Spoofing
Spoofing is the practice of placing limit orders with the intent to cancel them before execution, so that other participants react to displayed size that was never meant to trade. On a DOM or heatmap only the placement and the cancellation are observable; the intent that makes the behaviour spoofing is not established by any snapshot of the book.
Senzoukria · Glossary · Updated September 2026
Definition and what it is not
Spoofing is defined by intent: an order entered to be cancelled before it can be filled, in order to create a false impression of supply or demand. Regulated futures markets prohibit it, and the exchange and regulator rulebooks are the reference for how it is defined and enforced. The definition matters for a chart reader because the observable part, size that appears and then disappears without trading, is also what ordinary, legitimate activity looks like. Market makers cancel and repost as prices move; hedgers pull orders when the underlying moves; algorithms reprice on every tick. A cancellation is an event; spoofing is a claim about why it happened.
What a chart can and cannot show
- Observable: displayed size at a price, its appearance time, its disappearance time, and whether trades printed at that price meanwhile.
- Observable with order-level data: the lifetime of each order and whether it was cancelled, modified or filled.
- Not observable: who placed the order, what they intended, and whether the cancellation was a reaction to information or a plan from the start.
- A wall that vanishes as price approaches has several explanations. The heatmap guide on this site states that a disappearing band alone does not establish spoofing or intent.
Recording pulled size without a verdict
The useful practice is to treat a pull as a measurement. Note the price, the size, how long it was displayed, how close price came, and what price did after the pull. Over many observations, a rule such as 'a wall that disappears within one tick of being touched, without executions, is followed by a move into the hole it leaves' can be tested against realistic costs. That workflow needs no assumption about intent, and it produces counterexamples that a spoofing narrative would hide.
In Senzoukria
The Heatmap screen's Colour mode has a Pulls tint, described in the settings as liquidity pulled without trading, cancellations and spoofing, and an explicit note that the classification is inferred from the aggregated book and never presented as an order-by-order observation. The Liquidity tracker panel, which requires the order-by-order feed (MBO), separates size withdrawn from size executed per price level; its own note states that withdrawn includes normal market-maker requoting and that the panel distinguishes withdrawal from execution without calling withdrawal deceptive. Neither display outputs a spoofing flag.
Common mistakes
- Reading intent into a single pull. A one-second signal that appears and vanishes is more often requoting than manipulation.
- Treating every large order as a likely spoof and ignoring it; some walls are executed and hold.
- Comparing pulled size across feeds with different update rates: a slow feed makes a pull look instantaneous when it was gradual.
Related
- DOM trading guide
- Liquidity heatmap explained
- Heatmap overview
- Withdrawn vs executed liquidity (glossary)
This page in other languages
Frequently asked questions
- Can software detect spoofing automatically?
- Software can detect cancellations, measure how long size was displayed and whether it traded. It cannot observe intent, which is the element that legally defines spoofing. Any tool that labels a pull as spoofing is naming a hypothesis, and the label should be read that way.
- Why does a vanished wall still matter if it might not be spoofing?
- Because the book changed. Whatever the reason, the size that was in front of price is no longer there, so the next market orders will travel further before meeting resistance. That mechanical consequence is worth recording regardless of who pulled the order or why.