TT Score

Spoofing

Spoofing

Spoofing represents an attempt to deceive the market into thinking that an instrument has more interest, liquidity or depth by placing large orders on one side for the purpose of causing traders to execute smaller orders on the opposite side. Once the intended orders are filled, the larger orders are deleted.

Spoofing patterns

TT Score detects a variety of spoofing patterns, including:

  • Simple spoofing: A trader places a small order on one side (intent side) of the market that the trader wants to execute, followed by a much larger order on the other side (spoof side) of the market to mislead another trader into executing against the smaller order.
  • Spoofing with layering: A trader places a small order on the intent side of the market and orders at multiple price levels on the spoof side of the market. These spoof-side orders are designed to create a false impression of liquidity so that other participants execute against the smaller intent-side order. Once filled, all spoof-side orders are canceled or modified to avoid execution.
  • Spoofing with vacuuming: A trader places a small order on one side of the market and a larger order on the same side of the market. The larger spoof order is then canceled to entice market movement toward the smaller order.
  • Collapsing of layers: A trader tries to create a false appearance of large volume by circumventing pre-trade individual order size limits. The trader places a small order on the intent side and several small orders at a variety of price levels on the spoof side. The small individual spoof-side orders are then modified to the same price level to imply more volume at that price level.
  • Flipping: A trader places orders on one side of the market with the intent ot switch, or flip, to the other side of the market. In this pattern, a trader places a large spoof-side order at or near one side of the inside market to create a false impression of market depth, hoping to induce others to place orders on the same side at the same price point. Then the trader simultaneous cancels the spoof-side orders and flips the order from buy to sell (or vice versa) to execute against the other participants.
  • Spread squeezing: This spoofing pattern is unique to instruments with spreads that are multi-tick wide. A trader places order on the spoof-side at successively higher or lower prices with the spread to squeeze it one direction, enticing other market participants to joi or beat the newly established top of book. The trader then switches sides and executes against those participants. After execution, the trader cancels the spoof-side orders, and the market returns to its previous state. The trader then uses the same squeeze technique on the opposite side of the trade to trade out of the established position at an advantageous price.

Scoring methodology

For the spoofing pattern, each cluster is assigned a risk score on a sliding scale between 0-100. This score represents the probability that spoofing occurred during the duration of the cluster's trading activity. TT Score computes a cluster score based on how similar the activity in the cluster matches trading activity that has drawn regulatory attention in other situations.

Score interpretation

Higher scores indicate the trading activity within a cluster is more likely to risk regulatory concern. A company's risk monitors can use these scores to prioritize resources for investing which users' trading activity pose the most regulatory risk.

Scorecard metrics

The Scorecard Metrics section measures the following statistics related to abusive messaging:

  • Disclosed Buy Volume
  • Disclosed Sell Volume
  • Filled Buy Volume
  • Filled Sell Volume
  • Ord Cancel/Placed
  • Ord Modify/Placed
  • Volume Cancel/Placed
  • Volume Modify/Placed

Identifying spoofing

Use the Cluster Scorecard to get a closer look at the activity that triggered the spoofing score. The chart at the bottom of the scorecard can give you visual clues about the spoofing pattern. For example, the chart in the following scorecard for a cluster with a high spoofing score shows a potential flipping pattern.

  1. Cancels working Sell orders and begins submitting several Buy orders to create the impression of volume on the Buy (spoof) side.
  2. Starts submitting Sell orders (intent side) to take advantage of movement on the Buy side.
  3. Cancels working Buy orders when the Sell orders are executed.

The chart shows activity based on order volume over time, but does not show the order prices and liquidity. Looking at the prices for the potential spoofing orders can help you determine whether the trader was placing those orders far off the market in an attempt to deceive traders. From the Cluster Scorecard, you can click Market Replay to show how the orders interacted with the market at the various price levels.

  1. The price ladder shows the prices and liquidity in the market during the potential spoofing activity.
  2. The trader first cancels several Buy orders (spoofing side) and submits a large Sell order (intent side).
  3. Several executions occur quickly for the Sell order, giving the trader fills at the desired price.
  4. Pressing Play would then show the trader canceling all of the Buy side orders, as shown in the Cluster Scorecard chart.