On This Page
Key Takeaways
- Spoofing is entering bids or offers you intend to cancel before they trade, to make one side of the book look heavier than it is.
- Layering describes multiple orders distributed across price levels.
- In the example, 20,000 non-bona fide sell shares sit behind an 800-share genuine best offer, a 25-to-one wall.
- The buyer then fills 5,000 shares at $49.99, $300 below the earlier $50.05 offer, the price the wall was built to win.
- Use depth to read displayed interest and completed trades to read executions.
What is spoofing?
Spoofing is prohibited order activity in which a trader bids or offers with the intent to cancel before execution. The Commodity Exchange Act names that intent in its prohibition, and securities laws and exchange rules cover related manipulation and disruptive quoting. The displayed orders are never meant to trade, so they misrepresent the interest in the book.
Spoofing vs layering
Layering stacks multiple orders across price levels, like the 20,000 shares spread from $50.06 to $50.09 in the example. It becomes manipulation when the layers are non-bona fide and tied to trading on the other side.
Formula
Example size comparison = 20,000 non-bona fide displayed shares / 800 shares at the genuine best offer = 25.- Intent is given in the example; in a real case it has to be shown from the pattern and the trading around it.
- The denominator is the genuine best-offer size, so the 25 measures the wall against the top of the book.
- Surveillance ratios such as orders to trades follow each measure’s own event definitions, so compare them only within one measure.
Spoofing order book example
XYZ is quoted $50.00 bid by $50.05 offered, with 900 shares bid and 800 offered at the top of the book. A trader wants to buy 5,000 shares without paying the $50.05 offer.
- Genuine best-offer size: 800 shares
- Non-bona fide sell orders stacked behind it: 20,000 shares
- Size comparison: 20,000 / 800 = 25
- Completed purchase: 5,000 × $49.99 = $249,950
- Earlier-offer benchmark: 5,000 × $50.05 = $250,250
- Difference from the earlier offer: $300
With the wall of offers on the book, the offer drops to $49.99, the trader buys 5,000 shares there for $249,950, and the 20,000 shares are canceled. The fill is $300 below the earlier $50.05 offer and exactly at the offer standing when it traded.
Spoofing rules and enforcement
Cboe EDGX Rule 12.15 targets frequent patterns of disruptive quoting and trading. Under the CFTC’s statutory spoofing guidance, a single qualifying instance is enough for a violation when the intent is shown.
In the 2020 JPMorgan case, CFTC monetary relief totaled $920,203,609: $311,737,008 restitution, $172,034,790 disgorgement and $436,431,811 civil penalties.
What market depth and trade records show
Market depth shows displayed quantities, order-level feeds show each add, change and cancel, and Time and sales records completed transactions.
Read size that appears, moves the quote and vanishes before it trades as a warning, and trust the prints over the posted wall. Surveillance adds account records and evidence of intent to judge conduct. Completed contract executions appear in options flow, which records trades, so orders canceled before execution stay off it.
Limitations of spotting spoofing
- Intent is the legal line. Surveillance pairs depth data with account records and evidence of intent to draw it.
- Expect cancellations. Legitimate orders are submitted in good faith and still get canceled, so read a large canceled order as one data point and look for the pattern around it.
- Confirm a wall with executions. When a 20,000-share stack cancels before anyone reaches it, the selling pressure it showed vanishes with it, so price your order off the prints.
- Measure the wall against the top of book. The 25-to-one comparison uses the 800-share genuine best offer, so a deeper genuine book makes the same wall a smaller share of real interest.
- Read the $300 as price gained at entry. It compares the $49.99 fill with the earlier $50.05 offer, and the trade’s profit still depends on where the shares are sold.
Bottom line
Spoofing is entering bids or offers with intent to cancel them before execution, so the displayed book misrepresents real interest. Read depth for displayed size and trade records for executions, and trust the prints when a wall appears and vanishes; the rules turn on intent and the surrounding trading pattern.
Clear answers
Frequently Asked Questions
Sources and Further Reading
- CFTC Interpretive Guidance and Policy Statement, Antidisruptive Practices Authority, 78 FR 31890 (May 28, 2013)
- CFTC Fact Sheet: Disruptive Trading Practices
- Cboe EDGX Exchange Rulebook, Rule 12.15 Disruptive Quoting and Trading Activity Prohibited
- Cboe Options Exchange Client Suspension Rule
- CFTC Press Release 8260-20: JPMorgan Spoofing and Manipulation Settlement
How entries are sourced, calculated and updated: editorial methodology.