of Japanese manufacturer Mabuchi Motor Co., Ltd., Wang’s activity apparently accounted for 100% of the trading volume in the security on two consecutive days.

Link to SEC Complaint

The Alleged Wrongdoing

The misconduct centred on thinly-traded ADRs. ADRs are US-traded securities that represent shares in foreign companies, allowing investors to gain exposure to those companies without buying their shares directly in the relevant overseas market. The SEC claims Wang targeted more than 150 of these securities.

Thinly-traded securities typically have lower trading volumes, fewer active buyers and sellers, and wider spreads between the National Best Bid (NBB) and National Best Offer (NBO). This means that a relatively small number of orders can influence the best displayed prices and make these securities particularly susceptible to manipulation.

According to the SEC, Wang’s strategy followed three basic steps:

  1. Place non-bona fide orders to move the market.
    Wang allegedly placed a rapid sequence of visible limit orders for an ADR on one side of the market. These orders were entered either above the existing NBB or below the existing NBO and were intended to create a false impression of buying or selling interest. The orders allegedly moved the best displayed price even though Wang did not intend for them to execute.

  2. Trade on the opposite side at the manipulated price.
    Once the NBB or NBO had moved, Wang allegedly bought or sold the ADR through a different brokerage account. Many of these genuine trades were executed through an account in his wife’s name over which Wang had trading authority.

  3. Cancel the original orders.
    After completing the genuine trade, Wang allegedly cancelled the outstanding price-moving orders, typically before they could execute.

The use of separate brokerage relationships is an important feature of the case. According to the SEC, Wang submitted the spoof orders through accounts at one brokerage while entering the genuine, profit-seeking trades through accounts at another. This separated the two sides of the overall strategy and made the relationship between the manipulative orders and the beneficial trades less immediately apparent to either firm.

The Mabuchi Motor Example

The SEC’s complaint provides a detailed worked example involving the ADRs of Mabuchi Motor Co., Ltd., a Japanese manufacturer whose ADRs trade on US over-the-counter markets under the symbol MBUMY.

The alleged trading took place across 23 and 24 January 2023. On the first day, Wang used sell orders to push the offer price down before purchasing 4,400 shares. On the following day, he reversed the strategy by using buy orders to push the bid price up before selling those shares.

23 January 2023: pushing the offer down

At 10:16:48 a.m., Wang entered an order to sell 100 MBUMY shares at $7.33, below the prevailing NBO of $7.38. Four seconds later, after the NBO moved to $7.33, he cancelled the order.

Over the following 27 seconds, Wang continued entering and quickly cancelling further 100-share sell orders at progressively lower prices. The order prices moved from $7.33 to $7.28, $7.23, $7.18, $7.13, $7.08 and then $7.03. Most of these orders remained open for only three or four seconds.

According to the SEC, the sequence reduced the NBO from $7.38 to $7.04 and brought the midpoint between the NBB and NBO down to approximately $6.86. Wang then left one final sell order open at $7.05.

Between 10:29 a.m. and 10:53 a.m., Wang allegedly used an account in his wife’s name at a different brokerage to purchase 4,400 MBUMY shares at prices between $6.865 and $6.87. At 10:57 a.m., after completing those purchases, he cancelled the remaining sell order.

24 January 2023: pushing the bid up

The following morning, the SEC alleges that Wang reversed the process.

Beginning at 9:37 a.m., he placed and rapidly cancelled a series of visible buy orders above the prevailing NBB. These orders increased the best bid from $6.65 to as high as $7.00 and raised the midpoint between the NBB and NBO from $7.075 to as high as $7.205.

Wang then began selling the 4,400 MBUMY shares he had acquired the previous day. According to the complaint, he sold:

  • 600 shares at $7.205;
  • 2,200 shares at $7.15;
  • 1,300 shares at $7.15; and
  • the remaining 300 shares at $7.15.

During the selling process, Wang allegedly continued placing, maintaining and cancelling buy orders on the opposite side of the market. At 11:21 a.m., after all 4,400 shares had been sold, he cancelled the final outstanding buy order.

The SEC calculates that Wang generated approximately $1,270 in illegal profit from these two days of trading. More significantly from a market-integrity perspective, the SEC states that Wang’s activity represented 100% of the trading volume in MBUMY on both 23 and 24 January 2023.

