Spoofing & layering

It is 10:12 ET (22:12 ICT, winter). NQ is drifting up toward a round number. On your DOM one offer price shows 160 contracts while the prices around it show 12 to 18. Three minutes later price is two ticks away, and the 160 is gone. Nothing traded there. Was that a spoofer, a market maker moving a quote, or a fund that changed its mind? This lesson is about what you can and cannot know from that screen.

Spoofing (giả mạo lệnh) is entering bids or offers with the intent, at the time of entry, to cancel them before they execute Definition. Layering (xếp lớp lệnh ảo) is the same thing spread over several price levels, so a whole side of the book looks heavier than it is Definition. Both are illegal in US futures. The Commodity Exchange Act names spoofing as “bidding or offering with the intent to cancel the bid or offer before execution” (the anti-spoofing provision added by the Dodd-Frank Act in 2010), and CME Rule 575 bans orders entered with that intent on CME Group exchanges, which list NQ and ES. Regulators and prosecutors have brought cases: in 2016 the first trader convicted under the federal provision was sentenced to three years in prison. This lesson teaches you to understand spoofing so it cannot mislead you. It never teaches you to do it.

Notice the word that carries the law: intent. That word is also why your screen cannot settle the question.

Chart first: pulled versus traded

The two rows look alike for the first half of the animation: a price with a lot of size. They only separate at contact. One size leaves without trading. The other trades, and the display comes back. That is the whole observable difference, and it is the same “pulled vs refilled” read you learned in M3.08.

How it works

What a pulled order shows, and what it does not

A pulled order shows one fact: size was displayed and then removed without trading Definition. It does not show who removed it or why. Most displayed orders in electronic markets are cancelled rather than filled, because market makers and execution programs re-price their quotes all the time as price, volatility and their own inventory move PlausibleOther market. A quote that steps back as price approaches is often just a liquidity provider who does not want to be filled right before a move.

So the patterns traders call “spoof signatures” are really descriptions of pulled size:

• large size appears at a price, price approaches, and the size disappears before a contract trades there;
• heatmap walls that step away as price nears and reappear further back (M3.10);
• size that appears and disappears over and over at round numbers, with little traded volume.

Each of these can come from manipulation, and each can come from routine quoting. Regulators who prove spoofing use order-by-order records across accounts, cancellation timing measured in milliseconds, the trader’s own fills on the other side, and messages and testimony. You see an anonymous, aggregated book. Calling a pull “a spoof” from the DOM is a guess about intent.

The scheme, as the prosecuted cases describe it

In the cases that reached court, the pattern was a large order on one side that the trader did not intend to fill, placed to make the book look one-sided, while a smaller genuine order sat on the other side. When other participants reacted to the apparent imbalance and filled the genuine order, the large order was cancelled. The fake side was the advertisement; the genuine order was the business. Layering does the same with several stacked levels instead of one. Knowing this helps you see why size you never see trade is weak information, whatever its cause.

The mirror image: size that trades and refills

The opposite behaviour is size that keeps trading while the display stays small. Say a bid shows 6 contracts, and over fifteen minutes 140 contracts trade at that price while the display never goes above 8. The fact is: far more traded there than was ever displayed Definition. Traders call this an iceberg (lệnh tảng băng). It may be one order with a display quantity (CME Globex supports orders that show only part of their size), a platform’s synthetic iceberg, or many separate traders joining the same price. Your platform’s “iceberg” marker is an inference from trades versus display, not a label from the exchange.

PULLED (shown, then removed)           REFILLED (traded, display returns)
Display: 160 offered                   Display: 6 bid
Price approaches →                     Price arrives →
  160 → 9, zero traded                   6 → traded → 6 → traded → 6 …
Traded at the price: 0                 Traded at the price: 140
What you know: size was removed.       What you know: size traded there.
What you don't: why.                   What you don't: whether price holds.

The refilled side is better information than the pulled side, because contracts actually changed hands. But “real size traded here” is not “this level holds”. The popular claim that an iceberg at a level makes the level hold has been tested on NQ and did not separate from the baseline.

Myth / hypothesis: “When the refill stops, the defender is done, and the break is the signal.” This is a hypothesis, not a measured rule Lore. A refill can stop because the order filled, because it was cancelled, or because the participants at that price moved on. If you want to use it, write it as a testable rule (what counts as “stopped”, what counts as acceptance beyond the level, what outcome you score) and log it.

Why it is still worth knowing: the pulled-versus-traded distinction keeps you from reacting to size that never traded, it tells you where real volume changed hands when you plan a stop, and it gives you the vocabulary to read any claim about “spoofers” or “icebergs” critically.

