The SEC’s Playbook for Spotting Market Manipulation

Last updated 1 month ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

On January 6, 2026, SanDisk Corporation’s stock jumped approximately 27.6 percent in a single trading day. Behind every dramatic surge sits the SEC’s monitoring systems, analyzing whether what happened represents genuine market enthusiasm or manipulation—pumping up a stock price with fake demand, then selling at the inflated price, coordinated activity to move prices, or using secret company information.

Here’s what happened with SanDisk, and how the SEC’s monitoring systems work when shares do something this dramatic.

What Triggered the Surge

The immediate catalyst was Nvidia CEO Jensen Huang’s keynote at CES 2026 on January 5. Huang described memory and storage as a critical but “unserved market” with accelerating demand and increasing the ability to raise prices without losing customers. He highlighted memory’s importance for AI applications, including the long-context reasoning that advanced language models need.

SanDisk didn’t surge alone. Micron Technology jumped about 10 percent the same day. Western Digital gained approximately 16.8 percent. Seagate rose 14 percent. The entire memory sector moved together.

Coordinated manipulation schemes don’t usually lift an entire sector simultaneously. They target individual companies, often smaller ones with low volume where a relatively small amount of coordinated buying can move the price dramatically. When every major memory company surges on the same day following public comments from an industry leader, that looks like rational market response, not manipulation.

The Surveillance Systems Watching Every Trade

The SEC captures every single order, cancellation, and execution on a millisecond-by-millisecond basis through the SEC’s complete record of every stock trade (called CAT).

Every order you submit through your brokerage app, every institutional trade, every cancellation—it’s all there, timestamped and attributed. The system was implemented to help regulators reconstruct activity and identify manipulation patterns.

CAT captures the kind of granular data that reveals manipulation techniques like spoofing (placing fake buy orders to trick other traders into thinking demand exists) or layering (placing multiple fake orders to fake strong buying interest).

Running parallel to CAT is MIDAS, the SEC’s real-time monitoring system that watches for unusual trading patterns. MIDAS algorithms look for unusual patterns, like trades at prices way different from recent ranges, unusual timing patterns, volume that exceeds historical norms by large margins.

When MIDAS spots something suspicious, it escalates automatically to SEC market surveillance specialists who investigate market manipulation.

What Manipulation Looks Like

In January 2026, the SEC charged three individuals with multiple market manipulation schemes involving pharmaceutical companies. The schemes included impersonating physicians to steal confidential clinical trial data, stealing patient identities to publish falsified trial results, and issuing fake press releases about partnership deals that didn’t exist.

That’s what manipulation looks like: false statements, impersonation, threats, coordinated activity designed to create artificial price movements while concealing the orchestrators’ involvement.

Compare that to SanDisk. The catalyst was a public keynote address by an identified CEO of a major corporation, discussing genuine industry trends, delivered at a major trade show covered by financial media. No impersonation. No false statements. No concealment. Information flowed through normal channels and investors responded to it.

The Insider Question

Another thing regulators watch closely: whether company insiders traded suspiciously before major price movements.

If executives had sold large positions immediately before the move, that would raise red flags. If they’d bought heavily in the days before Huang’s CES comments, that would suggest they had advance knowledge of what he’d say.

The available data showed nothing suspicious. Some congressional members had sold shares earlier in 2025, locking in gains from purchases made much earlier. One congressman had bought shares in August 2025. There was no visible pattern of insider selling into the rally.

Regulators examine Form 4 filings, which publicly report when company executives buy or sell stock, looking for suspicious timing. The absence of such patterns around the move supports the conclusion that this was market repricing based on public information, not insiders exploiting secret knowledge.

The Options Market Told Its Own Story

Options data provided another window into what was happening. On the day after the move, people spent over $10 million on options contracts, dominated by options expiring soon.

Someone spent $1.9 million buying put options (bets the stock would fall below $340 by February 20)—buying insurance against the stock falling. That’s what sophisticated investors do when they’ve made money on a rally and want to protect their gains.

Meanwhile, bets that shares would keep rising to $360 or $380 showed some traders betting the move would continue. The mix of protective bets against losses and bets that the stock would keep rising indicated genuine uncertainty about near-term direction, which is normal after a massive single-day move.

From the regulator’s perspective, this options activity looked like normal institutional behavior—hedging, position-taking, risk management. What would look suspicious is unusual options activity timed precisely before positive news, suggesting advance knowledge. That pattern didn’t appear here.

The Fundamental Reality Behind the Numbers

There was verifiable more demand for memory chips than supply, which justifies higher stock prices.

Morgan Stanley research published on the same day showed the price companies pay for memory chips was expected to jump 40-70% in the next three months—substantially exceeding prior forecasts of 15-23%. Storage chip prices were expected to rise 30-35%, far above earlier expectations of 15-25%.

When memory suppliers can raise prices 40-70% without destroying demand, companies keep more profit from each sale. For SanDisk, which makes NAND flash memory and solid-state drives used in data centers and consumer applications, a 33-38% price increase translates directly to improved profitability.

