The Gateway to Algorithmic and Automated Trading

To spoof, or not to spoof, that is the question

Published in Automated Trader Magazine Issue 39 Q2 2016

Spoofers place orders with no intention to trade. They are accused of distorting the market. But if order books in mature markets do not contain information, why ban spoofing?

I've always hated spoofing, spoofers, and the concept of spoofing. I'm annoyed by their slings and arrows. I'd say the only truly appropriate punishment for a spoofer should be that old grotesque favourite of medieval torture, the rat torture. Though having rodents eat through your stomach, or other orifices, does seem to be letting the spoofer off a bit too lightly. A painful death seems too kind.

Things change

To spoof, or not to spoof? I'm no longer so sure of the answer. Perhaps a milder torture, such as water boarding, may be best. Then again, perhaps spoofing can be justified. I'm not sure I'm willing to back off that far but there is perhaps an argument for it. I think it may be worthwhile for you, too, to reconsider your position whether your thinking starts in favour or against. It is not as clear cut as it may seem. Here I wish to meander through my inner angst in public.


Matt Hurd has founded a high frequency trading firm followed by a trading technology firm. He specialises in integrating high level trading with low level technology. He has an MSc in Computing, which helped him with various previous roles in technology and trading in firms such as Bankers Trust and Susquehanna IG.

What is spoofing?

Firstly, lets get out of the way what spoofing is. Spoofing is the placing of an order in the market place without an honest intention to trade. Spoofing is a lie, expected to benefit the spoofer in some way. The reason many countries' regulators have a law against spoofing is because it is understood to be an unfair practice. Spoofing thwarts price discovery by distorting true market dynamics.

The classic example would be if Dr. Evil was short AAPL. Say she has been short for a few months. Now Dr. Evil has decided to buy to square off as her carefully constructed seismic event in Taiwan failed to have the market impact she hoped for. Dr. Evil can either cross the spread and lift the ask to buy and go flat, or wait on the bid with a limit or peg and hope the market will trade to her. Dr. Evil gets a better price with the second option but the market may not trade there. The eponymous Dr. Evil naturally decides to try to influence the market.

Dr. Evil throws in a bunch of classic evil spoofs just above the best bid. She does not intend for them to trade but is hoping that market participants will understand her evil influence and translate it to downward price pressure. That would be normal. Lots of volume on the offer side, with comparatively little on the bid, indicates the gods of supply and demand want lower prices in a 'normal' market. This may influence the market to trade down or to have just enough influence to make it more probable that Dr. Evil's limit orders on the bid do trade, giving her at least a gain of the spread on exit.

It is worth having a think about how you might catch out Dr. Evil as a spoofer. Would it be enough to see that she puts a bunch of orders above the market and then cancels them when her bids get hit?

No. Probably not. Maybe. It all depends on the evidence of intent.

In most markets, such as the US, the concept of intent is key. There are some not completely unreasonable scenarios where Dr Evil's pattern of trading may fairly occur. However, if there is a documented intention of those spoof trades to not trade, such as email, voice-records, or, perhaps even source-code, then you may be able to rise to that high test of beyond reasonable doubt. A balance of probabilities is not beyond reasonable doubt. However, if Dr. Evil just worked out the spoof in her head and left no trace, beyond the transaction history, it is a tough call without resorting to a diagnosable brain scan from a truly evil future world.

A real world spoof

Let's look at an example from the haziness of past trading that really annoyed me at the time. Dial back a few years to Korea. I am not sure the year it started, but it was probably after 2009. During stretches of relative inactivity some joker would turn on what was effectively a square wave pattern generator in Kospi futures that would oscillate enough to cause the near at-the-money (ATM) options to have their dependent valuations go outside the bounds of that normally very tight market. The square wave guy or gal was spoofing. I termed this "shake and bake" at the time as it was effectively shaking the market enough that the unaware could end up repricing their options so they may oscillate between selling low and buying high… which is never a good move for job security.

Figure 01: Kospi Futures Orderbook (without spoof)

Figure 01: Kospi Futures Orderbook (without spoof)

Here is a facsimile of what I remember the square wave price action to look like. Every couple of seconds the spoofs would arrive or be cancelled causing, in this example, a 0.03 movement in price every two seconds. This simulated example shows the impact of a 1,000 lot order spoofing either side of the market in turn.

