More spam made its way to inboxes Monday touting a small Florida company first hit by a massive pump-and-dump spam scam last week. The company has denied any responsibility for the junk mail that drove up its stock price, and said it will look at stockholder data in the hope that it can uncover who was behind the scheme.
Prime Time Group, a Florida-based company that owns and operates convenience and wireless stores in the U.S. and Caribbean, was the focus of a huge spam dump early last week that broke single-day records at several mail filtering vendors. Like other "pump-and-dump" scams, the Prime Time campaign involved fraudsters who had earlier bought shares, then used spam to get others to buy in and drive up the price. When enough did, the scammers took their profits and ran. Investors who believed the bogus e-mails were left holding the bag.
Sophos first noticed the Prime Time run around 11:40 a.m. EDT on Aug. 8. By the next morning, it had stopped more than half a billion messages at its traps alone, said Ron O'Brien, a Sophos senior security analyst.
The spam blast did drive up Prime Time's share price from Monday's low of around 7 cents to Wednesday's high of 11 cents, a 57 percent jump. Thursday morning, however, the bottom dropped out, and the stock fell to under 7 cents. Trading volumes peaked Wednesday as well, at around 1.7 million shares, substantially higher than any day in the month prior.
"You can actually see the wave of activity in the stock," said O'Brien, "and compare it with the volume of spam that we trapped."
Last Wednesday afternoon, Prime Time announced it was ordering a Non Objecting Beneficial Owners (NOBO) list to get a clearer picture of who owned its shares. "The NOBO list will be used to determine the naked short positions in Prime Time Group," the company said in a statement. "The finding will then be reported to the NASD (National Association of Securities Dealers) to take action against the violators of the naked short regulations."
"Naked short" is a investment term that refers to selling short, essentially a bet that the price will drop, but with a twist: "naked" means that the investor sells short without first making sure he can borrow the shares from another investor holding a "long" position on the stock.
On Friday, Prime Time rolled out another statement, this one denying any connection with the pump-and-dump. "Shareholders should be aware that the Company is not the source of any information distributed via bulk e-mail," said Prime Time. "The Company releases information to shareholders on a timely basis, and there are currently no undisclosed material announcements, events or facts with regard to the Company."
O'Brien said he contacted the Missouri Attorney General's office -- Prime Time owns several convenience stores in the state -- on Wednesday in an attempt to get someone to put a stop to trading. "We want to see this kind of activity come to an end, not propagated," he said. His thinking: "If we got it stopped, maybe it would leave [the scammers] holding the bag."
Regulators, however, have never blocked trading of a stock victimized by a pump-and-dump scheme as the campaign was unfolding, O'Brien acknowledged. Part of the reason: the nimbleness of spammers. "They can get out in front of users so much faster than we can," he said.
In fact, it appears that this pump-and-dump isn't over. "We saw a substantial uptick over the weekend, with the messages in FDF files, not PDF," said O'Brien. (FDF is an Adobe Forms format.) The new spam created another spike in the share's price. On Monday, it hit 9 cents early, a penny, or 12.5 percent, increase from Friday's 8 cents, then swung several times before falling to near 7 cents by 4 p.m. EDT. Trading volumes also jumped Monday; as of mid-afternoon nearly 800,000 shares had changed hands.
"This is one of the few times where a pump-and-dump has been sustained," O'Brien said.
Such scams now make up a significant portion of all junk mail, according to Sophos' data. "In 2005, less than 1 percent of spam was pump-and-dump. Last year it was 25 percent," said O'Brien. "It's now fast approaching the numbers for prescription medicines and performance enhancing drugs."
O'Brien also said that there is a "direct correlation" between the Prime Time pump-and-dump run and a widespread attack around July 4 by malware-bearing messages posing as electronic greeting cards. "The machines infected by those attacks are the same ones that were used to relay the [Prime Time] spam," O'Brien claimed. "They set up the infrastructure for the spam more than month before they started sending it."
Although the U.S. Securities and Exchange Commission (SEC) regularly issues trading suspensions, and in March stopped trading of 35 companies tied to pump-and-dumps, a spokesman Monday refused to comment on whether the agency would, or could, step in real-time to halt trading of Prime Time.