Skip to main content

Spoofing and HFT Prosecutions

While many high-frequency trading strategies operate in a gray zone of legal but arguably unfair behavior, spoofing is unambiguously illegal. Spoofing involves placing large orders with no genuine intention to execute them, creating artificial demand or supply signals that move prices in directions the spoofer can profit from. Since 2010, the SEC and Department of Justice have successfully prosecuted dozens of traders for spoofing, with cases revealing just how profitable and widespread the tactic has been.

The most prominent case involved Navinder Sarao, a trader operating from his bedroom in North London who accumulated hundreds of millions of dollars in profits through spoofing before his arrest in 2015. Sarao's case is particularly significant because evidence suggested his spoofing activity was related to the May 2010 flash crash, implicating illegal market manipulation in one of the most significant market disruptions in modern history. The Sarao case and others like it have fundamentally changed how regulators and exchanges approach market surveillance and enforcement.

Quick definition: Spoofing is the illegal practice of placing orders with no genuine intent to execute them, designed to artificially move prices by creating false signals of supply or demand. Layering is a related tactic involving multiple layered orders at different price levels for the same manipulative purpose.

Key takeaways​

  • Spoofing involves placing orders intended to be cancelled before execution, creating false signals of demand or supply
  • The tactic is illegal under Dodd-Frank and has been successfully prosecuted in dozens of cases since 2010
  • Navinder Sarao made approximately $40 million through spoofing from his home in London between 2009 and 2015
  • Sarao's spoofing activity contributed to the May 2010 flash crash and demonstrated how individual traders could trigger systemic disruption
  • Layering (placing multiple orders at different price levels for manipulation) is a similar illegal tactic that has also led to numerous prosecutions
  • These prosecutions revealed the weakness of pre-2010 market surveillance systems and drove investments in real-time monitoring technology

What Is Spoofing?​

Spoofing is deceptively simple in concept but reveals profound truths about how prices form in modern markets. Consider a concrete example:

Step 1: Market setup. Stock XYZ is trading at $50.00. The spoofer has accumulated a large short position (owning the right to profit if the price falls) and wants to create downward pressure on the price.

Step 2: Place spoof orders. The spoofer places a huge visible buy order for 100,000 shares at $49.50, far below the current price. This order sits on the order book in plain view of all market participants.

Step 3: Market reaction. Other traders see this large buy order and infer that demand is strong and the price will rise. This inference is accurate in normal circumstances; a large buy order usually signals genuine demand. But in this case, the signal is false.

Step 4: Algorithmic response. Algorithmic traders monitoring for demand signals see the large buy order and algorithmically decide to bid prices higher, hoping to capitalize on the anticipated upward pressure. Prices rise from $50.00 to $50.10 to $50.20.

Step 5: Cancel and sell. Before the spoof order can execute, the spoofer cancels it. The large buy order disappears from the market. The spoofer then sells shares into the upward price movement, realizing profits from the price movement created by the false demand signal.

Step 6: Net result. The spoofer has realized a profit by trading on a price move that was entirely artificial. No actual demand materialized; the demand was a deception. Other traders who bought at higher prices because they believed the demand signal to be real suffer losses.

The mechanism relies on a crucial market reality: traders must make decisions based on incomplete information, and observable order book information is one key input to decision-making. If a large order appears on the book, traders rationally infer demand unless they have reason to believe the order is fake. Spoofing exploits the trust that traders place in the visibility of order book information.

Spoofing Mechanics​

Navinder Sarao's story is one of the most remarkable and instructive spoofing cases. Sarao was a bright, socially isolated trader with a passion for video games and online trading who lived in a modest house in North London. Between 2009 and 2015, operating from his bedroom using relatively simple trading software, Sarao accumulated approximately $40 million in profits through systematic spoofing and layering tactics in E-mini S&P 500 futures markets.

How Sarao's strategy worked:

Sarao developed a relatively straightforward algorithm that would place large visible sell orders (spoofs) in the E-mini S&P 500 futures, far away from the current price. These orders created a visual signal of aggressive selling pressure. When prices fell in response to the spoof signal, Sarao would buy, and when prices rebounded, he would sell at a profit. The spoof orders were almost never intended to execute; they were purely informational weapons designed to manipulate prices.