The Kospi is a pretty busy market. The futures have a 0.05 tick size and the options below a 3.00 price level have a 0.01 tick size. A 0.03 movement in the futures, on the face of it, is impossible. If you were using last traded price or mid-point as your futures valuation metric, but that is not common practice in this market. It is normal that you have a theoretical price calculation for the future. It may be simple, such as just using the last traded price, or a complex, such as a black box that integrates machine learning or statistical models integrating history and external factors. A commonly used simple proxy for reasonably liquid markets, such as the Kospi futures, is the inverse weighted bid ask price. I will call it simply the Volume-Weighted Mid Price (VWMP) here as a non-inverse weighting makes no real sense.

It is this commonly used formula:

commonly used formula

It makes intuitive sense as when the bid is evacuating, say by lots of stuff trading there, a price closer to the bid is fairer and thus gets weighted more heavily, in this case by the larger ask volume. It is a pretty natural benchmark for liquid markets, even though it fails pretty miserably in not so liquid markets. I have often used this as the starting point and added some black-box magic to that benchmark for my trading.

Looking at the Kospi simulation graphs in Figure 01, 02 and 03: one can see that the ask and bid quantities are randomly moving about the 200-300 lot marks. The grey VWMP line in Figure 03 represents the VWMP without spoofing. Such a VWMP theoretical price ('theo') on the futures would be a fairly benign middle tick kind of price as nothing much is happening. With Mr. Shake and Bake coming in with a 1,000 lot order on the back end of the queue, oscillating between the bid and the ask, you get that squarish wave pattern with a bit over 0.03 of price action represented. If Mr. Shake and Bake came in with 2,000 lot spoofs you would see about 0.04 points of price action.

Figure 02: Kospi Futures Orderbook (with spoof)

Figure 02: Kospi Futures Orderbook (with spoof)

It was always pretty clear that in Korea many people use something for the underlying pricing not too far from VMWP as otherwise the futures and options pricing would not be so finely balanced as they are. Remember the futures have a tick size of 0.05. A delta 50 option with a 0.01 price tick has 2.5 ticks per futures tick. This significant difference in tick influence helps open the door to the spoofer screwing with the index option market. Hello, Mr. Shake and Bake.

Figure 03: Kospi Futures Pricing

Figure 03: Kospi Futures Pricing

Mr. Shake and Bake only intervened when the market was pretty quiet. This would have been so he could have spoofed at best in the market with no real risk of actually trading. That is, Mr. Shake and Bake seemed to have no intention of trading. Mr. Shake and Bake would let it run for a few minutes and then take some time off to gloat, I suppose.

Let's look at the consequence of the shake and bake for the option market maker (MM) in Figure 04.

Figure 04: Kospi ATM Options Pricing

Figure 04: Kospi ATM Options Pricing

You can see the theoretical price of the option gyrates with the shake and bake when priced off the spoofed VWMP. Whereas without spoofing it would sit comfortably between the bid and the ask. In one scenario the MM would just lose priority as they cancel and repost orders. However, the MM may also end up selling low and buying high as it views false opportunities appearing for trading. That is, the MM could see the 'theo' above 1.52 on the option and buy at the ask of 1.52. The MM could then see the 'theo' below the 1.51 and sell the option at 1.51. That would lock in a nice loss which would continue as long as the MM does not adjust to the shake and bake.

Just for completeness, if Mr. Shake and Bake used 2,000 lot spoofs, or if the 1,000 lots were used and the natural market was half the size in volume, the delta 50 action would look like the graph in Figure 05.

This example is interesting as it highlights that it is not just the primary market we need to be concerned about. If there was a spoofer in the CME E-Mini S&P futures, then - as it is a primary price leader - many other markets, including options, ETFs, stocks, warrants, et cetera, may be affected.

We never did put in any work into mitigating Mr. Shake and Bake. It was fairly infrequent and fairly obvious. The trader working that desk at the time was as thick as a short plank. He made people nervous if he dared to reach out and touch a button on the HFT machine. However, the spoofing did not really pose too much of a problem even to him. A properly trained machine learning layer, or reasonably simple heuristic, would have mitigated but there was no real need. There was a marked increase in option trading volume as a consequence, implying it was a real issue harming the market even if not our trading. Mr. Shake and Bake's harvesting seemed to work.

Now, could Mr. Shake and Bake have been prosecuted by a regulator? I would have liked that. I'm not really sure. Perhaps just a small dose of rat torture. The activity was clearly automated as the square wave VMWP action was precisely timed, regular, and obvious. The shake and bake was timed for a quiet market indicating a reluctance to trade in the futures market, even though the orders were at risk of trading. The intent could be hard to prove. Normally spoofing is seen as a criminal activity and thus it would have had to be proved beyond a reasonable doubt. Were there incriminating emails, voice records, or perhaps clarity for no-intention in the source code? Who knows. I think it is unlikely prosecution could have been successful. Particularly as the spoof was at best, not at depth, so there was an imminent danger of transacting.

