How spoofing actually gets caught

Spoofing is detected statistically from the order audit trail, not by watching a screen. The decisive measure is the conditional probability that a large resting order is cancelled given a fill on the opposite side, computed across thousands of episodes. Order-to-trade ratios and cancellation rates, the metrics most often cited, are filters rather than findings.

Published 2026-08-19 · 12 min read

Nobody catches spoofing by watching an order book. The book updates faster than a person can read, cancelled orders leave no mark on the tape, and the conduct is indistinguishable from ordinary market making at the level of any individual order.

What catches it is arithmetic applied to a complete record. This post sets out which measures actually work, which are widely cited and nearly useless on their own, and why the decisive evidence in these cases is a conditional probability.

The raw material

Every venue holds an order audit trail: every message a participant sends, timestamped to the microsecond and attributed to an account. Not just executions — placements, amendments and cancellations, including orders that never traded.

This is a fundamentally different evidentiary position from most financial misconduct. An accounting fraud has to be reconstructed from documents that people chose to create. An order audit trail is created automatically, completely, and without anyone deciding what to record.

In US equities the Consolidated Audit Trail extends this across venues, which matters because layering is frequently distributed across several markets specifically so that no single venue sees the whole pattern.

The metrics that get cited and do not work alone

Two measures appear in nearly every discussion of this subject and are far weaker than their prominence suggests.

Order-to-trade ratio. Order messages sent per contract executed. It is easy to compute, published by venues, and effectively useless in isolation — a market maker quoting continuously across hundreds of instruments runs a high ratio by design. Every threshold set on it alone drowns in false positives.

Cancellation rate. The share of orders cancelled rather than executed. In modern electronic markets, most orders are cancelled. This is not a defect; it is what happens when quotes update as conditions change.

Both are useful as filters — they narrow a population from millions of accounts to hundreds. Neither is evidence of anything, and a case built on either would fail.

The measures that work

Order lifetime distribution. Not the mean lifetime — the shape. Genuine order flow produces a heavy-tailed distribution: some orders fill instantly, some rest for minutes, some sit all day. A spoofing strategy produces a sharp spike in the first few hundred milliseconds and almost nothing after, because the order’s purpose is served the moment it is displayed.

This is hard to disguise. An order that rests long enough to look natural is an order that risks being hit, and being hit on a 6,000-lot order you never wanted is catastrophic relative to the $200 a successful cycle earns.

Size asymmetry conditioned on fills. The central measure, and the one that appears in nearly every complaint. For each episode, ask: was a large resting order cancelled within a short window of an execution on the opposite side, where the executed size was a small fraction of the cancelled size?

Then compute the conditional probability across thousands of episodes. For a legitimate strategy it is close to the base rate. For a spoofing strategy it is dramatically elevated, and it stays elevated across sessions, products and market conditions.

That conditional probability is what a regulator puts in front of a court. It is not “this order was suspicious”; it is “across 11,000 episodes, a large order was cancelled within 200 milliseconds of a contra-side fill 94% of the time, against a baseline of 7%.”

Co-timing across price levels. For layering specifically. Four orders placed within the same few milliseconds at four consecutive prices, and cancelled within the same few milliseconds of each other, are not four independent decisions. The joint timing is the signature, and it is very difficult to produce accidentally.

Fundability testing. Would the displayed orders have breached the trader’s own risk limits or capital if they had filled? A stack the participant could not have funded is powerful evidence that execution was never contemplated.

Cross-market reconstruction

Several matters in this library only became visible when data from different venues was joined.

This is the harder half of the problem, and it is organisational rather than technical. Data lives with different venues, under different regulators, sometimes in different jurisdictions. Sophisticated schemes are distributed deliberately to exploit that.

The Lek Securities matters illustrate a related point: where a broker provides market access to overseas traders, the conduct and the firm that enabled it sit in different places, and the case has to reach both.

The same joining problem, in a different form, runs through cash versus derivatives schemes, where the manipulation is invisible in either market examined alone.

What the algorithm tells you

Where the trading was automated — which is most of it — the strongest evidence often is not the trading data at all.

Configuration files specify how long orders rest before cancellation, at what distance from the touch they are placed, and under what conditions they are pulled. A parameter that sets a cancellation delay in milliseconds is a description of intent written by the person who wrote it.

Source code comments have proved decisive in several prosecutions, for the ordinary reason that programmers document what code is for.

Version history shows how a strategy evolved — including, in some matters, adjustments made specifically to evade a venue’s surveillance thresholds, which is difficult to characterise as anything other than consciousness of wrongdoing.

The false positive problem

It is worth being honest about how hard this is in the other direction.

Manipulation is rare relative to total order flow. A detection system operating at very low base rates produces overwhelmingly false positives even when it is accurate, which is a property of the arithmetic rather than of the system.

Consider a surveillance model with a 1% false positive rate, applied to a million accounts of which 100 are manipulating.

True positives  ≈ 95
False positives ≈ 9,999
Alerts          ≈ 10,094
Share of alerts that are genuine ≈ 0.9%

Ninety-nine per cent of alerts are innocent, and the model is doing well. This is why surveillance teams triage rather than investigate, why the metrics that merely narrow the population matter operationally, and why the cases that get built are the ones where the conditional probabilities are extreme rather than merely elevated.

It is also why “this account had a high cancellation rate” is not an allegation, and anyone treating it as one has misunderstood the statistics.

