Spoofing and Layering
Spoofing and layering use orders placed with no intent to execute to trick other traders. Learn how they work, how they are detected, key cases and the law.
Spoofing is placing orders you intend to cancel before they execute, to create a false impression of supply or demand. Layering is a form of spoofing that uses several orders at different price levels to build a misleading wall in the order book. The spoofer profits by trading on the other side once other traders react to the fake orders. Spoofing has been explicitly illegal in US futures markets since the Dodd Frank Act of 2010, and regulators have brought criminal cases with prison sentences and some of the largest fines in market history.
How a spoof works#
- The spoofer places a small genuine order, for example to sell at the ask.
- They place large fake buy orders below the market, making demand look strong.
- Other traders and algorithms see the buying pressure and raise their bids or buy.
- The spoofer's genuine sell order fills at a better price.
- They cancel the fake buy orders within moments, before they can be hit.
- The process may repeat in the opposite direction.
Why it is illegal#
Spoofing deceives other market participants about real supply and demand. It harms traders who buy or sell at distorted prices and erodes confidence in displayed liquidity. The key legal element is intent: placing and cancelling orders is normal, but placing them with the intent to cancel before execution is not.
Detection#
| Signal | What surveillance looks for |
|---|---|
| Order to trade ratio | Many large orders, very few fills |
| Asymmetry | Large orders on one side, small fills on the other |
| Timing | Large orders cancelled right after small opposite orders fill |
| Repetition | The same pattern many times |
| Communications | Chats or emails describing intent |
Exchanges and regulators use automated surveillance to flag these patterns, and evidence of intent often comes from messages.
Key cases#
| Case | Outcome |
|---|---|
| Michael Coscia, 2015 | First criminal conviction under the Dodd Frank anti spoofing provision; sentenced to 3 years |
| Navinder Sarao, 2016 | Pleaded guilty to spoofing in E mini S&P 500 futures, including activity on the day of the 2010 Flash Crash. See The 2010 Flash Crash |
| JPMorgan, 2020 | Paid about $920 million over spoofing in precious metals and Treasury futures |
| Bank traders, 2022 | Former JPMorgan precious metals traders were convicted of fraud and related charges for spoofing |
What it means for traders#
- Large resting orders may not be real. Treat level 2 data as context, not a promise. See Market Data Levels: Level 1, 2 and 3.
- Watch for walls that move or vanish as price approaches.
- Do not cancel and replace orders in patterns that could look like spoofing, especially in algorithms.
- Automated systems need compliance checks on order behaviour. See Risk Controls and Kill Switches.
Not spoofing#
Legitimate reasons to cancel orders include changing market conditions, risk limits, partial hedges and market making quote updates. High cancellation rates alone are not illegal; intent is what matters. See Market Making and High-Frequency Trading.
Frequently asked questions#
What is spoofing in trading?#
Placing orders with the intent to cancel them before execution, to mislead others about supply or demand and profit from their reaction.
What is the difference between spoofing and layering?#
Layering is a type of spoofing that places several fake orders at different price levels to create a false impression of depth.
Is spoofing a crime?#
Yes. It is prohibited in US futures markets under the Dodd Frank Act and under market abuse rules in other jurisdictions, with criminal prosecutions and large fines.
Next, learn about fake volume in Wash Trading.
3 quick questions on this lesson. Get them all right to finish it.
Turn on JavaScript to take the quiz.
Mentioned in
- Market Maker Manipulation: Myth and RealitySmart Money Concepts