Spoofing: the order that is never meant to be filled, and how it shows up in the order book

Spoofing is the placing of a large limit order that its author never intends to have filled: its purpose is to let other participants see a "wall" of demand or supply in the order book and move their prices after it, so that the spoofer can cancel the order and profit from a trade on the opposite side at an improved price. The defining feature is neither the size nor the speed of cancellation in itself, but the absence of any intention to trade. That is the test by which the law separates spoofing from the legitimate work of a market maker, who also places and cancels orders continuously.

The mechanism: no intention to trade, rather than the cancellation itself

Cancelling an order is a normal thing to do. Anyone who trades with limit orders pulls them when the price changes, when news arrives or when their own assessment of risk shifts. What sets spoofing apart is that the cancellation is built into the plan from the outset, while the order serves as a signal for other people's algorithms and other people's eyes.

The scheme usually unfolds as follows. A trader wants to buy more cheaply. They post a conspicuous sell volume above the market or, alternatively, load one side of the book so that the skew looks convincing. Participants who read order book imbalance as a leading indicator adjust: some pull their bids, others join the "strong" side. The price moves. At that moment the spoofer executes the real order, hidden until then and carrying the opposite sign, and takes down the stage set.

A related technique is layering: instead of a single large order, a cascade of smaller orders is placed at different price levels, which makes the picture of "depth" more plausible and harder to tell apart from ordinary order flow. The logic is the same: to create the appearance of interest that does not exist.

What can be seen from the outside and what cannot

A retail terminal offers indications, not proof. The warning signs are: a volume sharply out of line with the instrument's usual depth; a "wall" that stands exactly until the price approaches and vanishes fractions of a second before it is touched; the repetition of this behaviour at the same levels; and a mismatch between the picture in the order book and the trade tape, where the displayed volume is enormous but there are no actual executions near it.

What a retail participant cannot see, as a matter of principle, is who owns the orders. In an anonymous order book it is impossible to distinguish several independent participants from the repeated actions of the spoofer alone. The everyday conclusion that "this was spoofing" therefore always remains a hypothesis: it can be confirmed only by someone with access to account-level data, that is, the exchange and the regulator.

Why thin instruments suffer more

The cost of manipulation depends on how much money it takes to make the order book look different. In a stock with a dense order book and high turnover such as {{instrument:SBER}}, a fake "wall" has to be so large that it becomes a risk in itself: it may simply be filled, leaving the spoofer with an unwanted position. In an illiquid instrument the same effect is achieved with an incomparably smaller volume, and getting out of an accidentally filled order is harder there too.

The practical conclusion follows: vulnerability to this kind of behaviour is another reason to look at liquidity before entering a position, not after. Turnover and spreads across securities can be compared in the Russian equities section; for a comparison with instruments where depth is formed differently, the OFZ section is useful. For those who do not want to carry the risk of an individual thin security, exchange-traded funds remain an alternative, as their price rests on a basket of assets.

The legal framework in Russia

Market manipulation is prohibited by Federal Law No. 224-FZ, adopted in 2010. Its Article 5 lists the indicators of manipulation, and among them is the placing of orders that leads to a material deviation in price, demand, supply or trading volume. Criminal liability for market manipulation is set out in Article 185.3 of the Criminal Code of the Russian Federation, and administrative liability in the Code of Administrative Offences. The exchange, for its part, applies its own disciplinary measures, ranging from requests for information about transactions to the suspension of trading access.

An important caveat: the specific materiality thresholds, the sanctions and the investigation procedure are determined by the current versions of the regulations and by the internal trading rules, and they change. They should be checked against the original source, not against a description of the mechanism. The platform's database holds no statistics on detected cases, so this article makes no claim about how widespread spoofing is on the Russian market, only about how it works.

What a trader should do about it

The defence here is not spotting the manipulator but the way your own trading is constructed.

Step 1. Remove the dependence of your entry on the picture in the order book. If a signal collapses entirely when the "wall" turns out to be fake, it is not a signal.

Step 2. Give up market stop orders placed at obvious round levels in thin securities: a price move caused by false pressure knocks out exactly those.

Step 3. For an order that is large by the instrument's standards, use limit orders and split the volume instead of executing at market. This removes the main way in which you pay for someone else's manipulation, namely a poor execution price.

Step 4. Separate a move that has a cause from a move that has none. Financial results, a corporate event and the news flow explain most sharp moves; the news feed is a convenient place to check. Definitions of the terms encountered along the way are collected in the glossary.

If you believe you have encountered manipulation, the ordinary route is to contact your broker and the Bank of Russia as the supervisory authority. Do-it-yourself "countermeasures" in the form of trading against a suspected spoofer amount to a bet against a participant who sees more than you do and controls the timing.