Spoofing on Level 2: fake walls, layering and what you can see
By Scalpel Team. , updated . 8 min read.
In short
Spoofing on Level 2 means placing bids or offers you intend to cancel before they execute, to trick other traders into buying or selling. Layering is the same trick spread over several price levels. On the book it looks like large size that appears near the inside and vanishes as price approaches, but honest orders do that too: on US exchanges in the second quarter of 2026, there were about 17 order cancellations for every trade. You cannot prove spoofing from your screen. The practical rule is to treat any wall as unconfirmed until shares trade into it and it stays.
Every small-cap trader has seen it. A 9,000-share bid sits two cents under the price, looking like a floor. You buy above it. Price drifts down, and a second before it gets there, the bid is gone. Was it a spoof? Maybe. Regulators have spent the last decade proving that some walls are exactly that. But most vanishing size is ordinary order management, and the difference is invisible from a retail Level 2 screen.
This post covers what spoofing on Level 2 means legally, the real enforcement cases with the amounts paid, what the pattern looks like on the book, and how to trade so that a fake wall cannot hurt you. Case details were checked against the regulators' own releases on October 22, 2026.
What spoofing and layering mean
The legal definition comes from futures law. The Dodd-Frank Act of 2010 added a list of disruptive practices to the Commodity Exchange Act, including "spoofing" (7 U.S.C. 6c(a)(5)(C)):
bidding or offering with the intent to cancel the bid or offer before execution
The key word is intent. Cancelling an order is not illegal. Placing an order you never meant to fill, so that others react to it, is.
Layering is spoofing at several prices at once: a stack of orders on one side of the book, at or just away from the best price, to make supply or demand look heavier than it is. The trader then trades on the other side at the better price the fake stack produced, and cancels the stack.
In US stocks, the SEC brings these cases as market manipulation under the securities laws. Its order against one day trader, covered below, describes non-bona fide orders placed "to create a false appearance of new or increased interest."
In this Nasdaq TradeTalks interview, Nasdaq's head of regulatory strategy for anti-financial crime explains what spoofing and layering look like in practice and the recent cases regulators brought, a useful plain-language companion to the legal definition.
Spoofing cases with real fines
These are cases where a regulator or prosecutor published the outcome. Amounts are as stated in each release.
| Case | Market | Outcome |
|---|---|---|
| JPMorgan (CFTC, September 29, 2020) | Precious metals and Treasury futures | $920.2 million in total |
| Navinder Sarao (CFTC, November 17, 2016) | E-mini S&P 500 futures | More than $38 million ordered |
| Michael Coscia (DOJ, July 13, 2016) | Futures on CME and ICE Futures Europe | 36 months in prison |
| Avalon FA and principals (SEC, affirmed June 2022) | US stocks | $7.5 million civil penalty each |
| Xuepeng Xie (SEC, September 27, 2021) | Hundreds of thinly traded US stocks | About $2.7 million in total |
| Mingran Wang (SEC, June 2026) | Over 150 thinly traded ADRs | Pending: amounts to be set by the court |
JPMorgan. The CFTC's order found that traders "placed hundreds of thousands of orders" in gold, silver, platinum and palladium futures, and in Treasury futures, "with the intent to cancel those orders prior to execution," from at least 2008 through 2016. The total was $920.2 million: restitution of $311,737,008, disgorgement of $172,034,790 and a civil monetary penalty of $436,431,811, the largest monetary relief the CFTC had ever imposed. The Department of Justice settled in parallel with a deferred prosecution agreement.
Navinder Sarao. The CFTC tied this UK trader's orders to artificial prices on several days, including May 6, 2010, the day of the Flash Crash. His layering program, per the CFTC, "routinely placed 4 to 6 exceptionally large sell orders into the E-mini S&P order book," often modified hundreds of times before being cancelled. On Flash Crash day alone, those orders were modified over 81,000 times. The court ordered a civil monetary penalty of $25,743,174.52 and disgorgement of $12,871,587.26.
Michael Coscia. The first criminal case under the Dodd-Frank anti-spoofing provision. A jury convicted him on six counts of spoofing and six of commodities fraud, and he was sentenced to three years in prison. Prosecutors showed he profited nearly $1.4 million in less than three months in 2011 with algorithms that placed orders he meant to cancel.