Bad intentions

Imminent danger is not enough to save you in most jurisdictions. It is about intent.

Think of insider trading. A bad insider may lose money on the trade but they still may be prosecuted for their misuse of information. That is the case but you would think public humiliation and general laughter would be enough for a bad insider trader. Usually only the traders with ill-gotten gains, rather than ill-gotten losses, are prosecuted. Similarly, for a spoofer, even if your trades were at risk and do not trade, perhaps you are at risk of prosecution due to your intention not to trade. A bad spoofer is still a spoofer.

Figure 05: Kospi ATM Options Pricing

Figure 05: Kospi ATM Options Pricing

One of the high profile cases in spoofing is that of Navinder Singh Sarao. The US is looking for an extradition from the UK to the US for this version of an alleged Dr. Evil. Sarao denies all allegations. There is such hyperbole around this case from some quarters that you would think the guy single handedly caused the entire 2010 Flash Crash with his alleged E-Mini spoofs. The truth seems a little different. To me there is little doubt he is a spoofer as he refers to his 'spoofs' in emails to his developer. However, like the bad insider trader, it does not always go his way, as Bloomberg reported:

"I need to know whether you can do what I need, because at the moment I'm getting hit on my spoofs all the time and it's costing me a lot of money," Navinder Singh Sarao wrote in a February 2009 e-mail to a programmer he had tapped to build trading software, according to the grand jury indictment file." (Source: Bloomberg, September 4, 2015.) Even if the execution is suspect, the intention seems clear, no?

Sarao's case is different to Mr. Shake and Bake as it is alleged his orders were placed one side of the market at depth and not at best. There would seem to be less risk of a trade, though the February 2009 email referenced above suggests not. A trader seeing copious volume at various levels above the market may conceivably be spooked into thinking that translates to downward pressure on pricing but that seems a little naive. Obviously, a simple VWMP would not be effected in that scenario but a broader algorithm that evaluates volume at depth might. I do not think too many proper black boxes would be spooked, though.

It was reported by Reuters on 5 February 2016 that Sarao is claiming that there is no UK law against spoofing and that his orders were at risk as they were in the market and anyone could trade against them if they so chose. There is a good argument to that. I certainly have some sympathy for the idea that if an order is in the market it is at risk and hard to call it a spoof. However, spoofing is not really concerned with the order being tradeable or not as we have discussed. A bad spoof that trades is still a spoof. It is the intention or state of mind that matters.

Should Sarao be subject to the rat torture of extradition?

Things that can look a lot like spoofing but are Not

Spoofing can look a lot like spoofing but isn't. I do not mean to be facetious here but the occasional exchange has been known to suggest spoofing is a legitimate activity. Remember that during the Flash Crash, part of the story was that some stocks (e.g. Accenture) traded as low as a penny? Well, part of the reason for this was that exchanges may have suggested to market makers that they could fulfil their continuous quote obligations by quoting very low prices to buy or high prices to sell, instead of pulling their quotes completely. It seems a rude hack. There would be no intention to trade at that price, but then again, the market participant would be seemingly happy to pick up silly prices if the trades did not break. I don't really get this, as continuous quote obligations normally have spread requirements. It is what it is. It happened. Is it spoofing? It kind of smells like it but it isn't really as there is not an expectation that it will trade but general happiness if that was to occur without a trade break.

Market making is a game of fast cancels to avoid adverse selection and fighting for priority in the order queue so you can best make a spread. Some MMs will put orders in both sides of the market at depth around the current price to gain priority in queue position by marking out territory in advance. There is often a statistical unlikelihood that these will actually trade. Is it spoofing? I would say no. There is a hope they will all trade profitably. That is, there is a real intention to trade. MMs often use a so-called inventory model. With a balanced inventory, e.g. no position, you would quote on both sides of the market. If you hold a position you may only choose to have your limit or pegs on the other side of the market so you can earn the spread without growing your inventory.

A smart and fast MM may be able to do this without pulling all their at depth orders on both sides. A more naive, or more risk averse implementation may pull orders at depth so you do not risk positions in the same direction. Another implementation may pull orders at depths on the other side, so you are not creating 'pressure' against your inventory position. This second scenario may look a lot like a spoof. It is not. It would just be getting out of your own way due to inventory. You can imagine many seemingly legitimate scenarios can look a lot like spoofing, even though there was indeed a hope and desire that those queue priorities being fought for do actually trade.