What made Sarao's activity particularly significant was the sheer scale and consistency of his spoofing. He executed this strategy hundreds of times per day across thousands of days. The cumulative effect was to persistently distort prices in the E-mini S&P 500, one of the most widely traded and economically important futures contracts.

Connection to the May 2010 flash crash:

In 2015, when the SEC and Department of Justice indicted Sarao, they alleged that his spoofing activity on May 6, 2010 (the flash crash day) played a role in triggering the crash. Specifically, Sarao's spoof orders and related manipulation were positioned to profit from downward price movements, and his activity added to the downward pressure when prices began falling due to the Waddell & Reed sell order.

The allegation was not that Sarao single-handedly caused the flash crash (the Waddell & Reed algorithm was the primary trigger), but rather that Sarao's spoofing added to the cascade and helped push prices lower, allowing him to profit from the crisis he helped create. The connection between individual spoofing activity and systemic market disruption illustrated just how dangerous small-scale market manipulation could be when amplified through algorithmic feedback loops.

Before 2010, spoofing was theoretically illegal under general market manipulation prohibitions, but the Dodd-Frank Act of 2010 explicitly criminalized spoofing, providing clearer legal tools for prosecution. Section 747 of Dodd-Frank added new language making spoofing a specific offense:

"It shall be unlawful for any person to engage in any trading, practice, or conduct on or subject to the rules of any registered entity that, in connection with the purchase or sale of any commodity in interstate commerce, is of the character of, and is commonly known to the trade as, 'spoofing'."

The law defines spoofing as placing orders that the trader knows will be cancelled before execution, with intent to create artificial signals of supply or demand that move prices.

This explicit criminalization provided prosecutors with a powerful tool. Before Dodd-Frank, proving spoofing required showing either insider trading (knowledge of future information) or general fraud. After Dodd-Frank, the specific act of placing and cancelling orders with manipulative intent became its own offense, much easier to prove.

The law also applied to a similar practice called layering: placing multiple orders at different price levels that are cancelled in a specific pattern, designed to create an appearance of strong buy or sell pressure. Layering is mechanically similar to spoofing but usually involves multiple orders rather than a single large order.

Early Cases and Prosecution Patterns​

Following Dodd-Frank, the SEC and CFTC began identifying and prosecuting spoofing cases. Early cases included:

2011: Rajaratnam/Gupta insider trading case (technically distinct from spoofing but part of broader enforcement focus on trading manipulation)

2013: Coscia manipulation case: Daniel Coscia pleaded guilty to spoofing in futures markets. His case was notable because it was one of the first clear spoofing convictions and established prosecutorial precedent.

2015: Navinder Sarao arrest: The high-profile arrest of Sarao brought massive publicity to spoofing and established that even individual traders operating from their homes could face serious criminal charges.

2016-2020s: Wave of convictions: Following Sarao's case, the SEC and DOJ prosecuted dozens of additional spoofing cases, including trader John Atchison (Barclays), Peng Jiang (JPMorgan), and others. These convictions established that spoofing enforcement would be persistent and serious.

The Sarao Trial and Conviction​

Navinder Sarao's trial in 2016 provided unprecedented public insight into how spoofing actually worked at scale. Prosecutors presented detailed evidence of Sarao's trading patterns:

Smoking gun evidence: Electronic records showed that Sarao placed and cancelled millions of orders over a 6-year period, with a clear pattern: he cancelled orders immediately after prices moved in the direction he profited from.

For example, a typical sequence: Sarao places a large sell order (spoof) at a high price. Prices fall as other traders react to the apparent selling pressure. Sarao immediately cancels the spoof order and buys at the lower prices. When prices recover, he sells at a profit. This pattern repeated hundreds of times daily, with a remarkably high success rate.

Mathematical correlation: Prosecutors demonstrated that Sarao's profits were highly correlated with his spoof order placement and cancellation patterns. When he placed spoof orders before buying, his profitability increased. This statistical evidence was damning.

The defense argument: Sarao's defense team argued that his behavior was aggressive trading, not illegal manipulation. They suggested that Sarao was simply using visible orders as tactical signals and that other traders were free to ignore those signals. The defense narrative portrayed Sarao as a controversial but legal trader, not a criminal.

