Automated Spoofing

Spoofing is an attempt to deceive the market into thinking an instrument has more interest, liquidity, or depth by placing large automated orders on one side for the purpose of causing traders to execute smaller orders on the opposite side. Once the intended orders are filled, the trader deletes the larger orders.

Note:The Automated Spoofing Model in TT Trade Surveillance is specifically tuned for automated trading strategies. Only trading events marked as originating from automated strategies in FIX Tag 1028 are clustered and scored under this model. Any clusters that contain a single trading event that is not marked as originating from automated trading strategies in FIX Tag 1028 are still found in the Spoofing model.

Automated spoofing patterns

TT Trade Surveillance detects a variety of spoofing patterns created by automated trading, including:

• Simple spoofing: An automated trading strategy places a small order on one side (intent side) of the market that the user wants to execute, followed by a much larger order on the other side (spoof side) of the market to mislead another trader into executing against the smaller order.
• Spoofing with layering: An automated trading strategy places a small order on the intent side of the market and submits orders at multiple price levels on the spoof side of the market. These spoof-side orders are designed to create a false impression of liquidity so that other participants execute against the smaller intent-side order. Once filled, all spoof-side orders are canceled or modified to avoid execution.
• Spoofing with vacuuming: An automated trading strategy places a small order on one side of the market and a larger order on the same side of the market. The larger spoof order is then canceled to entice market movement toward the smaller order.
• Collapsing of layers: An automated trading strategy tries to create a false appearance of large volume by circumventing pre-trade individual order size limits. The automated trading strategy places a small order on the intent side and several small orders at a variety of price levels on the spoof side. The small individual spoof-side orders are then modified to the same price level to imply more volume at that price level.
• Flipping: An automated trading strategy places orders on one side of the market with the intent to switch, or flip, to the other side of the market. In this pattern, the automated trading strategy places a large spoof-side order at or near one side of the inside market to create a false impression of market depth, hoping to induce others to place orders on the same side at the same price point. Then the automated strategy simultaneously cancels the spoof-side orders and flips the order from buy to sell (or vice versa) to execute against the other participants.
• Spread squeezing: This spoofing pattern is unique to instruments with spreads that are multi-tick wide. An automated trading strategy places an order on the spoof-side at successively higher or lower prices with the spread to squeeze it one direction, enticing other market participants to join or beat the newly established top of book. The automated trading strategy then switches sides and executes against those participants. After execution, the trader cancels the spoof-side orders, and the market returns to its previous state. The automated trading strategy then uses the same squeeze technique on the opposite side of the trade to trade out of the established position at an advantageous price.

Scoring methodology

TT Trade Surveillance computes a cluster score based on how similar the activity in the cluster matches trading activity that has drawn regulatory attention in the past.

Higher scores indicate that the trading activity within a cluster is more likely to risk regulatory concern. A company's risk monitors can use these scores to prioritize resources for investigating which users' trading activity poses the most regulatory risk.

Score interpretation

For the automated spoofing pattern, each cluster is assigned a risk score on a sliding scale between 0-100. This score represents the probability that spoofing occurred during the duration of the cluster's trading activity.

Based on TT Trade Surveillance best practices, clusters that score over 75 are deemed to be “high risk” and should be the primary focus of users during their compliance reviews.

Scorecard metrics

The Scorecard Metrics section shows the following statistics related to automated spoofing on a per trader basis:

• Placed Buy Volume — Total quantity of Buy orders.
• Placed Sell Volume — Total quantity of Sell orders.
• Filled Buy Volume — Total Buy fills.
• Filled Sell Volume — Total Sell fills.
• Ord Cancel/Placed — Percentage of working orders that were canceled.
• Ord Modify/Placed — Percentage of working orders that were modified.
• Volume Cancel/Placed — Percentage of total volume that was canceled.
• Volume Modify/Placed — Percentage of total volume that was modified.

Identifying spoofing with the Automated Spoofing Model

Use the Cluster Scorecard to analyze the trading activity that triggered the high automated spoofing score. The chart at the bottom of the scorecard gives you visual clues about the automated spoofing pattern.

For example, the following chart shows a potential "spoofing with layering" pattern.

In this example:

1. An automated trading strategy adds volume to create the appearance of Buy-side pressure.
2. The automated trading strategy gets filled on its resting Sell order by traders executing against the smaller order on the opposite side of the market.

   Note: The green diamond above the fill is an "imbalanced fill indicator" that marks where a trader receives a fill on the opposite side of the majority of their working volume.

3. After getting filled, the automated strategy cancels the large Buy orders.

The chart in the scorecard shows activity based on order volume over time, but does not show prices and liquidity. Looking at the prices for the potential spoofing orders can help you determine whether the automated trading strategy was placing those orders far off the market in an attempt to deceive traders.

In the Cluster Scorecard, you can click Market Replay to view how orders interacted with the market at various price levels.

For example, you can see in the replay when the automated trading strategy begins submitting numerous Buy orders to create the illusion of buy-side pressure. As you continue replaying the market activity, you can observe the state of the market and the trader's activity at each point in time.

In this example:

1. The price ladder shows the prices and liquidity in the market during the potential spoofing activity by an automated trading strategy.
2. The vertical line identifies the point in time when the trading occurred.
3. Orders and fills that occurred around the specified time are also displayed.

Spoofing Indicators

The chart on the Cluster Scorecard may also show "imbalanced fill" and "market flip" indicators to help easily identify when the potential spoofing occurred.

The imbalanced fill indicator is a green diamond above a fill that indicates where the trader had an imbalance between the bid and offer and was filled on orders on the small side of the imbalance.

The market flip indicator shows where a trader quickly flipped from offering to bidding (or vice versa) at the same price. The triangle indicator is either red (flipped short) or blue (flipped long).