This was therefore not simply a participant attempting to marginally influence an active market. According to the SEC’s case, Wang was effectively the market in MBUMY on those two days, submitting the orders that moved the displayed prices and executing every reported trade in the security.

Wang’s Notes

The most damning and unusual element of the SEC’s complaint is the collection of notes found on Wang’s personal computer.

In market-manipulation cases, intent is often inferred from order placement, cancellation rates, price movements, execution patterns and the timing of genuine trades. Sometimes there is a smoking gun trail of communications traffic referring to the illicit activity. In this case, the SEC claims Wang documented the alleged strategy, his methods of concealment and even the explanations he might provide if questioned.

One document created around October 2021 reportedly contained an “action plan” for Wang’s ADR trading. It instructed him to check the securities on his “symbol-to-try list”, then “push down ask-price, and wait for a few minutes to buy”. Another document from around the same period allegedly stated that an important factor in selecting an ADR was “how much I can push the bid up!!”

A separate note discussed combining the strategy with fundamental information. Wang allegedly wrote that he should spend more time understanding the fundamentals of the ADRs because, if he could combine fundamental news with the trading strategy, it would be “extra powerful” and would “look more real too”.

“Most important thing is to hide”

Another of Wang’s documents fascinatingly sets out several practical methods for concealing the activity. It begins:

“Most important thing is to hide, so several ways”

The note then reportedly identifies the following methods:

  • Randomise the pattern as much as possible, including trade size, position size and holding time;
  • Reduce the frequency of trading, even though doing so would sacrifice gains;
  • Hold positions for longer or delay unloading them;
  • Split the unloading of a position across two days;
  • Rotate between different symbols; and
  • Trade around company fundamentals where possible.

The same note allegedly includes a prepared response for questions about cross-trading with his own account on another exchange. Wang considered saying that he had forgotten about an order entered elsewhere or that he had accidentally clicked “buy” instead of “sell”, adding in brackets that the second explanation might be better.

A document dated 9 July 2022 reportedly reiterates that “it is important to hide my actions, and that requires having some losses!!” It also describes a plan to press down the ask price before buying and boost the bid price before selling.

What if he was caught?

Other notes allegedly show Wang considering the consequences of detection.

According to the complaint, undated materials created in late 2024 or 2025 refer to one brokerage scrutinising his accounts as part of an anti-money laundering review. Wang noted that the brokerage’s questions appeared to relate only to AML and not to his trading, while another broker had blocked outflows but had “no clue” because he had not made money through that account.

The notes also refer to a Wikipedia page concerning spoofing and enforcement actions against individuals accused of spoofing. Despite this, Wang seemingly reassured himself that the likely “worst case” was a financial penalty, potentially involving the surrender of his 2024 gains plus an additional penalty. He also recorded that the most likely outcome would be civil charges.

Wang allegedly prepared potential explanations for the trading itself. The notes suggested that he could claim to be trading based on news or a discount to the previous closing price, and that he “doesn’t know layering or spoofing or those things!!”.

Although the alleged spoof trading stopped in or around November 2024, that may not have marked the end of Wang’s intention to use the strategy. The SEC refers to notes outlining “possible strategies in 2026 or 2027 if needed”. A January 2025 note stated that hiding the activity would remain the primary focus and considered trading less frequently but in larger amounts, while disguising the activity within volatile movements caused by US indices, foreign exchange, macroeconomic events or company-specific news.

Finally, when US Postal Inspectors searched Wang’s residence in July 2025, they reportedly discovered two books titled A Convicted Stock Manipulators Guide to Investing and How Stocks Are Manipulated. During the same search, Wang told investigators that he had tried “to walk the price up [to] my advantage” to increase his trading profits.

Case History

The SEC alleges that Wang began the spoofing scheme in or around October 2021 and continued until at least November 2024. Across that period, he allegedly manipulated more than 150 thinly traded ADRs, placed thousands of market-moving orders that were subsequently cancelled, and generated approximately $1.3 million in gains.

The complaint also identifies an earlier warning that the SEC considers relevant to Wang’s knowledge. In 2016, one of Wang’s brokerages flagged potential wash trading involving Wang’s account and an account held by his brother but controlled by Wang. A compliance representative warned him that where related accounts or accounts under common control appeared on both sides of a transaction, the activity could, depending on intent, violate exchange rules or the Securities Exchange Act.