One thing that makes priority games look more like spoofing is when your priority limit order may be fairly large. You put in that large order because you genuinely hope it is appropriate and you do intend to trade all of it if given the appropriate opportunity. However, statistically, it is most likely to be modified to be somewhat smaller or even cancelled. Is that a spoof? I do not think so. There is an original intention, even hope, that you will trade it all. Some may differ in their view.

Painting the book

A market maker may go to extremes when fighting for priority. Depending on the market, instead of just trying to maintain queue position for a bunch of prices around the market price, they may decide to go for priority at every conceivable price! I refer to this as painting the book. Quite a few people do this. Not just MMs. In some markets when the ordering pre-market window opens there are 'opening races' with a flood of orders gushing into the market at the earliest opportunity. All of those orders are fighting to be as close to top of book as possible. A 'paint race' really. In a hyper-competitive market you may like to analyse this quite closely to observe and learn from others. I certainly have. Sometimes you kind of get to know the personalities and behaviours of the traders due to the distinctive sizes of their orders in the queues. The inferred trader becomes known to you as '42 lot guy' or '7 lot guy'. You can observe how they manage their book. It is always interesting to see how nervous, or not, people get trying to pick up pennies in front of the market steam roller.

Is painting the book a spoof? You may be placing an order outside a couple of standard deviations of normal movement. Again, I would suggest there is an intention to trade, if you would be so lucky (even if not an expectation).

Every market varies quite a bit here with respect to painting as to what is allowed and what is not and when and how the margining, risk or funding may work. In some markets it breaches rules. Some markets allow it and it may even be necessary to compete. Such practices can annoy other traders when they fail to get priority due to other long standing queue lurkers. When the market gets close to the level staked out in advance and you decide to vary that order based on inventory, risk or otherwise, it can look a lot like a spoof. Especially when the trade is cancelled.

Allowing spoofing?

The simplest argument is that if the order is at risk it should not be considered a spoof. It can be traded with. End of story. This is not totally unreasonable. Especially from the point of view of someone sweeping a few price levels. A spoofer would be road kill in that circumstance.

In my heyday in Korea, I would typically average around six to seven percent of the index option market with the occasional day over ten percent. That was well over a million index option contracts with the old multiplier on those bigger days. You have to run things very exactly with tight tuning to trade a million index options in a day. I hated that spoofer with a vengeance for interfering with my orderly view of the world. The world is better when it behaves just as you have rehearsed. I suspect the spoofer was having a bit of fun by fighting against people like me as they threw their spanners, or square waves, into the works.

It may be that Sarao believed that the only way he could compete against the HFT machine was to thrust, parry and fake. In a trading pit you can imagine people acting like they do have a big order, or acting like they don't have a big order, so they don't get screwed on price. Is that so different?

An iceberg order is an interesting symmetry to the spoof. Here you are kind of faking by presenting a big order as a small one. The hidden component of the iceberg replenishes the visible as it gets traded away. You are lying about your intention to trade a small size as a larger quantity already sits at the exchange hidden from view. Exchanges kindly provision those order types so you may efficiently disguise big orders as small ones. Why the distortion? Is faking a small order really that much different to faking a large order? Hmmm.

Computers traditionally haven't been that great at poker, as it is a game of incomplete information with faking, bluster, and posturing all being part of the game. This does, however, seem to be changing as AI improves. It does make you think. Perhaps spoofing is part of the last bastion of human ingenuity to beat the computer overlord. Maybe that itself is enough reason to ordain it as acceptable.

Perhaps the chaos from voracious spoofing would make the randomness of the order book so extreme that there is no information in there at all. All you could do for your legitimate trades is understand where the market is trading and put your legitimate order in the market without a supply and demand context. In such a scenario you could argue that spoofing has actually made the market completely fair for all participants! There would be no micro-alpha in the depth sizes. I can imagine a lot of buy-side investors would like such a signal free market to push their large institutional orders through.

It is worth thinking more what a market may look like under the hammer of voracious spoofing. Given throttling due to technical, regulatory, and financial limits, there would not be virtually infinite spoofing at any market place. Exchanges have limits of tolerance and the ability to control and specify order traffic. Parties with correlated open interest would be incentivized to bias the order book in their favour for their existing positions. Other parties would be interested in creating asymmetries in the book they could lie in wait for.