Avalon FA. The SEC charged this Ukraine-based firm and its principals in 2017 with layering in US stocks. After a jury trial, the court ordered Avalon and two principals to pay $7.5 million in civil penalties each, and the Second Circuit affirmed the judgment on June 15, 2022.
Xuepeng Xie. The case that matters most to a small-cap day trader, because Xie was one: a full-time day trader in North Carolina, trading hundreds of thinly traded stocks. The SEC's settled order required disgorgement of $1,864,787, prejudgment interest of $243,991 and a $600,000 civil penalty. His pattern is described in the next section.
Mingran Wang. In June 2026 the SEC filed a settled action alleging that this California trader placed decoy orders through one brokerage and real trades through another in over 150 thinly traded American Depositary Receipts, from October 2021 to at least November 2024, for more than $1.3 million in gains. He allegedly told investigators he tried "to walk the price up [to] my advantage." The court has yet to set disgorgement and penalties, and the Department of Justice filed criminal charges. These are allegations, not findings.
What spoofing looks like on Level 2
The SEC's order against Xie describes the pattern step by step. He placed "a series of visible, limit orders for a particular security on one side of the market at or just away from the NBBO that he did not intend to execute." His fake sell orders were "incrementally narrowing the NBBO from the offer side," so he could buy cheaply. He bought "via a market order using an account at a different broker-dealer," then cancelled the visible sell orders "within seconds." Then he did the same thing on the bid side to push the price up, and sold. The SEC says he did this "on thousands of occasions."
On your screen, that sequence would look like this:
- Offers stepping down with nothing trading. New size keeps arriving a cent lower on the ask, but the tape shows few sells. Supply looks like it is building, so sellers lower their prices too.
- A buy prints. Someone buys at the lower price. It looks like any other trade.
- The offers vanish. The stacked asks disappear within seconds, without shares trading into them.
- The mirror image. Bids start stepping up, the price rises, a sale prints, and the bids vanish.
Notice what you cannot see. Level 2 on IBKR labels each row with the venue the order rests on, not the trader behind it, and both Xie and Wang allegedly split their activity across brokers. Our post on market maker IDs on Level 2 explains why a row that says ARCA could be anyone.
Why most pulled orders are not spoofing
Before you call a vanished bid a spoof, look at the base rate. The SEC's market structure data, built from exchange order feeds, measures how often orders are cancelled. Averaged over the trading days of April to June 2026, stocks on US exchanges showed:
- About 17 cancellations for every trade (a cancel-to-trade ratio of 17.04).
- About 4.3% of order volume ending in a trade. The rest of the shares offered and bid never traded.
That is the normal state of the book. Market makers re-price every time the market moves. Algorithms post and pull as their models change. A trader who bid 9,000 shares and then saw the stock break down cancels because the reason for the order is gone. None of that is illegal.
What separates spoofing is intent, plus trading on the other side to profit from the reaction. Regulators prove it with full order data, account records and, in some cases, chat messages. From a retail montage you see one side of it at best.
Fake bids on Level 2: how to trade around them
You do not need to know whether a wall is fake to protect yourself from it. Treat every wall the same way:
Do not buy because of a wall
A 9,000-share bid under the price is not a floor until it proves it. Size that leaves before it trades was never willing to trade there.
Wait for it to trade and stay
The useful signal is shares trading into the level while the order stays. If 2,400 shares sell at 5.62 and the bid still shows 6,800, the buyer is real. If price approaches and it vanishes with no prints, it was not.
Read the tape, not just the book
The book shows intentions; the time and sales tape shows what actually traded. When the two disagree, trust the tape. Tape reading covers what fast prints and big prints mean.
Put your stop where the trade is wrong
Never place a stop just under a big bid because the bid is there. If the bid disappears, the price can drop straight through your stop with nothing to slow it. Use a level that makes sense on the chart, as in our guide to stop loss placement.
Count the bid under you
If the only real size under your long is the wall, and the wall goes, what is left? A few hundred shares a level means a slippery exit.
The pillar post on how to read Level 2 covers stacking and thinning in more depth, and hidden orders and dark pools covers the opposite problem: real size that never shows on the book at all.