On or around 24 July 2025, US Postal Inspectors searched Wang’s residence. The search recovered the notes and books described above, while Wang admitted using orders to walk prices upwards for his own advantage.

On 24 June 2026, the SEC filed its civil complaint in the US District Court for the Northern District of California.

The SEC alleges that Wang violated:

    • Section 17(a)(1) and Section 17(a)(3) of the Securities Act of 1933: Prohibits fraudulent schemes and practices in connection with the offer or sale of securities.

    • Section 10(b) of the Securities Exchange Act of 1934: Prohibits the use of manipulative or deceptive practices in connection with the purchase or sale of securities.

    • Rule 10b-5(a) and Rule 10b-5(c): Prohibits schemes to defraud and any practice or course of business that operates as a fraud or deceit in connection with securities transactions.

    • Section 9(a)(2) of the Exchange Act: Prohibits transactions intended to create apparent trading activity or raise or depress a security’s price to induce others to buy or sell.

The SEC is seeking permanent injunctions, disgorgement of allegedly ill-gotten gains plus prejudgement interest, and a civil monetary penalty. It is also seeking a conduct-based injunction that would prevent Wang from opening, maintaining or trading through brokerage accounts in his own name, the names of immediate family members, companies he controls or third parties, without first providing the relevant broker-dealer with copies of the complaint and any judgment entered against him.

At the time of writing, the allegations in the SEC’s complaint remain allegations and will need to be determined by the court.

Data Intellect’s Views and Takeaways

  • The notes are a rare written playbook for market manipulation.
    Surveillance professionals are accustomed to reconstructing intent from data. High cancellation rates, short order lifetimes, repeated price movement and opposite-side executions can all support a spoofing investigation, but the intent behind an order is often contested. Here, it seems that Wang wrote down how to push the ask lower, boost the bid, identify suitable securities, conceal the pattern and respond if questioned. If authenticated and accepted by the court, those notes would provide unusually direct evidence of both intent and awareness.

  • Low absolute order sizes can still create significant market impact.
    Many of the MBUMY spoof orders highlighted by the SEC were for only 100 shares. Viewed purely through an absolute-volume threshold, those orders might appear immaterial. In an illiquid security, however, a 100-share order can become the NBB or NBO and materially change the quoted midpoint. Surveillance calibration therefore needs to take account of liquidity, spread, displayed depth and the order’s contribution to the market, rather than relying solely on fixed volume thresholds.

  • Being 100% of the trading volume should be treated as an exceptional risk indicator.
    Wang’s activity allegedly accounted for every MBUMY trade on both 23 and 24 January 2023. Participant concentration at that level provides important context, particularly when combined with repeated quote changes, rapid cancellations and opposite-side executions. Controls should be capable of identifying when one customer dominates trading in an illiquid security and then examining whether that customer is also controlling the surrounding price formation.

  • Cross-broker execution created a significant detection challenge.
    The alleged spoof orders and genuine trades were routed through different brokerages, with many beneficial trades entered through an account in Wang’s wife’s name. Each broker may therefore have seen only one side of the behaviour. One firm might observe repeated cancelled orders without the resulting profit; the other might observe apparently successful executions without the orders that created the favourable price. This reinforces the advantage regulators and market operators have through access to cross-firm and cross-market data.

  • The alleged plan to accept losses is particularly important for model design.
    Surveillance controls sometimes use profitability or a high success rate as supporting evidence of abuse. Wang apparently recognised this vulnerability and considered taking losses to make his behaviour more difficult to identify. Profitability remains relevant, but the absence of consistent profits should not automatically clear a suspicious order pattern where the market-impact and cancellation evidence remains strong.

  • The case shows the limitations of reviewing individual alerts in isolation.
    A single 100-share order that is cancelled within seconds may be explainable. The broader sequence is harder to dismiss: repeated orders progressively moving the best price, execution through a connected account on the opposite side, cancellation after completion of the genuine trade, and repetition across numerous thinly traded securities. Effective surveillance needs to reconstruct the entire strategy rather than judging each order or alert independently.

Share this:

LET'S CHAT ABOUT YOUR PROJECT.

GET IN TOUCH