What Data Points Are Most Critical for a Surveillance System to Detect “Spoofing”?

Spoofing is the practice of placing large, non-bonafide limit orders (bids or offers) to mislead other traders about supply or demand, and then canceling them just before execution. Critical data points for detection include the ratio of orders canceled to orders executed , the time duration the orders were active, the distance of the orders from the best bid/offer , and the account's subsequent trading activity after the cancellation.

High cancellation rates far from the market are key flags.

How Does ‘Order Book Spoofing’ by Some HFTs Distort the Perceived Bid-Offer Spread and Liquidity?
What Is the Difference between a “Wash Trade” and a Legitimate Trading Strategy?
How Is the “Best Bid and Offer” (BBO) Calculated across Multiple Cryptocurrency Exchanges?
What Is the Concept of the ‘National Best Bid and Offer’ (NBBO)?
How Do Regulators Monitor Trading Activity within Dark Pools?
What Is the Role of ‘Surveillance’ Systems in Detecting Wash Trading?
How Is Transaction Data Used by the CFTC for Market Surveillance?
How Do CEXs Typically Use Trade Surveillance to Detect Front-Running?

Glossar