Spoofing (and layering)
Also called: layering · fake orders
Spoofing is entering orders with the intention of cancelling them before execution, to create a false impression of supply or demand. Layering is the same conduct spread across several price levels. It is illegal in US derivatives markets and has been prosecuted, including against very large banks.
The definition that matters is the regulator's
The distinguishing element is intent at the time of entry, not the cancellation itself. Cancelling orders is entirely normal: market makers manage inventory continuously and cancel constantly. What is prohibited is entering an order you never intended to have filled.
Describing the largest such case to date, the CFTC characterised the conduct as placing orders with the intent to cancel those orders prior to execution — which is as close to a working definition as a trader needs.
It is genuinely prosecuted
In September 2020, JPMorgan agreed to pay 920.2 million dollars across parallel CFTC and Department of Justice actions over precious metals and Treasury futures, conduct spanning roughly 2008 to 2016. It was, at the time, the largest monetary relief the CFTC had ever imposed, and it was accompanied by a deferred prosecution agreement. Individual traders in related cases have received prison sentences.
This matters for how you read a ladder: the practice is real enough to have produced nine-figure penalties, and common enough to have persisted for years inside a major institution.
How it differs from an iceberg
An iceberg order is a genuine order that intends to trade but displays only part of its size. A spoof is an order that never intends to trade at all. One conceals real intent; the other manufactures fake intent. They are opposites, and are frequently confused because both make the visible book misleading.
A worked example
On a synthetic ES book, an 840-lot offer sits two ticks above the market with zero contracts executed against it, while a 60-lot bid one tick below the market has absorbed 1 480.
That picture is consistent with a spoof — and equally consistent with a legitimate order that was simply never reached. From the outside you cannot tell the difference, which is precisely why the practical response is the same either way.
The trap
Calling every cancelled order a spoof. Pulling liquidity before contact is ordinary risk management, and intent is not observable from a price ladder. Regulators establish it with internal communications and order-history forensics you do not have.
The usable conclusion is not accusatory, it is operational: confirm displayed size by execution before relying on it. Do that and you are protected against spoofs, against ordinary cancellations, and against your own pattern-matching — without ever needing to decide what anybody intended.
Frequently asked
- Is spoofing illegal?
- In US derivatives markets, yes — it was made explicitly unlawful by the Dodd-Frank Act, and it has been enforced through both civil actions and criminal prosecutions. Rules differ by jurisdiction and by venue, and enforcement in crypto is considerably thinner.
- How can I detect spoofing on a chart?
- You cannot detect it reliably, and treating any large cancelled order as a spoof will mislead you. What you can observe is behaviour at contact: whether displayed size actually trades. That observation is useful regardless of anyone's intent.
- Is spoofing common in crypto?
- It is widely reported and much less consistently policed than on regulated futures exchanges, where surveillance and enforcement are established. That difference is a good reason to weight executed volume even more heavily than displayed size on crypto venues.