Who finds it first

Usually the venue. CME Group, ICE, Nasdaq and NYSE run their own surveillance and refer patterns onward. FINRA surveils across US equity venues. A CFTC or SEC action is frequently the second stage of a process that began with an exchange alert months earlier.

That sequencing explains part of the lag between conduct and charges visible in this library’s time-to-resolution data, and it explains why the venue counts measure surveillance reach rather than where manipulation happens. A venue that runs good surveillance and refers cases appears more often, not less — which inverts what the ranking looks like it is measuring.

What this means for a compliance function

If you are trying to catch this inside a firm rather than from outside, the useful controls are narrower than the industry-standard ones.

Do not threshold on cancellation rate. You will alert on your best market makers and miss the thing you are looking for.

Do compute the conditional probability. Contra-side fills within a fixed window of large cancellations, per trader, per product, against that trader’s own baseline. It is close to zero for legitimate strategies.

Do test co-timing. Three or more orders at adjacent prices placed and cancelled within narrow windows, counted as episodes.

Do require written strategy rationales. Any strategy whose displayed size routinely exceeds its executed size by more than an order of magnitude should have an explanation on file, written before anyone asks.

Do read your own alerts. A recurring feature of enforcement in this area is a firm whose systems flagged the conduct and whose compliance function closed the alert. The supervision charge that follows is frequently larger than the manipulation charge.

The broader point

Spoofing is detectable because it must be repeated to be profitable, and repetition converts a judgement about intent into a statistical question about a distribution.

That property is not universal. Marking the close is profitable in a single episode, so there is no distribution to examine — those cases are built on calendar clustering and on the trader’s economic interest instead. Momentum ignition is detected by decomposing round-trip profit and loss, because its signature is a consistently loss-making entry leg.

Each technique’s detection method follows from its economics. Where a technique needs repetition, the statistics catch it. Where it does not, something else has to.

What surveillance looks like from inside a venue

A description of the machinery, since it is rarely set out.

An exchange surveillance function receives the full message stream in near real time and runs a library of pattern queries against it continuously. Each query produces alerts. Alerts are triaged by analysts, escalated to investigations, and — for a small fraction — referred to a regulator or handled through the venue’s own disciplinary process.

The volumes are worth stating. A large venue processes billions of messages a day and generates alerts in the thousands. An investigations team is measured in tens of people. The ratio determines everything about how the function actually operates.

The practical consequence is that most of the work is suppression, not detection. Tuning thresholds so that a team can look at what the system produces is the daily activity. A model that alerts on everything is operationally identical to one that alerts on nothing.

This is also why the first stage of a case is so often an exchange rather than a regulator: the venue holds the data, runs the queries, and sees the pattern months before anyone files anything.

The measures that catch the other order-book techniques

Each technique’s detection method follows from its economics, and the contrast is instructive.

Wash trading is an identity problem before it is a trading problem. The pattern — offsetting trades, no net position — is trivial to compute. Establishing that both sides are the same interest is the work: common funding, shared addresses, common authorised traders, sequential account openings.

Matched orders turn on interposition analysis. For each execution, reconstruct the book and ask whether any third party could realistically have interacted. Two orders entered milliseconds apart at a price leaving no room for anyone else did not meet by accident.

Marking the close cannot be caught by distributional analysis, because it is profitable in a single episode. It is caught by calendar clustering — aggression concentrated on month-ends, quarter-ends and expiries — combined with mapping the trader’s economic interest in the closing price.

Momentum ignition is caught by decomposing round-trip profit and loss. Its signature is an entry leg that reliably loses money and a reversal leg that reliably makes it.

The general principle: find the thing the strategy cannot avoid doing. Spoofing cannot avoid repetition. Marking the close cannot avoid the calendar. Momentum ignition cannot avoid the loss-making entry. Each of those is a constraint the manipulator does not get to choose.

The limits of all of this

Three honest caveats about what surveillance can and cannot do.

It finds what it is looking for. Pattern queries encode known techniques. A genuinely novel method produces no alert until somebody writes a query for it, and nobody writes a query for something they have not seen.

Attribution requires the venue. An outside analyst can establish from public data that spoofing occurred in an instrument. Establishing who requires account-level data that only the venue holds — which is precisely the gap discussed on perpetual market spoofing, where the venue may hold no such data at all.

Detection is not enforcement. A great deal of what surveillance finds is resolved through warning letters and venue disciplinary processes that are not consistently published. The case library records public enforcement actions, which is a subset of what was found, which is a subset of what occurred. The data pages carry that caveat on every chart, and it is the most important thing to know about this kind of data.

The full spoofing case list and the layering list are the records this post draws on. The underlying data is at cases.json.

Techniques referenced

• Spoofing — Spoofing is placing orders a trader intends to cancel before execution, to create a false impression of supply or demand and move the price toward a smaller genuine order on the other side.
• Layering — Layering is placing multiple orders at several consecutive price levels with no intention of trading them, building an apparent wall of depth that pushes the price toward a genuine order on the other side.
• Quote stuffing — Quote stuffing is flooding a trading venue with order messages in order to slow down the processing of market data, so that competing participants act on prices that are already stale.
• Momentum ignition — Momentum ignition is entering a burst of aggressive orders designed to trigger other participants' momentum strategies, creating a price move the initiator then trades against.
• Marking the close — Marking the close is trading in the final minutes of a session specifically to move the closing price, which is the price that sets portfolio valuations, margin calls, index levels and derivative settlements.

Cases referenced

Reviewed August 19, 2026. Spotted an error? Tell us.