Spoofing vs Quote Stuffing vs Layering

Spoofing and quote stuffing are two abuses of the same raw material: the stream of order and cancel messages that builds an electronic order book. Spoofing is an order entered with the intent to cancel it before it trades, placed to move what everyone else sees. Quote stuffing is message volume aimed at the plumbing, at gateways and queues rather than at any trader's reading of supply and demand. Layering is spoofing stacked across several price levels at once.

Spoofing vs quote stuffing, side by side

• Spoofing: live orders the trader has already decided will not trade. The target is your picture of supply and demand.
• Layering: the same non-bona-fide orders resting at several price levels at once, treated by regulators as a form of spoofing.
• Quote stuffing: paired order and cancel messages in bulk at high rate. The target is capacity, not your reading of the book.

A spoofer wants you to believe a price. A stuffer wants your systems to fall behind.

What is spoofing in trading?

Section 747 of the Dodd-Frank Act of 2010 added an anti-disruptive-practices provision to the Commodity Exchange Act that names the practice outright.

... bidding or offering with the intent to cancel the bid or offer before execution.

Commodity Exchange Act section 4c(a)(5)(C), added by section 747 of the Dodd-Frank Act, 2010.

The mechanic: post visible size on the side you do not want, let other participants shade their prices toward you, take your fill on the other side with a smaller order, then pull the visible size before it can trade.

Intent carries the case. Cancelling by itself is ordinary, and a market maker repricing a two-sided quote as the reference price moves cancels and reposts thousands of times a day. The prohibited act is entering an order having already decided it will not trade.

Two settled matters show what proof looks like. Michael Coscia of Panther Energy Trading was convicted in November 2015 and sentenced in July 2016, the first criminal conviction under the Dodd-Frank spoofing provision; his programs entered large orders and cancelled them within milliseconds while small orders on the opposite side filled. In September 2010 FINRA sanctioned Trillium Brokerage Services and eleven individuals $2.26 million over a layering strategy in equities.

What is layering, and how is it different from spoofing?

Layering is spoofing with depth: size stacked at three or four price levels on one side until the book reads as though many participants want to buy, then withdrawn once the real order on the other side fills. Displayed depth is an input everyone uses. If you have ever worked out where your order sits in the queue, you were reading the numbers a layering strategy manufactures.

What is quote stuffing?

Quote stuffing is the rapid entry and cancellation of large numbers of orders where the message volume itself is the point. Gateways, feed handlers, and tape processors have finite capacity, and a burst that fills a queue adds latency for everyone reading it.

No US securities statute names quote stuffing. Four instruments govern it instead.

• Exchange conduct rules. CME Rule 575, adopted in September 2014, prohibits messages entered with intent to overload, delay, or disrupt exchange or participant systems, and orders entered with intent to cancel before execution.
• The CFTC's 2013 interpretive guidance on the spoofing provision, which lists overloading a quotation system or delaying another person's execution among its examples.
• Message-rate pricing. Nasdaq's excessive messaging policy, introduced in 2012, charges a per order fee once a firm's weighted order-to-trade ratio passes 100 to 1. Fee schedules change, so each venue's current price list is the document that governs.
• Order-to-trade limits in Europe. MiFID II requires every trading venue to cap the ratio of unexecuted orders to transactions per member (RTS 9, applying since January 2018).

How much message traffic is normal?

Before treating a high cancel rate as suspicious, look at the baseline. The panel below counts consolidated top-of-book updates against trades for six household names over one half hour, 10:00 to 10:30 a.m. ET on Tuesday, June 16, 2026.

