Unmasking 'Collaborative Toxic Flow': The 5 Networked Abuse Typologies FX & CFD Brokers Still Don’t Know

Tapaas chief operating officer Andria Orphanidou explains that ‘The source of any toxic flow is rarely new. In most cases, these are active traders. Interestingly, 73% of the trading accounts we recently flagged belonged to known individuals.’

Volatility can be both a blessing and a curse for FX and CFD brokers. Not only does it attract traders eager to catch the momentum, but most worryingly, it attracts abusive traders to brokerage platforms. Typically, abusive trading behaviours escape brokers’ filters, remaining undetected for dangerously long periods.

Tapaas, a cross-broker data intelligence platform, identifies five networked abuse typologies that most brokers and prop firms commonly fall victim to.

A recent report by the data provider shows that during times of volatility, when market conditions change dramatically, either due to a rate decision, a geopolitical event, or commodity supply shocks, the traders who react immediately are not responding to price action.

They are reacting to opportunity, more specifically, the narrow timeframe within which they can derive the most value at the broker’s expense before the pricing model calibrates.

This scenario plays out in three steps. Firstly, trade volume in specific instruments can rise sharply during periods of volatility, reaching up to 25% according to Tapaas data, as both abusers and genuine traders increase their activity.

Secondly, the toxic flow keeps up to speed. Even more so, the volume of so-called ‘toxic’ trades relative to the overall number of orders doubles as abusers take advantage of the elevated volume and wider spreads.

Thirdly, the source of this toxic flow is, in most cases, known yet still anonymous to brokers. As much as 73% of the accounts flagged by Tapaas were known individuals who had moved on to another broker to catch the move.

‘What’s rather concerning, and what one broker cannot possibly have visibility into, is this quick bouncing from one platform to another. In all these cases, brokers knew who these traders were. What they didn’t know was that they had moved on to another broker using different account details,’ Orphanidou said.

Veiled by siloed trading data, the identity of abusive traders remains out of sight. But not out of mind. And this is precisely what Tapaas set out to do – identify abusive traders and reduce their impact on brokers’ order books.

Putting a face to the name

‘As it turns out, abusive traders do not work alone. They have an established network regularly targeting brokers, and their impact on order books is significant,’ Orphanidou added.

There are five main abusive networked typologies as follows:

• Internal hedging (taking opposing positions within the same broker)
• External hedging (taking opposing positions across different brokers
• Prop trading abuse (funded account challenge hedging, which exploits challenge mechanics against live CFD positions)
• Syndicate trading (with two substructures comprising ring and cascade/funnel typologies, coordinating group positioning to move CFD prices).

Once the abuse has been identified, brokers and prop firms can block those users. The question is how to spot abusive behaviour. Tapaas breaks down each of the above.

Internal hedging

Internal hedging is one of the most widespread forms of networked or collaborative abuse. Collaborating traders hold two or more accounts with the same operator. They open opposing positions on the same instrument to neutralise directional risk while reaping other benefits, such as bonuses, rebates, or execution advantages otherwise unavailable to a single account.

From a broker’s standpoint, it looks legitimate, as the positions offset each other. But from a network view, it’s a matter of behavioural fingerprinting. Abusive accounts have a few elements in common, including time correlation, device or IP proximity, and similar order sizing or funding patterns.

Key takeaway: If two accounts consistently take opposing positions on the same instrument with high timing correlation and low net directional exposure, it’s a tell-tale sign of internal hedging.

External hedging

Typically, with external hedging, traders bounce from broker to broker, making the relationship between accounts even harder to detect. One position is profitable, and one is losing, so the net position across brokers remains flat or positive, with the profitable side routed almost always to the broker with worse execution, worse pricing, or weaker detection.

Analysing data from several brokers, Tapaas suggests that around 1-2% of habitual traders worldwide, all with an established recurring trading history, engage in systematic external hedging. At network level, this represents a structural drain of brokerage profits.

According to metrics from the 30th of June 2026, Tapaas’ matching engine screened approximately 626,000 cross-broker account pairs. Roughly 7% of these pairs (~43,000) were given an economic label. Of these, ~26,000 extractor pairs had locked in about $49,000 in a single day, with the most gains concentrated in the busiest hundred pairs. Approximately 16,700 pairs were hedged, of which around 6,400 were clean, two-party pairs. Shockingly, over the trailing month, 183 extracting accounts cashed out $7,500 (median per capita) more than they had actually deposited. At the same time, 1,841 constantly losing accounts were refunded. One of these accounts stood out. Despite losing $5M lifetime, it continued to receive $2.5M in fresh deposits without any withdrawals. This is what Tapaas flags as ‘the signature of a hedge whose winning leg sits outside the network.’

