Guy Who Did Avon Hoax Was Terrible at Hoaxes

He lost money every time, but he did it in style. Sort of.

Shadowy Avon.

Photographer: Scott Eells/Bloomberg

Here is the story of Nedko Nedev, a Bulgarian living in Sofia, as told in Thursday's Securities and Exchange Commission complaint against him.

Chapter 1

In 2012, Nedev decided to buy some stock in the Rocky Mountain Chocolate Factory. He bought a total of 5,034 shares "between August 17 and December 18, 2012." Here's how the stock looked over that time:


The SEC doesn't say so explicitly, but it sure looks like he was down on his investment. But, says the SEC, he had a plan. His plan was to set up a fake company, called PST Capital, and register for a login to the SEC's Edgar securities filing system. 1  And then, allegedly, he did this:

On December 18, 2012 at approximately 4:28 p.m., after the market closed, PST Capital uploaded to EDGAR a Schedule TO-C falsely stating that PST Capital had submitted a proposal to Rocky Mountain to acquire all of its stock through a cash tender offer at a price of $13.50 per share. The proposed offer price of $13.50 per share represented a 27% premium over the closing price of $10.60 per share on December 18, 2012. 

That tender offer filing is still on Edgar. It is not a particularly thrilling document; the offer language is generic, and the description of PST is kind of weird ("PST Capital is a private equity firm pioneered 'The Leaders Strategy' - finding and partnering with exceptional leaders as the critical first step in identifying, acquiring and building market-leading companies through acquisitions and organic growth."). But it got the job done: "In response to the filing," says the SEC, "in after-hours trading on December 18, 2012, Rocky Mountain's share price jumped 23% to approximately $13.01 per share."

Except that was the wrong job: Nedev didn't sell his stock in after-hours trading, and by the next morning, Rocky Mountain had "disclosed that there were numerous problems with this proposed tender offer that cast doubt on its credibility," one of the problems being that it was totally fake. And so Nedev was out of luck: 

Nedev did not sell his position in Rocky Mountain after the manipulation, likely because the false document did not cause a large enough price increase during regular market hours, particularly in light of the statement made by Rocky Mountain prior to the opening of the market on December 19, 2012.

Womp womp. Rocky Mountain's price soon recovered from its late-2012 lows: By the end of January 2013, it was back above $12, and it hit Nedev's $13.50 fake tender price by the summer. So Nedev's failure to manipulate it to his profit doesn't seem to have cost him much.

Chapter 2

Emboldened by that failed market manipulation, Nedev (allegedly!) tried another one. In late 2013 and early 2014, he started buying shares of Tower Group. Guess what happened to Tower Group! 


Nedev had accumulated about 385,000 shares, at an average price of about $2.92. On May 13, with the stock at $2.24, the position was worth about $863,000, and Nedev had paper losses of about $263,000. 2  So he allegedly turned to another fake acquisition proposal to bail him out. This time Nedev didn't bother with Edgar:

On May 13, 2014 at 12:26 p.m., a fraudulent press release was issued in the name of a company called Euroins Insurance stating that the company had submitted a letter to Tower Group proposing to acquire the company's outstanding stock for $3.75 per share, which represented a premium of approximately 67% for Tower Group's shares. The press release listed an address for Euroins Insurance in Sofia, Bulgaria.

That press release is still on Business Wire, and it is at least as persuasive as the Rocky Mountain Chocolate Factory one, though it is also not much more persuasive. Once again, Nedev's proposal had a dramatic but short-lived effect. Tower "traded at a high of $2.97 per share on May 13, 2014, over 32% higher than the opening price of $2.24 per share that day," but not for long:

twgp gip

And once again, Nedev ... just sort of dropped the ball?

On May 13, 2014, approximately 25 minutes after the issuance of the fraudulent press release, between 12:51 p.m. and 12:55 p.m., Nedev sold 80,000 shares of Tower Group stock at an average price of approximately $2.53 per share, which was approximately 13% higher than the opening price that day of $2.24 per share. Taking advantage of this market manipulation, Nedev received approximately $23,368 more than he would have received absent the artificial increase in Tower Group's stock price. Nedev executed these trades from Bulgaria.

