“Robinhood and WallstreetBets” are warning signs.

Check this post by u/Moonyachs showing a $1 million equity position leveraged from just $4000 deposit.

A much worse problem with the Premium Gold service of the Robinhood app was exploited later by around twenty r/WallStreetBets members in November 2019. As described by Business Insider it involved the following exploit –

• “Users who pay a premium for Robinhood Gold sell call options with money borrowed in the app (a loan know as a margin or leverage).
•  Robinhood incorrectly adds the value of the options sold to the user’s cash pile.
• This gives the user more capital to trade with, and the more a user borrows, the more the app adds to their buying power.
• There seems to be no limit to how much a user can exploit the trick.

Call options (in the above case “covered” call options) are contracts that allow the buyer to purchase a stock at a set price at future expiry date. A seller (or “writer”) sells for a fee the right to buy the stock (which they must sell if the buyer asks for it), the hope being that the underlying stock will always remain below the agreed purchase price (known as the exercise price) and thus the option will expire unused – the seller pocketing the cash made from selling the option and retaining the stock.

The bug in this case was that the more the user borrowed to sell call options, the more the app added this to their balance and thus the more the app allowed them to borrow. The original discoverer of the bug, u/ControlTheNarrative, used the flaw to write $50000 worth of Apple put options from a $2000 deposit. One user, u/MoonYachts, was able to borrow a margin of at least $1 million for an original sum of $4000! The user u/Cal_Warrior went even further, turning a $3000 deposit into a position of $1.7 million! They wrote, “After seeing people on the almighty wallstreetbets wager a timid 50k or so on average with this new feature available, I thought it was only a clear choice to raise the average for the good of all.”

Overall about twenty members used the bug to borrow larger sums than were allowed, getting the cue from posts in the subforum. A user u/SocioButt even posted a “Hall of Fame” of users exploiting the bug. It took days for Robinhood to find out and release a patch to fix the bug and communicate with customers and there was no guarantee that it could claim losses from people who used the exploit and lost money. Robinhood also ran the risk of falling foul of regulators such as the SEC and FINRA along with the costs required to take legal action to claim back the funds.

Badly Displayed Losses Resulting in the Suicide of Alex Kearns

In June 2020 the student and budding retail trader Alex Kearns tragically committed suicide after seeing a negative cash balance of $730 000 in his Robinhood Margin (i.e. loan) account. According to his family, later that night the company sent an automated email demanding Alex take “immediate action,” requesting payment of more than $170,000 in just a few days.

A note left by Kearns to his family stated the following – “How was a 20-year-old with no income able to get assigned almost a million dollars worth of leverage? There was no intention to be assigned this much and take this much risk, and I only thought that I was risking the money that I actually owned. If you check the app, the margin investing option isn’t even ‘turned on’ for me. A painful lesson.”

Bill Brewster, a relative and analyst at Sullimar Capital, publicly criticised how the app displayed temporary debt exposure, stating “I’d like them to fix the way that they’re showing exposure — I want them to act as a financial platform should act. When you’re dealing with retail money and actively soliciting traders under 30 years old to have errors like this is inexcusable and at the minimum negligence.” Robinhood responded by offering to make changes to their in-app messages and history page to make the mechanics of trading options clearer, along with providing more stringent eligibility requirements and better educational resources for new investors. However, William Galvin, the chief financial regulator in the state of Massachusetts, found over 600 instances of people in the state who should never have been approved for options trading by Robinhood’s own standards but were. CBS News confirmed how easy it was to get around Robinhood’s eligibility checks by simply “upgrading your experience”.

Alex Kearn’s family have since filed a lawsuit for wrongful death against Robinhood.

Implications for Testers, Quality and Risk Management

The badly displayed temporary debt in the UI and poorly written automated messaging created a tragedy for a brand new trader like Alex Kearns. Robinhood app created the situation where easy access to risky options trading resulted in tragic consequences as well as permanently damaging the company’s reputation. That such a thing was allowed to happen and not flagged up by Robinhood’s internal processes is nothing short of disgraceful and a moral failure.

One way that could have improved the interface such as to prevent the above would have been to apply persona-based tests – testers creating personas to study the app interface, emails and warning messages from the perspective of new retail traders lacking experience and financial expertise.

The “Infinite Leverage” flaw, in particular, highlighted the speed at which bugs are made public and exploited in online forums along with the motivations in which anonymous exploiters use the bug to one-up each other online. Suddenly issues that may carry one risk if an individual does it are much graver when social media is taken into account and lots jump on the bandwagon. They also carry new reputational and regulatory risks when forum posts go viral and are reported in the press.

In effect, brokerages and companies reliant on traders in groups like r/wallstreetbets need to be aware that the spotlight is always on them and mistakes and errors will be found out and the word spread quickly. The costs of failure are thus potentially enormous and testers and developers working on these apps have to always be “on the ball”. They also need a real understanding of the users coming to their apps, along with their levels of experience, and the social media worlds they inhabit and are influenced by.

The lesson gained from r/wallstreetbets and other groups of small retail traders in their Gamestop short squeeze is that they are realising their immense latent power and acting in ways that institutions on Wall Street would never have predicted. This includes using apps and brokerage tools to make incredible purchases together which makes collusion difficult to prove and police. This does not just affect shorting hedge funds but the tools they use – online brokerage apps now need to allow groups of small retail traders to make large moves en masse at individual stocks and always have the collateral to manage it, otherwise be punished by these same users.

For the rest of us, this is a parable about the power of social media to allow groups of ordinary individuals to troll and exploit – whether it be as anger against the elites, for financial gain or simply because they were bored and it is a funny thing to do. It is a lesson in that just because ordinary people take part in an activity or use your service doesn’t mean you control them, predict what they will do or think they will act (in your definition of) rationally. We have to think again about what we expect of users and the online communities they dwell in. For those of us making and testing products to be used by the masses, this is a wake-up call to all.

*Thanks to the great editing work and support of JeanAnn Harrison, without whom this article would have been a poor shadow of itself.