Spoofing Guide — Illegal Order Cancellation Manipulation
Spoofing is a form of market manipulation where a trader places orders they intend to cancel before execution, creating a false impression of supply or demand to move prices in their favor. It was explicitly outlawed in the US by the Dodd-Frank Act of 2010.
Spoofing involves entering large orders on one side of the market to create the illusion of buying or selling pressure, then canceling them before execution while trading on the opposite side. For example, a spoofer enters a large sell order for 10,000 contracts at $50.05, creating visible supply that pushes the price down. The spoofer then buys at the lower $49.95 price, and cancels the $50.05 sell order. The profit comes from buying at the artificially depressed price. The same technique works in reverse: large buy orders create upward price pressure, enabling the spoofer to sell at the inflated price.
The 2010 Dodd-Frank Act explicitly prohibited spoofing and disruptive trading practices. The landmark case was United States v. Coscia (2016), where Michael Coscia was convicted for spoofing futures markets. He used an algorithm that entered and quickly canceled orders in CME and ICE futures, making $1.4 million profit. Coscia received 3 years in prison and a $1.4 million fine. The Navinder Sarao case gained worldwide attention when his spoofing from his mother's house in London was found to have contributed to the 2010 Flash Crash that briefly wiped $1 trillion from US markets. Sarao used a spoofing algorithm that canceled 99% of its orders. He was extradited to the US, sentenced to 1 year in prison, and ordered to forfeit $12.9 million.
How Regulators Detect Spoofing
Regulators analyze order-to-trade ratios — legitimate traders typically execute 10-30% of their orders. Spoofers cancel over 95% of orders. Time-stamped audit trails ordered by the SEC's Market Information Data Analytics System (MIDAS) track every order message. The CFTC uses the Real-Time Market Surveillance system to flag abnormal cancelation patterns. Exchange members are required to implement surveillance systems. The Consolidated Audit Trail (CAT) provides comprehensive order-level data. Since Coscia, spoofing prosecutions have increased dramatically — the CFTC brought over 50 spoofing cases between 2018 and 2024, with fines totaling hundreds of millions of dollars against banks including JPMorgan, Deutsche Bank, and Citigroup.
FAQs
Is spoofing the same as bluffing in poker?
Legally, no. In poker, bluffing is part of the game everyone accepts. In securities markets, spoofing is explicitly illegal because markets depend on the integrity of prices. The Dodd-Frank Act made spoofing a criminal offense, not just a regulatory violation. The distinction is that market orders provide liquidity under rules that assume good faith.
What is the difference between spoofing and layering?
Spoofing and layering are closely related. Spoofing typically involves a single large order placed and quickly canceled. Layering involves multiple orders at different price levels on one side of the order book, creating the impression of depth — like layers of an onion. Both are illegal. Some regulators use the terms interchangeably; others distinguish them by the number of orders used.
How can algorithmic traders accidentally spoof?
Poorly designed trading algorithms that rapidly enter and cancel orders can appear to be spoofing even without manipulative intent. This is why CFTC regulations require firms to have automated trading system risk controls. Regulators consider intent, looking at patterns: cancelation rates, order sizes, and whether the trader trades on the opposite side while the canceled orders were in the book.