The verdict: In November 2016, the jury found Sarao guilty of spoofing and wire fraud. The conviction was significant because it established that the deliberate placement and cancellation of orders intended to manipulate prices constituted criminal conduct, even if the orders were placed through the same systems available to all traders.

Sarao was sentenced to time served (he had been in custody) plus three years of home confinement, and ordered to forfeit his $12.2 million in profits. The sentence was relatively lenient by standards of serious financial crime, but the conviction itself was landmark.

Related to spoofing is the practice of layering, where a trader places multiple orders at different price levels, all with the intent to be cancelled once the market reacts. Layering creates an appearance of layered demand or supply (hence the name) that misleads other traders about the true state of demand.

Example of layering:

A trader wants to buy at lower prices. The trader places sell orders at progressively lower prices: first at $50.10, then $50.05, then $50.00, then $49.95. These orders give the appearance of aggressive selling pressure. When the price falls in response, the trader cancels all the sell orders and buys at the lower prices.

Layering is distinct from spoofing in that it involves multiple orders rather than a single large order, but the manipulative intent is identical: create false signals that move prices to the spoofer's advantage.

Several notable prosecutions involved layering:

Atchison (Barclays): John Atchison, a Barclays trader, was convicted of layering in 2016. Atchison's activity was notable because it occurred at a major bank with supposed sophisticated compliance systems, suggesting that spoofing and layering could persist even in regulated institutions with ostensible oversight.

Jiang (JPMorgan): Peng Jiang, a JPMorgan trader, was convicted of spoofing and layering in 2020. His case further established that spoofing extended far beyond individual bedrooms traders and affected major financial institutions.

Prosecution Challenges and Evolving Detection​

Despite clear evidence of widespread spoofing activity, prosecutors face genuine challenges in detecting and proving cases:

Challenge 1: High order cancellation rates are normal. In modern markets, most orders are cancelled before execution. Distinguishing between normal order cancellations and manipulative spoofing requires showing intent, which can be difficult to prove through order data alone.

Challenge 2: Proving intent. The legal definition of spoofing requires proving that the trader knew the orders would not execute and intended to manipulate prices. Simply cancelling orders is not sufficient; prosecutors must show the trader's state of mind.

Challenge 3: Market complexity. With millions of orders per day across multiple venues, detecting patterns of spoofing amid legitimate trading requires sophisticated surveillance systems. Pre-2010, most regulators lacked these systems.

Challenge 4: Algorithmic activity. As trading becomes more algorithmic, distinguishing intentional spoofing from unintended artifacts of algorithm behavior becomes increasingly difficult.

Regulators have responded by developing more sophisticated surveillance systems. The SEC and CFTC now have real-time market surveillance that can identify suspicious patterns in real time, including unusual ratios of cancelled to executed orders and correlations between order placements and price movements.

Real-world examples​

Beyond the major cases discussed, spoofing and layering have been identified in numerous market situations:

Precious metals markets: Spoofing has been particularly prevalent in gold and silver futures markets, where traders would create false demand signals to move precious metal prices.

Currency markets: Traders have used spoofing tactics in foreign exchange markets, where the decentralized nature of trading makes detection more difficult.

Equity markets: Aside from Sarao, numerous equity index futures traders have been caught spoofing, particularly in the E-mini S&P 500.

Cryptocurrency markets: As cryptocurrency markets have matured, spoofing and layering have become common tactics used by traders seeking to manipulate prices in these less-regulated markets.

Common mistakes​

Several misconceptions surround spoofing and market manipulation:

Mistake 1: Assuming all order cancellations are suspicious. Normal market-making involves cancelling many orders. High cancellation rates are consistent with both legitimate and manipulative trading. Context and intent matter.

Mistake 2: Believing spoofing is rare. While major prosecutions are high-profile, the SEC and CFTC estimates suggest that spoofing and related manipulation tactics are relatively widespread, particularly in less-regulated markets.

Mistake 3: Thinking spoofing always makes money. Spoofers attempt to exploit false signals, but they don't always succeed. Market reaction to false signals is probabilistic, not deterministic. Some spoof attempts fail.

Mistake 4: Confusing spoofing with aggressive trading. Placing large orders and using aggressive tactics is legal. Spoofing specifically involves orders intended not to execute. The distinction turns on intent.

