Spoofing stocks: what is illegal and what a disappearing wall shows
Spoofing is placing orders you intend to cancel before they trade. A wall that vanishes from Level 2 fits spoofing and fits ordinary cancelling, so intent cannot be read from the screen. Plan for pulled size instead.
Start in plain English
Spoofing means placing orders with the intent to cancel them before they trade, to make other traders think supply or demand is different from what it is. Small-cap chat rooms use the word for almost any large order that disappears: "fake wall", "spoofer on the bid". This lesson separates the legal idea from what a scalper can actually see.
The core idea: intent is not visible on Level 2. A large bid that vanishes as price approaches fits spoofing. It also fits a trader who changed their mind, an algorithm updating a quote, a market maker managing risk, or an order that moved to another venue. You cannot tell them apart from the screen, and you do not need to. What you can plan for is that displayed size can disappear at any moment, and your plan needs a stop that still works when it does.
This is education about market rules, not legal advice.
Two paths from the same start
All prices, sizes and identifiers in this example are Illustrative. Penhallow Labs and every identifier below are fictional.
The setup at 10:21:00 ET. Penhallow traded down to a day's low of $2.38 at 09:58 and has bounced. At 10:18:40 a 40,000-share bid appeared at $2.40, more than 25 times the largest other bid on the book. It is still there. Chat calls it "a wall".
Penhallow Labs (fictional), Level 2 at 10:21:00, ET (Illustrative)
| Side | Price | Size | Source |
|---|---|---|---|
| ask | 2.45 | 1,500 | EXCH1 |
| ask | 2.46 | 2,200 | ECNB |
| ask | 2.47 | 1,000 | MMQB |
| ask | 2.50 | 6,000 | EXCH2 |
| bid | 2.44 | 1,200 | EXCH1 |
| bid | 2.43 | 800 | ECNB |
| bid | 2.42 | 1,500 | MMQB |
| bid | 2.41 | 600 | EXCH2 |
| bid | 2.40 | 40,000 | ECNB |
Identifiers are fictional. The 40,000-share bid at $2.40 appeared at 10:18:40 and is still displayed. Day's low $2.38 at 09:58. Chat calls the bid 'a spoof'.
The plan, written before 10:21:00. Entry with a marketable limit order (ceiling $2.46), filled at $2.45. Stop at $2.39, one cent under the wall. Target $2.57 (2R). Time stop at 10:31. Planned risk $0.06 per share. Size: $48 risk ÷ $0.06 = 800 shares. Costs: $0.005 per share round trip (Illustrative), plus any slippage.
The trader's reasoning was "the wall protects my stop." Watch what that reasoning does in each path.
Path AThe wall stays and price lifts
The 40,000-share bid sits at $2.40 untouched. Offers at $2.45 and $2.46 trade, and price reaches $2.58 at 10:27. The $2.57 limit sell fills.
Path BThe wall vanishes
At 10:22:14, as prints reach $2.42, the 40,000-share bid is cancelled in one update. Bids at $2.41 and $2.40 are thin. The $2.39 stop triggers and fills at $2.37.
Path CThe wall sits and nothing much happens
The wall stays, but neither side presses. Price chops between $2.42 and $2.48. At 10:31 the time stop exits at $2.44.
There is a fourth variant worth naming: the wall is real and fills. Sellers hit all 40,000 shares at $2.40, the bid is used up, and price trades $2.38. The stop fills in that case too. A wall that disappears and a wall that trades through both end in Path B; only one of them could be spoofing. The review note is the same for every path: "Leaned on displayed size; plan followed; 1R planned." The rest of this lesson covers what the law prohibits, what you can observe, and why the useful response is in your stop rule rather than in a guess about intent.
What the law prohibits
US securities law has no single statute titled "spoofing". The conduct is pursued under broader anti-manipulation and anti-fraud rules (all checked 2026-10-05):
- Securities Exchange Act Section 9(a)(2) prohibits a series of transactions that create actual or apparent active trading, or raise or depress a price, for the purpose of inducing others to buy or sell.
- Section 10(b) and SEC Rule 10b-5 prohibit manipulative or deceptive devices in connection with buying or selling a security.
- FINRA Rule 5210, Supplementary Material .03 (effective December 15, 2016) describes "disruptive quoting and trading activity" as a frequent pattern of placing orders on one side, a change in the market, trading on the other side, then cancelling the first orders. It applies to FINRA members.
- Commodity Exchange Act Section 4c(a)(5)(C), added by the Dodd-Frank Act in 2010, names "spoofing" directly: "bidding or offering with the intent to cancel the bid or offer before execution". That provision covers futures and other markets regulated by the CFTC, not stocks.
Two dated equity examples:
- SEC v. Lek Securities and Avalon FA (S.D.N.Y.). The SEC filed on March 10, 2017, alleging "layering" in US stocks: orders placed and then cancelled after tricking others into trading at artificial prices. A jury found against Avalon and two individuals on November 12, 2019; the court ordered civil penalties of $7.5 million per defendant, and the Second Circuit affirmed on June 15, 2022.
- A 2026 criminal plea. On June 24, 2026 a California man pleaded guilty to securities fraud in what the Department of Justice described as a years-long spoofing scheme in thinly traded securities, involving more than 3,000 instances between 2021 and 2024.
Both cases rest on order and trade records across accounts and venues, reconstructed over months. Neither was proved from one Level 2 screen.