SELECT
    ticker,
    sum(quote_messages)                         AS quote_message_count,
    sum(trades)                                 AS trade_count,
    round(sum(quote_messages) / sum(trades), 1) AS quote_to_trade_ratio
FROM
(
    SELECT
        ticker,
        count()     AS quote_messages,
        toUInt64(0) AS trades
    FROM global_markets.cache_stocks_quotes
    WHERE ticker IN ('SPY', 'AAPL', 'NVDA', 'MSFT', 'KO', 'JNJ')
      AND sip_timestamp >= toDateTime64('2026-06-16 14:00:00', 3, 'UTC')
      AND sip_timestamp <  toDateTime64('2026-06-16 14:30:00', 3, 'UTC')
    GROUP BY ticker

    UNION ALL

    SELECT
        ticker,
        toUInt64(0) AS quote_messages,
        count()     AS trades
    FROM global_markets.stocks_trades
    WHERE ticker IN ('SPY', 'AAPL', 'NVDA', 'MSFT', 'KO', 'JNJ')
      AND sip_timestamp >= toDateTime64('2026-06-16 14:00:00', 3, 'UTC')
      AND sip_timestamp <  toDateTime64('2026-06-16 14:30:00', 3, 'UTC')
    GROUP BY ticker
)
GROUP BY ticker
HAVING trade_count > 0
ORDER BY quote_to_trade_ratio DESC

SPY sits at the top of the sort with 9.6 quote updates for every trade. At the bottom, MSFT reads 0.7, fewer changes to the published best bid and offer than trades printed on the tape. That spread inside one panel of liquid names is the first reason a cancel-to-fill threshold cannot be a single number across symbols.

Read these counts as a floor. They are consolidated best bid and offer updates, one row per change in the national best price or size, not the orders sent to venues. A single exchange counts every order, modification, and cancel from every participant, most of which never reach the top of the book, and gateway-level order-to-trade ratios for an active quoting firm run far above anything visible on the tape.

How fast does the top of the book change?

The same half hour, minute by minute, for one name.

SELECT
    formatDateTime(toTimeZone(sip_timestamp, 'America/New_York'), '%H:%i') AS et_time,
    count()                   AS quote_message_count,
    round(60000 / count(), 3) AS avg_ms_between_updates
FROM global_markets.cache_stocks_quotes
WHERE ticker = 'SPY'
  AND sip_timestamp >= toDateTime64('2026-06-16 14:00:00', 3, 'UTC')
  AND sip_timestamp <  toDateTime64('2026-06-16 14:30:00', 3, 'UTC')
GROUP BY et_time
ORDER BY et_time

SPY's consolidated top of book changed 26832 times during the first minute of the window, one update every 2.236 milliseconds on average. The last minute in view carried 17791 updates, one every 3.372 milliseconds.

That rate is not steady. Grouping every second of the half hour by how many updates it carried spreads them across bands.

SELECT
    multiIf(
        message_count < 100,  'under 100',
        message_count < 500,  '100 to 499',
        message_count < 1000, '500 to 999',
        message_count < 2500, '1,000 to 2,499',
        '2,500 or more')  AS messages_per_second,
    count()               AS seconds_observed,
    max(message_count)    AS peak_messages_in_band
FROM
(
    SELECT
        toDateTime(sip_timestamp) AS second_bucket,
        count()                   AS message_count
    FROM global_markets.cache_stocks_quotes
    WHERE ticker = 'SPY'
      AND sip_timestamp >= toDateTime64('2026-06-16 14:00:00', 3, 'UTC')
      AND sip_timestamp <  toDateTime64('2026-06-16 14:30:00', 3, 'UTC')
    GROUP BY second_bucket
)
GROUP BY messages_per_second
ORDER BY min(message_count)

The top band holds 1 seconds at 1,000 to 2,499 updates per second, and the busiest single second inside it carried 1084. An order that lives 40 milliseconds means one thing where the top of book moves every few milliseconds and something else where it moves twice a minute. Surveillance thresholds are set per instrument and against peer behaviour rather than as one fixed number.

Why a book can look deep on one side and then evaporate

Displayed size is a photograph of intentions that expire fast. This panel averages the quoted size at Apple's best bid and best offer in ten second buckets across ten minutes of the same morning.