Worked example: the 160 that never traded

A synthetic NQ morning, no date. Price drifts up toward 18,050.00, a round number that is not on your level map. The DOM shows 160 offered at 18,050.00, about ten times the neighbouring prices, and the heatmap shows that size appeared only in the last three minutes. Price ticks to 18,049.50; the 160 collapses to 9, with zero contracts traded at 18,050.00. Two minutes later price drops 8 points (32 ticks).

What you know: size was shown and removed before contact. What you do not know: whether it was a spoof, a quote moving away, or an order that was simply no longer wanted. You also do not know that the drop had anything to do with it. Price could have dropped with the size still there.

The trader who sold “because the wall was fake” made two guesses (intent, then direction) and was paid once. That outcome does not make the read right. The trader who wrote “pulled, 0 traded, no information about direction” and waited for executions had nothing to unlearn. If the drop was tradeable, it had to show up on the tape and footprint: aggressive selling that traded through prices, with participation, and with your plan’s entry, stop and invalidation written in advance.

Now the refill version. Same price, 18,050.00, but the display shows 6 offered, and the tape shows 140 contracts trading there over fifteen minutes while the display never goes above 8. That is size that traded. It tells you there was real selling at 18,050.00 and that buying there has so far been met. It does not tell you that 18,050.00 holds from here, that the seller is “defending” anything, or that a later break runs. If you trade around it, the stop goes where your idea is wrong, not on the assumption that the hidden size protects you.

The mirror and the failure

Mirror: a 160-lot bid that appears under the market and is pulled as price falls toward it reads exactly the same way: size removed, intent unknown, direction unknown. A bid that keeps trading and refilling under the market is size that traded, and the same evidence grade applies to “it holds”.

Failure case: a large offer appears and disappears three times at 18,050.00. You decide it is a spoofer and buy, expecting the fake supply to vanish and price to rise. On the fourth approach the size stays and trades: 140 contracts print at 18,050.00 and the display refills. What you labelled a spoof was a seller re-quoting until they were ready to sell. Fading “the spoof” put you long into size that did trade.

Common mistake: “Trading the spoof”: fading or chasing walls you have decided are fake. You are guessing at someone’s intent and then at the direction it implies, with no measured edge for either. When the guess is wrong, the “spoof” turns out to be real size that trades against you.

Common mistake: treating a refilled level as proven support. Traded size is a fact; “the level holds” is a separate claim, and on NQ it did not beat the baseline (n = 5,501). One hold you watched is an anecdote, not a base rate.

Common mistake: “fighting” suspected spoofers with your own large orders that you plan to cancel. Entering an order you intend to cancel before it fills is the prohibited conduct itself, whatever your reason.

What we don’t know yet

• How often large NQ walls are pulled before price arrives, and whether pulling, stacking or draining predicts the next move. Not yet measured: the lab needs a depth recorder first.
• How much of NQ’s pulled size comes in the layered pattern (several levels at once) versus single prices. Not yet measured.

Recap:

• Spoofing and layering are orders entered with the intent to cancel before execution; they are illegal under the Commodity Exchange Act and CME Rule 575. Understand them, never practise them.
• A pulled order shows that size was removed without trading. It does not show intent; most cancellations are routine.
• Traded-and-refilled size shows that contracts changed hands. Whether the level then holds is a separate claim, and on NQ it was inconclusive.
• The response needs no guess about intent: note what is displayed, decide only on what trades and on your written plan.

Further reading

• 7 U.S.C. § 6c(a)(5), disruptive practices, including spoofing (Commodity Exchange Act, as amended by the Dodd-Frank Act). The legal text: the prohibition turns on intent to cancel before execution.
• CME Group Rulebook, Rule 575 “Disruptive Practices Prohibited” and its market-regulation advisory notice: how the exchange applies the same idea to orders on Globex, including layering.
• Order Flow, Measured: All claims. A public, pre-registered practitioner study on NQ, 2018–2026. Read the order-book rows (OB-01 to OB-07): the iceberg test, and the wall and pulling claims that could not be tested without depth data.
• Our lab: the order-flow claims map grades “most pulled orders are routine cancellations” Plausible and every “iceberg holds” or “pulling predicts” claim Lore, pending a depth recorder.

This lesson connects to: M3.08 (DOM: pulled vs refilled) · M3.10 (heatmap: where pulled size is visible over time) · M5.02 (absorption reversal: the setup and its evidence grade).

Next: M3.13 looks at the data and settings behind every number on these tools, including how your platform’s aggregation shapes the size it shows.

Educational content only — not financial advice. Futures trading involves substantial risk of loss.