What you can observe, and what it fits
| Observable pattern | Fits spoofing | Also fits |
|---|---|---|
| Large size far from the inside, cancelled as price approaches | Yes | A trader who changed their mind; a resting order moved to another venue; a market maker re-pricing risk |
| Size that appears and disappears repeatedly at nearby prices | Yes (layering) | An algorithm updating quotes as the inside moves |
| Wall cancelled, then prints on the other side | Yes | Two unrelated traders acting a second apart |
| Wall fills completely | No | A real buyer or seller finishing |
Cancelling is ordinary. Quoting firms and algorithms update and cancel orders constantly as prices move. That is why regulators look for a pattern tied to trading on the other side across many episodes, with account-level data that retail screens do not show.
Why accusations in chat are not evidence
"Spoofer on the bid" is a claim about intent. Three problems make it weak:
- It is assigned after the fact. A wall that stays and holds is called support; one that vanishes is called a spoof. The label follows the outcome.
- Nobody in the chat can see the account. Level 2 shows a venue or market participant identifier, not the trader behind an order sent to that venue. Market maker Level 2 covers what identifiers show.
- It changes nothing about your plan. Whether a wall was pulled for an illegal reason or a legal one, your stop meets the same thin book.
If you have a specific, documented reason to suspect manipulation, the SEC accepts tips through its online system (linked in Primary sources). A screenshot of a vanished bid, on its own, describes an ordinary event.
Observe vs. infer
Go back to 10:21:00 in the Penhallow example (fictional; all figures Illustrative).
| What the screen shows (observed) | What a trader might infer | Why it is not established |
|---|---|---|
| A 40,000-share bid at $2.40 under ECNB, more than 25 times the largest other bid | "Someone big wants the stock" | One displayed order at one venue; owner, total position and intent are not shown |
| The bid has stayed since 10:18:40 | "It is real support" | Duration so far says nothing about the next update |
| The day's low is $2.38, two cents under the wall | "The wall protects the low" | Displayed size can be cancelled in one message |
| Chat says "spoofer" | "It is about to be pulled" | A guess about intent; Path A and Path C start from the same book |
Only the left column was usable at 10:21:00.
Odds box
The split is near zero on purpose. Whether a given wall was a spoof does not appear in it, because you cannot record intent. What you can record is whether the wall vanished, filled or stayed, and what your stop cost each time.
What shifts the odds
These are hypotheses to record, not findings:
- Wall size relative to the stock's volume per minute. Size that equals a few seconds of volume is different from size that equals ten minutes.
- Distance from the inside. Walls several cents away are cancelled more cheaply than walls at the inside.
- How the wall behaves as price approaches. Stays, shrinks, or moves.
- Stop placement relative to the wall. A stop one cent under displayed size meets the gap the moment that size goes.
- Halt proximity. Near a LULD band, a vanished wall can be followed by a pause before any stop fills.
Cost of being wrong
Using the Penhallow plan at 800 shares (Illustrative):
| Outcome | Exit | R after costs | Dollars after costs |
|---|---|---|---|
| Path A: target | $2.57 | +1.92R | +$92.00 |
| Path B: wall vanishes, 2¢ slippage | $2.37 | −1.42R | −$68.00 |
| Path C: time stop | $2.44 | −0.25R | −$12.00 |
| Wall trades through, fast drop, 6¢ slippage | $2.33 | −2.08R | −$100.00 |
Stops placed just beyond visible size may be common, so they can cluster; when the size goes, many stops can trigger into the same thin book. Stop-loss placement covers the trade-off between a tight stop and one beyond the crowd; Slippage covers measuring it.
How many trades before this means anything
To learn whether leaning on walls helps your plan, log every wall trade and every wall you skipped, with how the wall ended. With 20 trades, a 35% Path A share has a 95% interval of roughly 18% to 57% (Wilson, computed on hypothetical counts). See How many trades before your numbers mean anything.
What this lesson does not claim
- It does not claim any order in any real stock was or was not spoofing. Intent is a legal question decided on records retail traders do not have.
- It is not legal advice. Rule descriptions are summaries checked on 2026-10-05; read the sources for the exact text.
- Penhallow Labs, its book, identifiers and costs are fictional and Illustrative.
Go deeper
- FennEdge first. FennEdge does not offer Level 2 depth as of 2026-10-05. The Scanner (paid: Plus, Pro, Max) covers rapid rises and drops, regular-session highs and Nasdaq-listed LULD halts.
- Layering. Several orders at stepped prices on one side, cancelled together; FINRA's Rule 5210 description covers this pattern.
- Quote fading by market makers. Legitimate quotes move away when risk changes; see Market maker Level 2.
- Reserve orders. The opposite case: more size than is shown. See Iceberg, reserve and hidden orders and Absorption.
- US Day Trading Fundamentals: How to read Level 2.
Exercises
Five exercises follow this lesson: three concept checks, one replay of a static Level 2 snapshot (classify observation vs. inference at 10:21:00), and one scenario asking for the most defensible response to a "spoofer" claim. Exercises, answers and progress are available after signing in.
Primary sources
- Securities Exchange Act of 1934, Section 9, 15 U.S.C. 78i.
- SEC. Rule 10b-5, 17 CFR 240.10b-5.
- FINRA. Rule 5210, Publication of Transactions and Quotations, and Regulatory Notice 17-22.
- Commodity Exchange Act, 7 U.S.C. 6c.
- SEC. Press release 2017-63 (March 10, 2017) and Litigation Release No. 25427 (June 17, 2022).
- U.S. Department of Justice. Northern California man pleads guilty in years-long securities fraud spoofing scheme (June 2026).
- SEC. Report suspected securities fraud or wrongdoing.
Sources checked 2026-10-05. Penhallow Labs and all quotes, identifiers, outcome splits and costs in this lesson are fictional and Illustrative. This lesson is education, not legal advice and not a recommendation to buy or sell any security. Past patterns do not indicate future results.