# Spoofing and Layering

> Spoofing and layering use orders placed with no intent to execute to trick other traders. Learn how they work, how they are detected, key cases and the law.

Source: https://learn.tradelabsai.com/industry/spoofing-and-layering/  
Track: The Trading Industry · Level: Intermediate · Updated: 2026-10-03  
Publisher: TradeLabs AI (https://tradelabsai.com). Education, not financial advice.  
Cite as: TradeLabs Learn, "Spoofing and Layering", https://learn.tradelabsai.com/industry/spoofing-and-layering/

Spoofing is placing orders you intend to cancel before they execute, to create a false impression of supply or demand. Layering is a form of spoofing that uses several orders at different price levels to build a misleading wall in the order book. The spoofer profits by trading on the other side once other traders react to the fake orders. Spoofing has been explicitly illegal in US futures markets since the Dodd Frank Act of 2010, and regulators have brought criminal cases with prison sentences and some of the largest fines in market history.

## How a spoof works

1. **The spoofer places a small genuine order,** for example to sell at the ask.
2. **They place large fake buy orders** below the market, making demand look strong.
3. **Other traders and algorithms see the buying pressure** and raise their bids or buy.
4. **The spoofer's genuine sell order fills** at a better price.
5. **They cancel the fake buy orders** within moments, before they can be hit.
6. **The process may repeat** in the opposite direction.

**Example: A layering pattern**
A futures contract trades at 4,500.00 bid, 4,500.25 ask. A trader places a genuine order to sell 10 contracts at 4,500.50. They then layer large buy orders: 200 contracts at 4,499.75, 250 at 4,499.50 and 300 at 4,499.25. Seeing 750 contracts of apparent demand close to the market, other participants lift their bids and buy, and the price ticks up to 4,500.50, filling the 10 contract sell order. Within a second, the trader cancels all 750 buy contracts. The fake orders were never meant to trade; their only purpose was to move other traders. See [The Order Book and Market Depth](https://learn.tradelabsai.com/market-structure/the-order-book-and-market-depth/).

## Why it is illegal

Spoofing deceives other market participants about real supply and demand. It harms traders who buy or sell at distorted prices and erodes confidence in displayed liquidity. The key legal element is intent: placing and cancelling orders is normal, but placing them with the intent to cancel before execution is not.

## Detection

| Signal | What surveillance looks for |
|---|---|
| Order to trade ratio | Many large orders, very few fills |
| Asymmetry | Large orders on one side, small fills on the other |
| Timing | Large orders cancelled right after small opposite orders fill |
| Repetition | The same pattern many times |
| Communications | Chats or emails describing intent |

Exchanges and regulators use automated surveillance to flag these patterns, and evidence of intent often comes from messages.

## Key cases

| Case | Outcome |
|---|---|
| Michael Coscia, 2015 | First criminal conviction under the Dodd Frank anti spoofing provision; sentenced to 3 years |
| Navinder Sarao, 2016 | Pleaded guilty to spoofing in E mini S&P 500 futures, including activity on the day of the 2010 Flash Crash. See [The 2010 Flash Crash](https://learn.tradelabsai.com/history/the-2010-flash-crash/) |
| JPMorgan, 2020 | Paid about $920 million over spoofing in precious metals and Treasury futures |
| Bank traders, 2022 | Former JPMorgan precious metals traders were convicted of fraud and related charges for spoofing |

## What it means for traders

- **Large resting orders may not be real.** Treat level 2 data as context, not a promise. See [Market Data Levels: Level 1, 2 and 3](https://learn.tradelabsai.com/programming/level-2-data/).
- **Watch for walls that move or vanish** as price approaches.
- **Do not cancel and replace orders** in patterns that could look like spoofing, especially in algorithms.
- **Automated systems need compliance checks** on order behaviour. See [Risk Controls and Kill Switches](https://learn.tradelabsai.com/algo-trading/risk-controls-and-kill-switches/).

## Not spoofing

Legitimate reasons to cancel orders include changing market conditions, risk limits, partial hedges and market making quote updates. High cancellation rates alone are not illegal; intent is what matters. See [Market Making](https://learn.tradelabsai.com/strategies/market-making/) and [High-Frequency Trading](https://learn.tradelabsai.com/algo-trading/high-frequency-trading/).

## Frequently asked questions

### What is spoofing in trading?

Placing orders with the intent to cancel them before execution, to mislead others about supply or demand and profit from their reaction.

### What is the difference between spoofing and layering?

Layering is a type of spoofing that places several fake orders at different price levels to create a false impression of depth.

### Is spoofing a crime?

Yes. It is prohibited in US futures markets under the Dodd Frank Act and under market abuse rules in other jurisdictions, with criminal prosecutions and large fines.

Next, learn about fake volume in [Wash Trading](https://learn.tradelabsai.com/industry/wash-trading/).

## Continue learning

- Next lesson: [Wash Trading](https://learn.tradelabsai.com/industry/wash-trading/)
- Previous lesson: [Market Manipulation](https://learn.tradelabsai.com/industry/market-manipulation/)
- Related: [Market Manipulation](https://learn.tradelabsai.com/industry/market-manipulation/): Market manipulation means artificially moving prices or volume to mislead others. Learn the main types, from pump and dumps to spoofing, and real cases.
- Related: [The Order Book and Market Depth](https://learn.tradelabsai.com/market-structure/the-order-book-and-market-depth/): The order book lists every waiting buy and sell order by price. Learn to read market depth, what imbalances show, spoofing risks and how depth affects fills.
- Related: [Market Data Levels: Level 1, 2 and 3](https://learn.tradelabsai.com/programming/level-2-data/): Level 2 data shows bids and offers at multiple prices beyond the best quote. Learn level 1, 2 and 3 data, how to read depth, its limits and how traders use it.
- Related: [High-Frequency Trading](https://learn.tradelabsai.com/algo-trading/high-frequency-trading/): High frequency trading uses extreme speed to trade huge volumes for tiny profits per trade. Learn the main HFT strategies, the technology and the criticisms.
- Related: [The 2010 Flash Crash](https://learn.tradelabsai.com/history/the-2010-flash-crash/): On 6 May 2010, US stocks plunged and rebounded within about 36 minutes. Learn what happened, the role of a large futures sale and HFT, and the rules that followed.