If you believe you have seen manipulation, the SEC takes tips through its online tips and complaints portal. Bring specifics: symbol, times, prices. A screenshot of a wall that vanished is not evidence on its own.
Where Scalpel fits
Scalpel is a desktop day-trading cockpit for your own Interactive Brokers account. It cannot tell you a wall is fake, and nothing on a retail screen can. What it can do is make arriving and leaving size easy to see:
- Flash size changes. Switch it on in the LEVEL 2 cog (it is off by default). A row flashes green when size is added at a price and red when it shrinks. A quote cancelled outright disappears and the rows below move up.
- Big orders in amber. With colouring Off, a row at least three times the average size shown, and 1,000 shares or more, has its size in amber, so a wall stands out the moment it appears.
- The tape beside the book. Prints sit in a column next to the montage, so you can see at a glance whether anything actually traded at the wall's price (read time and sales).
The read the players guide walks through a big bid that holds and one that vanishes, side by side. The iceberg orders guide covers the opposite footprint, hidden size that refills, and the Level 2 guide covers every number on the panel. Our section video on reading the market shows the montage, the tape and the flashes moving together:
Scalpel is long only, and its stops are watched by the app rather than resting at IBKR, so they only work while Scalpel runs with a live feed. Practice reading the book in SIM against the live market before you risk money on it.
Scalpel is independent and not affiliated with or endorsed by Interactive Brokers or any firm named in this post.
Trading carries a significant risk of loss. Nothing here is financial advice.
Questions
- What is spoofing in trading?
- Spoofing is placing bids or offers with the intent to cancel them before they execute, to make other traders think supply or demand has changed. US law has banned it in futures since the 2010 Dodd-Frank Act, and the SEC prosecutes it in stocks as market manipulation.
- What is layering in the stock market?
- Layering is spoofing across several price levels: a stack of non-bona fide orders on one side of the book to move the price, followed by a real trade on the other side and the cancellation of the stack.
- Can you see spoofing on Level 2?
- You can see size appear and disappear, but not who placed it or why. On US exchanges there are about 17 order cancellations for every trade, so a pulled order on its own is not evidence of spoofing.
- Is spoofing illegal for retail traders too?
- Yes. The SEC's 2021 case against Xuepeng Xie involved a full-time day trader who spoofed hundreds of thinly traded stocks. He paid $1,864,787 in disgorgement, $243,991 in interest and a $600,000 penalty.
- What is the biggest spoofing fine?
- In September 2020 the CFTC ordered JPMorgan to pay $920.2 million for spoofing and manipulation in precious metals and Treasury futures, the largest monetary relief the CFTC had imposed.
- Should I trade off a big bid on Level 2?
- Not on its own. Wait until shares trade into it and it stays, keep your stop where your trade is wrong rather than just under the bid, and watch the tape for what actually trades.
Related guides
Guide 3.7Read the players on Level 2: venues, refills and sizeRead who is doing what on Scalpel's DAS-style montage: venues refilling a price, big size that holds or vanishes, bids stepping up, and the honest limits.Guide 3.1How to read Level 2 in ScalpelRead Scalpel's DAS-style Level 2: bids left, asks right, optional colour bands per price, venues, spread, imbalance and delta, and reading players by behaviour.Guide 3.2Spot iceberg orders on Level 2How Scalpel flags an iceberg: one venue refilling a small size while far more trades there, the exact rule behind the icon, and why it is not a floor.
Keep reading
- How to read Level 2: a plain guide for day tradersHow to read Level 2 step by step: the spread, stacking and thinning, reading the book against the tape, what depth hides, and why pre-market books mislead.
- IBKR Level 2: which subscription, what it costs and how to read itIBKR Level 2 explained: which depth feeds to buy and what they cost today, the TWS limit on books at once, and how to read the book, pre-market included.
- Level 1 vs Level 2 market data: what the difference means for a tradeLevel 1 vs Level 2 market data: top of book vs depth, a worked example of what your size really costs, IBKR prices, and who actually needs Level 2.
Practice in SIM, against the live book.A lifetime license, every update included, with a 7-day refund guarantee.Ask in DiscordGet Scalpel