Marcus and the Seventeen Accounts.

Marcus came in through the normal funnel. He paid for a two-step evaluation, passed it in eleven trading days, and got a funded account. His first payout came four weeks later. It cleared without a flag. His second payout came six weeks after that, and also cleared. By the end of the quarter he had three payouts banked and a profile the risk team filed under consistent performer.

There were sixteen other Marcus-shaped profiles in the funded book. Not his name. Not his picture. Different countries, different ID documents, different KYC packets that all checked out on their own. What they shared (and what the risk team couldn't see, because nobody had built a view that would show it) was that their trades moved together. Not always. Not obviously. But consistently enough that the seventeen accounts, looked at as a group, made a pattern that no single one of them made alone.

The seventeenth account, the last one onboarded and the newest in the group, was the one that broke it. The trader got impatient. They entered a position two seconds too early, while the signal was still being formed. The timing was wrong. It stood out. When someone finally looked at that account alongside the other sixteen, the shape of the ring came into focus. The entries clustered. The directions aligned. The exits were coordinated. The firm had been funding a small organized operation for nine months.

Copy trading is the most-discussed problem in prop firm risk and the least-solved. Every operator we speak with says some version of the same thing: we know we have it, we just don't know how bad. Most firms have more of it than they think, and it hides in places they're not looking.

Three shapes, not one

A common mistake we see firms make: they treat copy trading as a single pattern and try to build a single rule to catch it. It isn't, and they can't. There are at least three distinct shapes, and they need to be understood separately before they can be handled.

The first shape is accidental correlation. Two or more traders following the same public signal service, the same influencer, the same idea posted on a forum. Their trades look coordinated because the source is coordinated, not the traders. If you breach them, you've breached good traders who made the mistake of reading the same tweet. Every firm does this at least once. The good ones learn to tell the difference.

The second shape is the informal group. A handful of traders, usually three to eight, running a private chat in Telegram or Discord. They trade together, share ideas, and sometimes mirror each other's conviction. It isn't quite a ring. There's no signal generator. But the accounts move in near-unison during active hours, with visible timing offsets as the message propagates through the group.

The third shape is the one firms actually lose money on: the organized ring. One signal generator, many accounts, tight timing windows, and a business model built around the firm's own capital. The Marcus story is this shape. These are the operations that scale to twenty, fifty, or a hundred accounts before they get noticed. If they get noticed at all.

The ring you don't catch this quarter is a ring that's still there next quarter. With more accounts.

What the pattern looks like from the operator's seat

You don't see the ring directly. You see its shadow. An unusual cluster of accounts all passing challenge in the same narrow window. A set of funded accounts whose withdrawal rhythm is eerily synchronized. A group of traders with unrelated profiles who happen to all be online during the same three-hour trading session. None of these, on their own, prove anything. Together, they start to form a shape.

The shadow shows up in places your existing dashboards aren't built to display. Most prop firm tooling is built around the account as the unit of analysis. Rings don't live at the account level. They live in the relationships between accounts. To see a ring, you have to be able to ask your data a question that most systems can't answer: which of my funded accounts behave as if they're connected?

The hardest part isn't detection

It's response. Once you have a confirmed ring, what do you do? Breach all seventeen accounts? Deduct the profits? Publish a statement? Notify the individuals whose KYC was used, some of whom may be unwitting, their documents sold or stolen? Every choice has consequences. Every choice gets reviewed by Trustpilot, by Telegram, by the industry.

The firms that handle this best have three things in common. They have a documented response policy before they need it. They apply it consistently. And they communicate the decision, with evidence, to everyone it affects. Including the traders adjacent to the ring who may be wondering why their payout is being delayed. Silence creates rumor. Rumor creates reputational damage.