You would imagine that the likely chaos resulting from the Game of Orders, without true trade intention, would likely destroy all information in the order book. There would be no true picture of supply and demand from quotes. Trades would reign supreme. The spoofers without position would try to create asymmetries of advantage. Those incentivized with positions would try to limit signals against them by having the order book stacked in their favour, or at least not against them. Stacking one way would be rigorously opposed by their market colleagues with conflicting positions.

There may be two ways of looking at this in a game theory context:

1) either the equilibrium is a balanced order book with no information; or 2) the order book perhaps represents the overall open interest of this and correlated markets within the tolerance of risk associated with orders without trade intentions. I suspect the risks associated with scenario 2 would make it look like scenario 1 and we would end up with a balanced order book within noise thresholds. Either way the usefulness of the order book as an indicator of supply and demand is destroyed. We would all have to throw out a chapter or two of our favourite market microstructure text books.

Further to this dystopian view, perhaps the current reality is such that only less mature markets contain significant information of supply and demand in the modern order book. Think about it. Sophisticated investors should already be using algorithms to appropriately disguise their intentions. This is common and the algo's child orders leave faint impressions. That is, participants are already evading leaving supply and demand traces in the order book. Anecdotally, the maturity argument seems somewhat true enough to me when I compare order books in Asia to the US. There tends to be more information in Asian order books. This hints at a seemingly obvious thought: the equilibrium of strategy evolution may be such that the order book end game is a book where trade intentions are not reflected. This lack of information may be no different to an order book under voracious spoofing.

A somewhat axiomatic extension may be that any order book imbalances are thus spoofs by definition. A proper market participant would not transmit their real market intentions so clumsily. That could minimise the opportunity of a Mr. Shake and Bake as the market would simply ignore the square wave signal as it would surmise that no one would be so stupid.

If spoofing neither adds nor detracts from market information, why complicate life and ban it? Markets are robust beasts that can cure many evils on their own thanks to the incentivized vigilance of the participants, despite the motivations of those same participants to undermine that very same market.

Strangely enough, perhaps the largest beneficiary of voracious spoofing may be the large institutional trader, the buy-side.

All that said, I don't buy it... yet.

Then again, maybe I just say that as I am predisposed to pleading for any of my much appreciated order book microalpha to remain?

Other spoofs

There are other reasons spoofing may be bad. In a quieter market, bait and switch, or promoting by diming to hit the opposition can be used and it is evil. You can stuff quotes down an exchange's pipeline to artificially delay it, similar to a denial of service attack, and cause some benefit to you. You could push around an auction, such as an opening or closing call auction, with spoof orders to find some benefit. Some pricing benchmarks are based on quotes rather than trades and are thus susceptible to spoofs. Then again, you can also improperly influence markets with actual trades and not just quotes. Spoofing seems worse than a trade as such an order typically has a marginal cost of zero. At zero cost there seems no bounds to the havoc a Dr. Evil could dream up.

It is worth noting that none of these are HFT evils. They are simply trading evils. They could be done by an HFT but it is unimaginatively weak thinking to put such bad behaviour at the feet of HFTs. Sarao is a good example of the mostly manual trader screwing with the market with little to no automation. Allegedly.

Would a transaction tax cure spoofing?

It would be naive to use a transaction tax to quieten the market to foil spoofing. That would not necessarily threaten the economics of a spoofer. All you would succeed in doing is both making the market inefficient, thus harming its related economy, and pushing away trading to other markets. Also, you can see Mr. Shake and Bake would not have been affected by a transaction tax. The economics of the occasional order for many derivative spread gains would still stack up for Mr. Shake and Bake.


I think I still hate spoofers.

If you look at various market making scenarios it is easy to see that a lot of legitimate intentions to trade can look suspiciously like spoofing. How can you really tell the difference? Discovering intention seems invasive. I would not want to see the SEC and CFTC team up with the NSA. You have to ask yourself: are the false positives really worth the chase?

I can see that there is not only a Luddite argument for spoofing to fight against the machine but perhaps spoofing could make markets fairer by chaotically disguising supply and demand. Are markets not about supply and demand, though? Is it simply enough that, regardless of intention, the order is in the market and it is indeed tradeable? After all, the risk is real.

Yep, I still hate spoofers and their evil spoofing. Age wearies and confusion has mellowed my thoughts. I am no longer feeling motivated to 'take Arms against a Sea of troubles' caused by spoofing. And yet, I am no Atticus Finch. That is, I'm holding my spoofer pitch-fork, but I no longer want to join the lynch mob.

How about you?