SELECT
    formatDateTime(
        toDateTime(intDiv(toUnixTimestamp(toDateTime(sip_timestamp)), 10) * 10, 'America/New_York'),
        '%H:%i:%S')                                    AS et_time,
    round(avg(toFloat64(bid_size)), 1)                 AS avg_bid_size,
    round(avg(toFloat64(ask_size)), 1)                 AS avg_ask_size,
    round(100 * avg(toFloat64(bid_size))
          / (avg(toFloat64(bid_size)) + avg(toFloat64(ask_size))), 1) AS bid_share_pct
FROM global_markets.cache_stocks_quotes
WHERE ticker = 'AAPL'
  AND sip_timestamp >= toDateTime64('2026-06-16 14:00:00', 3, 'UTC')
  AND sip_timestamp <  toDateTime64('2026-06-16 14:10:00', 3, 'UTC')
  AND bid_price > 0
  AND ask_price > 0
GROUP BY et_time
HAVING avg(toFloat64(bid_size)) + avg(toFloat64(ask_size)) > 0
ORDER BY et_time

The first bucket averaged 93.9 at the best bid against 91.4 at the best offer, putting 50.7% of the displayed top-of-book size on the bid. The last bucket in the window reads 94 and 99.4, a bid share of 48.6%.

None of that is evidence of anything. Ordinary quoting produces lopsided, fast-changing depth all session. Since changing an order usually costs you queue priority, a firm adjusting displayed size cancels and reposts instead of amending in place, which is two messages where a reader might expect one. The heaviest bursts arrive in the first minutes of the session, alongside the behaviour covered in why spreads widen at the open, and the same fast repricing across venues produces momentary locked and crossed markets.

The defensive takeaway: size you can see is not size you can trade. It can be withdrawn in the time your order takes to reach the venue.

How surveillance flags each one

• Cancel-to-fill and order-to-trade ratios per participant and per symbol, measured against peers on the same instrument rather than a flat threshold.
• Order lifetimes in milliseconds, with attention to orders cancelled within a few milliseconds of a fill on the opposite side.
• One-sided displayed size that builds and is withdrawn without trading in the same seconds that participant trades the other way.
• Order lifecycle reconstruction. In US equities the Consolidated Audit Trail records order events across markets, so entry, modification, cancellation, and execution line up for one participant across venues.

What this means for your own orders

For a manual trader, none of this describes your behaviour: cancelling a limit order, or ten, sits nowhere near any messaging threshold. For an automated strategy the first exposure is cost. Venues price message traffic, and a quoting algorithm with a low fill rate can cross a weighted order-to-trade threshold and begin paying a per order fee on the orders above it. The second exposure is pattern: a strategy that repeatedly posts size it does not want filled produces the shape surveillance is built to find, whatever was intended by it. Orders that trade against your own resting orders raise a separate issue with its own controls: see wash trades and self-match prevention.

FAQ

Is spoofing illegal?

Yes. In US futures and swaps markets it is prohibited by name in the Commodity Exchange Act, added by section 747 of the Dodd-Frank Act in 2010, and it has supported criminal convictions. In equities, regulators bring the same conduct under general anti-manipulation rules, as FINRA did in its 2010 Trillium layering case.

Is quote stuffing illegal?

No US securities statute names it. Exchange conduct rules cover it, including CME Rule 575 since 2014, and the CFTC's 2013 guidance lists overloading a quotation system among its examples of spoofing. Beyond that it is priced rather than prosecuted, through messaging fees and order-to-trade limits.

How do exchanges detect spoofing?

Surveillance reconstructs each participant's order lifecycle and looks for repeated one-sided displayed size cancelled without trading around fills on the opposite side, together with very short order lifetimes and cancel-to-fill ratios out of line with peers.

Can cancelling orders get me in trouble?

Cancelling is a normal part of quoting, and repricing resting quotes is what the message counts in the panels above are made of. What is prohibited is entering an order already intending to cancel it before execution. High message volume on its own is a fee question at the venue level.

Every panel here ships with the SQL that produced it. Widen the window, swap the tickers, or count the same message traffic on a different session on the Strasmore terminal.