He sold 10,000 more shares at 1:02 at $2.48 per share. The stock closed that day at $2.28, a few pennies above where it started. So to recap:

  • He bought 385,675 shares for a total of about $1,126,000.
  • He sold 90,000 shares for a total of about $227,000.
  • He was left, at the end of the day on May 13, with a total of 295,675 shares worth $674,000.

So by my math he was still out $225,000. The SEC points out that, by selling a quarter of his position at slightly elevated prices after his hoax press release, he avoided $25,768 worth of losses, versus Tower's opening price that day. Umm, super? Tower never saw $2.92 again, and was ultimately acquired in September for $2.50 per share. Assuming that Nedev held his remaining shares until then, his total losses on Tower were a more modest $160,000 and change.

Chapter 3

This keeps going for some reason! At this point Nedev was apparently drunk with hubris after pulling off two entirely unsuccessful and money-losing stock manipulations. So he got cocky and went after one last score, which would prove to be his undoing. The target was Avon Products. He started trading Avon stock in November 2012, and by May 14, 2015, he had a position worth about $183,000, mostly in the form of contracts for difference (unfunded bets on the stock price) rather than actual stock. 3  Of course Nedev had accumulated paper losses of about $88,000, because he was just terrible at investing:


So obviously he decided to fix this problem the way he had utterly failed to fix his previous problems: fake tender offer! You probably know about this one; we talked about it here last month. He signed up for Edgar (as "PTG Capital," which is like TPG Capital only fake), filed a fake tender offer document with the SEC (still on Edgar here), drove the stock up, waited for it to come back down, and then sold a fraction of his shares at what was still a loss:

On May 14, 2015, approximately 25 minutes after the filing of the false Schedule TO-C, between 11:59 a.m. and 12:04 p.m., Nedev sold 12,000 Avon CFD at an average price of $7.01 per CFD contract. Taking advantage of this market manipulation, Nedev received approximately $4,879 more than he would have received absent the artificial increase in Avon's stock price. Nedev executed these trades from Bulgaria. Nedev's unsold Avon CFD and Avon shares also greatly increased in price through this market manipulation.

The stock was at $6.60 when he filed his fake offer, was up to $8.00 shortly afterward, and was back down to $7.01 when he sold. He had bought his shares, meanwhile, at an average price of about $9.78. 4  So he sold those 12,000 shares worth of CFDs at a loss of about $33,000. But of course if he hadn't filed his fake tender offer and had just sold at $6.60, he would have had a loss of about $38,000. So ... awesome work?

He seems to have kept the rest of the shares. Avon closed Wednesday at $6.49, giving his position a value of about $102,000. His total losses on Avon seem to be about $85,000 out of his initial $271,000 investment, or about 31 percent.


What have we learned? First of all, the SEC made impressively quick work of catching Nedev, at least measured from the Avon hoax. The complaint tells a story of decent detective work, matching IP addresses and trading records to connect Nedev's trading to the manipulative hoax filings. Obviously this conclusion is contingent on the SEC being rightIf Nedev was just coincidentally trading in Sofia at the same times another Sofia resident was making fake filings, then this detective work becomes considerably less impressive. 5 (He did keep losing money on the manipulations, after all.) In any case it is fast, though.

Second, a lot of the reaction to the Avon hoax has been about how easy it is to make a fake SEC filing. The SEC's Form ID, which you need to fill out to get an Edgar login, is just two pages long, and the requirements are not especially onerous:

As part of the application process, each applicant creates a unique passphrase and must provide: the applicant's name; mailing address; state of incorporation; person to be contacted; and other information. The Form ID must be signed by a duly authorized person, such as an authorized attorney-in-fact for an individual or an officer or director in the case of a company, and notarized.