Huang’s comments highlighted strong demand drivers for memory and storage, particularly from AI applications. Server manufacturers including Dell and HP were planning large-scale capital expenditure increases to build AI infrastructure, implying sustained demand for high-capacity, high-speed storage.

This is the rational foundation that distinguishes a legitimate rally from schemes where people artificially inflate a stock price, then sell at the peak. In manipulation schemes, the price movement has no fundamental support—it’s purely artificial demand created through false statements or coordinated buying. The move reflected investors repricing based on genuine changes in supply-demand dynamics and profit expectations.

Why Enforcement Priorities Matter for Regular Investors

The SEC’s enforcement division underwent significant reorganization in 2025. Acting Chairman Mark Uyeda announced that enforcement resources would focus primarily on fraud and manipulation cases involving customer harm, rather than pursuing purely technical regulatory violations.

Regulators launched a 30-day enforcement sprint in March 2025 to clear backlog of older cases involving compliance issues—recordkeeping violations, reporting failures—where there was no customer harm, fraud, or market abuse.

Regulators also formed a task force in September 2025 to combat cross-border fraud affecting foreign private issuers. This initiative reflected growing concern about schemes where people artificially inflate a stock price, then sell at the peak, disproportionately targeting newly-listed foreign companies with few shares available to the public and with company insiders owning most of the shares. The SEC suspended activity in at least nine Asia-based issuers based on allegations they were targeted by social media-driven manipulation schemes.

SanDisk doesn’t fit that profile. It’s a U.S.-based, well-established S&P 500 component with substantial public float and extensive institutional ownership. The kind of manipulation that works on newly-listed foreign companies with few shares available to trade doesn’t work the same way on large-cap domestic companies with active analyst coverage and deep liquidity.

Analyst Coverage After the Move

After the move, analyst sentiment remained overwhelmingly bullish despite the steep, rapid price increase. China Renaissance had initiated coverage in early December 2025 with a “Buy” rating and $322 price target. Susquehanna had lowered its price target from $50 to $39 in April 2025. Cantor Fitzgerald initiated with a $300 target.

Even the bullish analysts had price targets below where shares traded after the move. Goldman Sachs had a $140 target—considerably more conservative than peers, implying downside of approximately 60% from the post-surge price. Wells Fargo and JP Morgan expressed caution with “hold” ratings and targets of $230-$235, implying downside of approximately 34-36% from the post-surge price.

This analyst divergence is evidence against manipulation. In fraudulent schemes, you sometimes see coordinated analyst cheerleading designed to support artificial price inflation. What you see here is genuine disagreement about fair valuation—different analysts reaching different conclusions about long-term memory demand sustainability and appropriate valuation multiples.

How Exchange Circuit Breakers Work

Nasdaq and the New York Stock Exchange maintain circuit breakers that automatically pause trading when a stock moves too fast, designed to temporarily halt activity when a stock’s price moves more than a certain percentage in a specified timeframe, typically five minutes.

A 27.6% gain spread across an entire session doesn’t necessarily trigger automatic halts. The circuit breakers are designed to catch sudden, compressed price movements—the kind that might indicate a technical glitch or manipulation in progress. A steady climb throughout the day, even if the cumulative gain is large, can occur without triggering halts if each individual five-minute period stays within the thresholds.

On the following day, shares did experience an automatic pause at one point, indicating extreme intraday volatility. Trading ultimately continued higher, suggesting the pause functioned as intended—providing a brief cooling-off period without preventing the stock price settling at what it’s worth based on new information.

Memory Market Dynamics in Early 2026

The semiconductor industry had officially surpassed $1 trillion in annual sales, with growth driven by constant worldwide demand for fast storage and processing power required to power the next generation of generative AI and autonomous robotics. Memory and storage speed became the main thing slowing down AI systems.

This created a period of unusually high demand for storage chips—sustained demand growth outpacing supply additions, giving memory suppliers the ability to raise prices without losing customers they hadn’t enjoyed in years. Industry analysts forecast NAND flash price increases of 33-38% quarter-over-quarter driven by continued undersupply.

When an entire industry faces a long-term shortage of supply, every company in that industry benefits. That’s why SanDisk, Micron, Western Digital, and Seagate all surged together. They were all beneficiaries of the same fundamental dynamic—AI infrastructure demand colliding with constrained memory supply.

Manipulation schemes typically target individual companies with manufactured catalysts. Sector-wide movements driven by genuine macroeconomic trends don’t fit the manipulation profile, even when the gains are dramatic.

What Regular Investors Should Watch For

If you’re trying to distinguish between legitimate rallies and manipulation schemes, here’s what matters:

First, look at the catalyst. Is it public information available to everyone, or mysterious “rumors” from anonymous sources? Huang’s CES keynote was public, recorded, and covered by financial media.

Second, check whether the entire sector moved or one company. Sector-wide movements suggest genuine industry developments. Individual spikes on no news suggest potential manipulation.

