Spoofing¶
OVERVIEW¶
Spoofing is the practice of entering large buy or sell orders on an exchange with the intent to cancel them before execution. The goal is to create a false impression of supply or demand, moving the price in a direction that benefits a separate, genuine order the spoofer actually wants filled.
Note
The defining legal element is intent. Placing and canceling orders is normal market activity. Placing them specifically to deceive other participants about real supply and demand is illegal under U.S. law and prohibited on all major exchanges.
Spoofing was explicitly criminalized in the U.S. under Section 747 of the 2010 Dodd-Frank Act, codified at CEA Section 4c(a)(5)(C), which defines it as "bidding or offering with the intent to cancel the bid or offer before execution."
HOW IT WORKS¶
A typical spoofing sequence:
- Trader stacks large sell orders on the offer side of the order book to make the market appear heavy.
- Other participants — including algorithms reading order-book depth — sell into that pressure.
- Trader buys the dip cheaply through a smaller, genuine resting order.
- Trader cancels the large sell orders before they are ever executed.
HOW IT'S IDENTIFIED¶
Regulators and exchange surveillance systems flag spoofing using pattern-based criteria. No single metric is definitive; enforcement relies on a combination of signals.
| Signal | Description |
|---|---|
| Order-to-trade ratio | A large volume of orders placed relative to how many actually execute |
| Cancellation timing | Orders canceled within milliseconds to seconds of placement, often just before they would be reached in the queue |
| Layering | Multiple orders stacked at successive price levels on one side of the book to exaggerate depth |
| Correlated fills | A genuine order on the opposite side of the book fills favorably at the same moment spoofed orders are pulled |
WORKED EXAMPLE¶
The best-documented spoofing case is Navinder Singh Sarao, a London-based futures trader whose spoofing algorithm placed and canceled large volumes of E-mini S&P 500 futures orders.
The CFTC and DOJ found his activity contributed to the May 6, 2010 Flash Crash, during which the Dow dropped roughly 1,000 points intraday before recovering.
| Outcome | Detail |
|---|---|
| Guilty plea | One count of spoofing, one count of wire fraud |
| Civil monetary penalty | $25,743,174.52 |
| Disgorgement | $12,871,587.26 |
| Criminal sentence | One year of home confinement (January 2020) |
Note
The lenient criminal sentence was attributed to Sarao's cooperation with prosecutors and an Asperger's diagnosis — not to any doubt about whether the conduct occurred.
WHAT THIS MEANS FOR TRADERS¶
Tip
Spoofing is illegal. This reference exists for identification and defensive purposes only, not as a technique to deploy.
Understanding spoofing matters for reading Level 2 data and order flow:
- A sudden wall of size on the bid or offer in a thinly traded name may be a spoof rather than genuine resting interest.
- Size that appears and vanishes repeatedly at the same level without ever trading through it is a pattern consistent with spoofing or layering.
- Treat displayed liquidity showing this pattern as unreliable for gauging real supply and demand.
LIMITATIONS AND COMMON MISCONCEPTIONS¶
| Misconception | Reality |
|---|---|
| Every canceled order is spoofing | The vast majority of cancellations come from market makers and algorithms legitimately updating quotes as prices move |
| Spoofing is the same as iceberg orders | Iceberg orders are legal. The distinguishing factor is intent and documented evidence that orders were never meant to fill |
| High cancel rates prove spoofing | Surveillance systems flag far more candidate patterns than result in charges — proving subjective intent is the legal threshold |
Note
Spoofing prosecutions require proving subjective intent, which is why enforcement cases are relatively rare relative to how often the pattern appears in raw order-book data.