Home  /  Learn  /  What is spoofing?

What is spoofing?

Spoofing is a form of market manipulation in which a trader places orders they never intend to execute, creating a false impression of supply or demand, then cancels them once the deception has moved the price their way.

MANIPULATION TYPOLOGY · ~6 MIN READ

The order book is supposed to be an honest picture of genuine buying and selling interest. Other participants read it to decide how to price and time their own trades. Spoofing exploits that trust. The spoofer puts a large, visible order on one side of the book, with no intention of letting it execute, to nudge other traders into moving the price. They then trade on the opposite side at the improved price and cancel the original order before it can be filled.

A simple example

Suppose a trader genuinely wants to buy. They place a series of large, visible sell orders just above the best offer. To the rest of the market, that looks like real selling pressure, and the price drifts down. The trader quietly buys at the lower price, and the moment they are filled, cancels every sell order that was never meant to trade. The visible selling interest was a fiction; its only purpose was to move the price.

Spoofing vs layering

The two are closely related and frequently mentioned together. The usual distinction is one of multiplicity. Spoofing typically refers to one large non-bona-fide order; layering refers to multiple non-bona-fide orders placed at different price levels to manufacture the appearance of depth. The intent is the same: to mislead, and to cancel before the orders can execute.

Why it is illegal

Across the major jurisdictions, spoofing is prohibited because it creates an artificial price or a false or misleading impression of the market. The precise statutory hook varies, since the test of intent and the way 'non-bona-fide' is framed differ from one regime to another, but the core wrong is consistent: orders entered with no genuine intent to trade, used to deceive other participants. Penalties run from fines and suspensions through to criminal prosecution in the most serious cases.

How surveillance detects spoofing

Spoofing leaves a recognisable footprint in order-book data. No single metric is decisive; surveillance systems apply multi-factor scoring and then route the strongest signals to an analyst for contextual review. The classic indicators include:

• High cancellation ratios. A large share of orders cancelled before they ever execute.
• Order-book imbalance. Large visible size stacked on one side, then withdrawn.
• Cancel-after-fill timing. The non-bona-fide orders vanish within milliseconds of the genuine order being filled on the opposite side.
• Proximity and placement. Orders positioned to maximise visible pressure while carrying little real execution risk.

Flagging the pattern is the easy part. Telling it apart from legitimate behaviour is the work. Market-making, hedging and passive iceberg orders can all throw readings that look like spoofing, which is why contextual review (the participant’s strategy, their role, the economic rationale) comes before any escalation.