Key takeaway: Cross-broker trade matching on timing is the primary detection signal of abusive trading activity, with an identical match between instrument and position size in opposing directions within two seconds after clock correction. Deeper scanning then confirms ownership through identity signals — device fingerprint, funding source, behavioural pattern — combined with position mirroring across brokerage systems.

Prop challenge abuse

The prop trading sector is not alien to abuse either. The emergence of prop challenges has created a new playground for external hedging actors. The network exploits the asymmetry between challenge accounts and live accounts. Below is a snapshot of what happens behind the scenes:

• A trader opens a challenge account, and the prop firm assumes the risk throughout the entire challenge phase
• Simultaneously, the same trader opens an opposing live CFD position at a retail broker
• If the challenge account is profitable, the trader qualifies for funding, a capital gain with limited downside risk
• The live account hedges directional risk during the challenge, ensuring the trader would not be in a losing position twice.
• In more sophisticated instances, challenge accounts are hedged against other challenge accounts across multiple prop firms.

Key takeaway: Given its diversity, the prop trading ecosystem is perhaps even more prone to trader abuse, with cross-entity data remaining unavailable at scale. The refunding signature is the practical detector here: a chronically losing live account that keeps being refunded is visible on its own, with no visibility into the prop firm required.

With a surveillance system like Tapaas in place, prop firms gain a granular view of these activities – from temporal correlations between challenge accounts and CFD live positions to funding source overlap and behavioural profile matching.

Syndicate trading

Syndicate trading is the most complex and damaging form of abuse across the board. A group of traders, through coordinated efforts, opens positions across multiple trading accounts maintained across several brokers. The cumulative position is often large enough to impact CFD prices, especially in instruments with lower liquidity. Once the price has moved, the group exits, harvesting the most benefits from the price movement.

The July build data shows that this structure is not just a theoretical model. 11,000 accounts were identified across four brokerage firms, and 40% of these had near-sequential registration numbers. This covers roughly a 10,900 account body deriving incentive farming benefits. The median on-book P&L was zero, with a collective lifetime spread cost of cca $16M. Split per month, this means about $0.5 M over the cluster’s history. Those accounts collected $0.7M in negative-balance compensations in a single month, enough to thin out brokerage margins significantly.

A separate cluster within this group, counting 156 large accounts, was identified. Alongside this cluster, 598 hub accounts (the most active of which were synchronised with 957 counterparties in a single day) and a 523-account conduit helped move a shocking $25M worth of brokerage funds in a single month. According to Tapaas data, 98% of said accounts never placed a suspicious trade.

This is a typical example of how syndicate operators exploit the CFD pricing mechanism, influencing the hedging behaviour of brokers (particularly those running B-book models), which, in turn, creates pricing pressure.

Tapaas further identifies two sub-patterns within the syndicate trading model, with a varying impact on brokers’ order books, depending on each network structure – the ring structure and a more complex, cascade or funnel structure.

The ring structure

A closed network of accounts trading with multiple other accounts in an interconnected mesh. No single account coordinates the operation, which makes the structure invisible. Most importantly, each account benefits from and contributes to the collective hedged position. Tapaas defines this as the ‘ring model’. Below is a graphical representation of how it works.

The cascade/funnel structure

One or two coordinating accounts run a hierarchical network, providing timing signals to an execution layer comprising several accounts, which distribute them across a broad base of terminal accounts. The coordinating group is typically the best-positioned one, while the execution layer absorbs the noise and detection risk, and finally, the terminal accounts are disposable. Below is a graphical representation of how it works.

Key takeaway: The wider the trading activity is spread, the more disparate the edges of the network are – confluence between accounts, identity fragmentation across accounts and often broker entities, split positions, and where exploitation actually occurs.

Abusers are well aware of this intelligence gap and the limitations of brokerage surveillance systems and take advantage of these vulnerabilities.

Cross-broker intelligence solutions close this gap. Alongside returning abusers, Tapaas’ findings also confirm that 27% of these operators are new. Their behavioural signatures, timing distributions, order sizing, instrument preferences, and geographic clustering often align with and match typical network abuse patterns.

At a regional level, the study places APAC in the top place in terms of abusive trading practices, with 63% of flagged toxic flow – the most coming from one region, which, once understood, enables risk teams to apply asymmetric scrutiny before orders accumulate.

Final considerations

As traders become more sophisticated, their risk tolerance grows, as does their desire to harvest gains. Often, this comes at the expense of brokers and prop firms. The implications of Tapaas data go far beyond trading history or pattern identification. The signal to CFD industry players is clear. They must pivot from reactive detection to pre-positioned defence if they wish to stay in business.

The question is not whether their order books will be targeted because they will be, but rather who will target them next and what they already know about these prospective abusers. In the broader context of networked abuse, cross-broker visibility is becoming a must-have rather than a good-to-have. Tapaas positions itself at the centre of this shift, identifying toxic trading flow in real time.

For more information about Tapaas and how its surveillance system works, contact the team.