Mistake 5: Assuming institutional or regulated traders don't spoof. Major banks and regulated institutions have been caught engaged in spoofing, disproving the assumption that such institutions have adequate compliance controls.

FAQ​

Q1: Why is spoofing illegal but aggressive trading is legal?

Spoofing is illegal because it involves deception: placing orders intended to deceive other traders about demand levels. Aggressive trading is legal because it involves genuine orders representing actual trading intention. The distinction hinges on whether orders are intended to execute.

Q2: How did Sarao avoid detection for so long?

Sarao operated in an era (2009-2015) when market surveillance systems were much less sophisticated. The SEC and CFTC lacked real-time algorithmic detection systems. Sarao's activity was only detected after investigators became suspicious following the flash crash and conducted deep forensic analysis of his trading records.

Q3: Could Sarao's spoofing have single-handedly caused the flash crash?

No. The flash crash was triggered primarily by the Waddell & Reed sell order. However, evidence suggests Sarao's spoofing activity contributed to downward pressure and may have exacerbated the cascade. He profited from the crash, suggesting his activity was positioned to benefit from falling prices.

Q4: What happens to the profits from spoofing?

Convicted spooffers are typically ordered to forfeit their profits. However, enforcement is imperfect. Some spoofers flee jurisdiction, and recovering international profits is difficult. Sarao forfeited $12.2 million but likely had significant additional undisclosed profits.

Q5: Is spoofing more common in some markets than others?

Yes. Spoofing appears more prevalent in less-regulated markets (cryptocurrency, some commodity futures) where surveillance systems are weaker. Well-regulated markets like U.S. equities have better surveillance but still experience spoofing.

Q6: How do algorithms distinguish spoofing from legitimate trading?

Modern surveillance systems look for statistical patterns: unusual order cancellation ratios, correlation between order placements and price movements, and timing patterns inconsistent with legitimate trading. However, distinguishing intent remains challenging, and humans ultimately make prosecution decisions.

Q7: If spoofing is illegal, why haven't all spooffers been caught?

Spoofing is illegal but detecting it requires identifying statistical patterns in millions of daily orders, which requires sophisticated technology and analysis. Many smaller-scale spoofers may never be detected. The cases that are prosecuted represent the tip of the iceberg of actual spoofing activity.

Spoofing is a form of market manipulation, a broader category of illegal conduct including spreading false information, painting the tape (wash trading), and pump-and-dump schemes. Not all market manipulation is spoofing, but spoofing is always manipulation.

Information asymmetry is what spoofing exploits. If all traders had perfect information about intent, spoofing would be impossible because traders would know that the spoof orders were not genuine. Spoofing works because traders must make decisions based on observable order book data.

Surveillance and enforcement of spoofing depends on real-time market monitoring systems that can identify suspicious patterns. The evolution of surveillance technology has directly enabled prosecution of spoofing cases.

Order routing and market fragmentation make spoofing possible because traders cannot observe all trading simultaneously, and false signals on one venue can move prices on others before the signal is revealed to be false.

Summary​

Spoofing is the illegal practice of placing orders with no genuine intent to execute them, designed to artificially move prices by creating false demand signals. Unlike many high-frequency trading tactics that operate in legal gray zones, spoofing is explicitly illegal under Dodd-Frank and numerous other securities laws.

Navinder Sarao's case exemplifies both the profitability of spoofing (he accumulated $40 million) and the legal consequences (conviction, forfeiture, home confinement). Sarao's spoofing activity was related to the May 2010 flash crash, revealing how individual manipulative trading can contribute to systemic disruption.

Since 2010, the SEC and DOJ have successfully prosecuted dozens of spooffers, establishing that market manipulation is a serious criminal offense with real consequences. These prosecutions have occurred across institutions large and small, in regulated markets and less-regulated venues, suggesting that spoofing is a persistent and widespread problem.

The prosecutions have also driven investment in market surveillance technology. Modern regulators can now detect patterns of spoofing in real time, though determining intent (a legal requirement for prosecution) remains challenging. The evolution from pre-2010 regulatory blindness to current real-time detection capability represents one of the most significant improvements in market oversight.

Next​

Explore comprehensive HFT regulation and how policymakers seek to manage high-frequency trading →