Third, examine insider patterns. Are company executives selling heavily into the rally? That’s a red flag. The absence of suspicious insider activity was reassuring.

Fourth, look for fundamental support. Are there verifiable supply-demand dynamics, earnings growth, or industry trends supporting higher valuations? Or is the rally purely momentum-driven with no fundamental basis?

Fifth, watch for false statements. Manipulation schemes often involve fake press releases, impersonation, or fabricated partnerships. Legitimate rallies are triggered by real information from identified sources.

The move checked the right boxes: public catalyst, sector-wide movement, no suspicious insider activity, fundamental support from memory market dynamics, and no false statements.

SEC Enforcement Resources and Priorities

The SEC has limited resources and has to prioritize.

In 2025, Acting Chairman Uyeda reported that the SEC’s enforcement division closed 50% of its open cases, including matters at various stages of investigation and legal action. That represented several hundred matters cleared from the backlog.

The enforcement sprint didn’t generate a large number of case resolutions. Of approximately two dozen firms expressing interest in participation, only about five cases were ready for the SEC to vote on settlement agreements by mid-2025. The proposed settlements reflected updated approaches to reduced penalties for companies that cooperated and imposed fines that were much smaller than what the SEC originally asked for.

Regulators focus on cases involving clear customer harm, fraud, or market abuse. A large-cap company surging on public information following comments from an industry leader, with no evidence of false statements or coordinated manipulation, doesn’t fit the profile of cases the Division of Enforcement prioritizes.

Nasdaq’s New Listing Standards

In December 2025, Nasdaq proposed rule changes granting the exchange discretionary authority to deny initial listings to companies even where the applicant met all stated listing requirements, based on characteristics that could render the securities susceptible to manipulation by third parties.

The rule reflected growing concern about schemes targeting newly-listed companies with few shares available to the public, company insiders owning most of the shares, and involvement by advisors who had participated in prior suspicious transactions. The rule stated that “the SEC’s suspension orders have generally been based on activities of unaffiliated third parties, without any allegations that the companies themselves or persons associated with the companies were involved in the schemes.”

Low float means less liquidity, so coordinated buying can move the price more easily. Concentrated ownership means fewer shares available, amplifying volatility.

SanDisk presented an entirely different profile. Already publicly-traded, S&P 500 component, substantial institutional ownership, deep liquidity. Nasdaq’s new discretionary authority over listings wouldn’t apply to trading of already-listed stocks, and the characteristics that make newly-listed companies vulnerable to manipulation weren’t present.

Order Flow on the Following Day

The day after the move, TradePulse (a service that tracks who’s buying and selling) detected strong institutional buying at $336.55.

At the time of the signal, shares had declined about 4% within the previous hour—profit-taking or technical consolidation after the prior day’s move. Following the signal, both individual and institutional interest shifted decisively toward the buy side, causing shares to rise as much as 5% to reach an intraday high of $353.40 by 2:45 PM EST.

This pattern—institutional buying followed by individual participation—is normal market behavior. Individual traders often monitor institutional order flow and follow large investors into positions. From the regulator’s perspective, this order flow pattern would be interpreted as evidence supporting legitimate price discovery. Large investors adjusting their stock holdings based on new information, with individual traders observing and responding to that institutional activity.

Conclusion

The 27.6% move on that day represented the kind of dramatic price movement that could potentially trigger scrutiny. The specific characteristics—public catalyst, sector-wide movement, fundamental support, transparent information flow, no suspicious insider activity—distinguished it from the manipulation schemes regulators prosecute.

The regulatory infrastructure is sophisticated. The Consolidated Audit Trail captures every order on a millisecond basis. MIDAS flags unusual patterns for investigation. The Division of Enforcement maintains specialized units focused on market abuse. Exchange circuit breakers provide cooling-off periods during extreme volatility.

Surveillance systems and enforcement resources are designed to catch deception—false statements, impersonation, coordinated schemes concealing their orchestrators’ involvement. They’re not designed to prevent legitimate market repricing when genuine fundamental developments justify higher valuations.

The memory market in early 2026 faced tight supply constraints colliding with surging AI infrastructure demand. Memory suppliers had the ability to raise prices without losing customers. When Nvidia’s CEO publicly highlighted memory and storage as critical growth areas at a major industry conference, investors rationally reassessed memory company valuations.

That’s not manipulation. That’s markets working as designed—incorporating new information, repricing securities based on revised expectations, and allowing capital to flow toward opportunities where supply-demand dynamics support higher returns.

For individual investors, you can evaluate dramatic price movements using the same factors regulators examine: Is the catalyst public and verifiable? Did the entire sector move or one company? Is there fundamental support for higher valuations? Are insiders behaving suspiciously? Are there false statements or impersonation involved?

Apply those questions consistently, and you’ll develop better instincts for distinguishing between legitimate rallies worth participating in and manipulation schemes designed to separate you from your money.