The SEC does not, it is safe to say, put a lot of time into checking these requirements. Here's how the SEC describes PTG Capital's Form ID:

On this Form ID, PTG Capital stated that the company was incorporated in the British Virgin Islands and that it had a mailing address in London, United Kingdom. The Form ID contained a signature purportedly notarized by a notary located in Ventura County, California. The notarization was falsified.

Umm, oops? Obviously it is not great that Edgar is so susceptible to false documents. But consider that Nedev's Tower Group hoax, which was done via press release rather than Edgar filing, worked just about as well, which is to say terribly, as his Edgar-based Avon and Rocky Mountain Chocolate hoaxes. Edgar is just an online place to file securities documents; it is not a place to file securities documents vouched for by the SEC. Any announcement, however fake, on Edgar or otherwise, has the potential to briefly influence stock prices; I'm not sure that provides much of a reason for the SEC to start laboriously verifying all Edgar filings. More useful would be (1) for exchanges to halt trading if it gets too crazy, (2) for companies to communicate quickly and accurately about hoaxes, and (3) for the SEC to quickly catch hoaxers to deter future hoaxers. By these standards, Avon looks like a success story.

Also of course if the hoaxers that the SEC catches were terrible at running stock hoaxes and lost a lot of money doing it, so much the better! Because really the main conclusion that you should take from Nedko Nedev's (alleged) experience is that market manipulation is dumb and you shouldn't do it. 

This column does not necessarily reflect the opinion of Bloomberg View's editorial board or Bloomberg LP, its owners and investors.
  1. Paragraph 47:

    On or about December 13, 2012, PST Capital submitted a Form ID to EDGAR as part of its application for a logon. On this Form ID, PST Capital stated that the company was incorporated in the British Virgin Islands and that it had a mailing address in London, United Kingdom. It also included a contact email address that is registered to an ISP in Bulgaria. The Form ID contained a signature purportedly notarized by a notary located in Napa County, California. The IP address used to submit the Form ID is registered to an ISP located in Sofia, Bulgaria. PST Capital was subsequently granted access to file documents on EDGAR.

  2. These figures are taken from paragraphs 39 and 40 of the complaint, summing figures for Nedev's two accounts as "Strategic Wealth" and "Strategic Capital." The $2.92 is my math.

  3. Paragraphs 21-24 of the SEC complaint:

    A contract for difference ("CFD") is an agreement between two parties to exchange the difference in value of an underlying stock between the time the contract is opened and the time at which it is closed. If the share price increases for the underlying security, the seller pays this difference to the buyer. If, however, the underlying share price declines, the buyer must pay the seller the difference. CFDs generally are not traded in the United States, but they are frequently traded outside the United States and tied to underlying securities traded on U.S. based exchanges.

    A CFD typically mirrors the movement and pricing of its underlying stock on a ddllar-for-dollar basis, such that any fluctuation in the market price of the underlying security is reflected in the unrealized gain or loss of the CFD position.

    Generally, the purchaser of a long CFD position benefits by acquiring the future price movement of the underlying common stock without having to pay for or take formal ownership of the underlying shares.

    Generally, the buyer of a CFD is not required to pay for the underlying shares of the security. Instead the CFD buyer only pays the transaction fees charged by the CFD provider plus a potential payment based on any decline in the value of the underlying asset. Thus, a CFD, like a stock option, allows a trader to recognize significant value from an underlying equity's price increase without having to pay for the underlying share.

    For simplicity in the text I treat CFD notional as equivalent to physical stock notional.

  4. My calculations based on paragraphs 30 and 32 of the complaint, counting both shares and CFDs as shares. By my math his shares had an average basis of $9.54 and his CFDs an average basis of $9.79; obviously he didn't "pay" $9.79 for them, but that seems to have been the average strike price. Or something like that; I don't know how the SEC is counting CFD fees, etc.

  5. Or if Nedev wasn't really the one trading, or if the manipulations didn't really occur in Sofia, etc.

To contact the author on this story:
Matt Levine at

To contact the editor on this story:
Stacey Shick at

Before it's here, it's on the Bloomberg Terminal.