Monday, 22 January 2018

To spoof, or not to spoof, that is the question:

This is something I wrote for Automated Trader quite a while ago. My arrangement there allowed me the right to publish after a year passed, so here it meanders.

It is a little dated now. The world has moved on a bit. Spoofing has been cleaned up a little with the enforcement actions. I feel that is a good thing. Ironically the HFT community is perhaps the one that benefits the most from said clean-up. Why? Short-term prediction is aided by knowing a valid order book with less spurious information. Who is best placed to benefit from short-term predictions using market microstructure? I'll let you answer that one yourself.


To spoof, or not to spoof, that is the question:

“Whether 'tis Nobler in the mind to suffer
The Slings and Arrows of outrageous Fortune,
Or to take Arms against a Sea of troubles,”
[William Shakespeare, Nunnery scene, Hamlet]

I've always hated spoofing, spoofers, and the concept of spoofing. I'm annoyed by their slings and arrows. I'd say the only truly appropriate punishment for a spoofer should be that old grotesque favourite of medieval torture, the rat torture. Though having rodents eat through your stomach, or other orifices, to escape the hot end of a bucket does seem a bit of a let-off for a spoofer. A painful death seems too kind.
Hamlet stabbed Polonius in error. Spoofers misguide market participants causing
many modern stabbing errors in the spoofers favour [Artist: Coke Smith, 19th century]

Things change

To spoof, or not to spoof? I'm no longer so sure of the answer.

Perhaps a milder torture, such as waterboarding, may be best. Then again, perhaps spoofing can be justified. I'm not sure I'm willing to back off that far but there is perhaps an argument for it. I think it may be worthwhile for you too to reconsider your position whether your thinking starts in favour or against. It is not as clear-cut as it may seem. Here I wish to meander through my inner angst in public.

What is spoofing?

Firstly, let's get out of the way what spoofing is. Spoofing is the placing of an order in the marketplace without an honest intention to trade. Spoofing is a lie. It is expected a spoof may profit the spoofer in some way. The reason many countries' regulators have a law against spoofing is that it is understood to be an unfair practice. Spoofing thwarts price discovery by distorting true market dynamics.

The classic example would be if Dr Evil was short AAPL. Say she has been short for a few months. Now Dr Evil has decided to buy to square off as her carefully constructed seismic event in Taiwan failed to have the market impact she hoped for. Dr Evil can either cross the spread and hit the ask to buy and square off, or wait on the bid with a limit or peg and hope the market will trade to her. Dr Evils gets a better price with the second option but the market may not trade there. The eponymous Dr Evil naturally decides to try to influence the market.

Dr Evil throws in a bunch of classic evil spoofs just above the best. She doesn't intend for them to trade but is hoping that market participants will understand her evil influence and translate it to downward price pressure. That would be normal. Lots of volume on the offer side, with comparatively little on the bid, indicates the gods of supply and demand want lower prices in a “normal” market. This may influence the market to trade down or have just enough influence to make it more probable that Dr Evil's limit orders on the bid do trade giving her at least a gain of the spread on exit.

It's worth having to think about how you might catch out Dr Evil as a spoofer. Would it be enough to see that she puts a bunch of orders above the market and then cancels them when her bids get hit?

No. Probably not. Maybe. It all depends on the evidence of intent.

In most markets, such as the US, the concept of intent is key. There are some not completely unreasonable scenarios where Dr Evil's pattern of trading may fairly occur. However, if there is a documented intention of those spoof trades to not trade, such as email, voice-records, or, perhaps even source-code, then you may be able to rise to that high test of beyond reasonable doubt. A balance of probabilities is not beyond reasonable doubt. However, if Dr Evil just worked out the spoof in her head and left no trace, beyond the transaction history, it is a tough call without a diagnosable brain scan from a truly evil future world.

A real world spoof

Let's look at an example from the haziness of past trading that really annoyed me at the time. Dial back a few years to Korea. I'm not sure the year it started, but it was post mid-2009. In stretches of relative inactivity, some joker would turn on what was effectively a square wave pattern generator in KOSPI futures market that would oscillate enough to cause the near at-the-money (ATM) options to have their dependent valuations go outside the bounds of that normally very tight market. The square wave guy or gal was spoofing. I termed this “shake and bake” at the time as it was effectively shaking the market enough that the unaware could end up repricing their options so they may oscillate to selling low and buying high which is never a good move for job security.

Here is a facsimile of what I remember the square wave price action to look like. Every couple of seconds the spoofs would arrive or be cancelled causing, in this example, a 0.03 movement in price every two seconds. This simulated example shows the impact of a 1000 lot order spoofing either side of the market in turn.

The KOSPI is a pretty busy market. The futures have a 0.05 tick size and the options below a 3.00 price level had a 0.01 tick size. A 0.03 movement in the futures, on the face of it, is impossible, say if you were using last traded price or mid-point as your futures valuation metric, but that is not how such a market is commonly used. It is normal you have a theoretical price calculation for the future. It may be simple, such as just using the last traded price, or a complex, such as a black box that integrates machine learning or statistical models integrating history and external factors. A commonly used simple proxy for reasonably liquid markets, such as the KOSPI futures, is the inverse weighted bid-ask price. I'll call it simply the weighted bid-ask (WBA) here as a non-inverse weighting makes no real sense.

This metric is simply this common formula:
WBA = (bid volume x ask price + ask volume x bid price) / (bid volume + ask volume).

It makes intuitive sense as when the bid is evacuating, say by lots of stuff trading there, a price closer to the bid is fairer and thus get weighted more heavily, in this case by the larger ask volume. It is a pretty natural benchmark for liquid markets even though it fails pretty miserably in not so liquid markets. I've often used this as the starting point and added some black-box magic to that benchmark for my trading.

Going back to the KOSPI simulation chart: you can see the ask and bid quantities are randomly moving about the 200-300 lot marks. The dotted orange WBA line represents the WBA without spoofing. Such a WBA theoretical price (theo) on the futures would be a fairly benign middle tick kind of price as nothing much is happening. With Mr Shake and Bake coming in with a 1000 lot order on the back end of the queue, oscillating between the bid and the ask, you get that squarish wave pattern with a bit over 0.03 of price action represented. If Mr Shake and Bake came in with 2000 lot spoofs you'd see about 0.04 points of price action.

It was always pretty clear that in Korea many people use something for the underlying pricing not too far from WBA as otherwise the futures and options pricing would not be so finely balanced as they were. Remember the futures have 0.05 in a tick. A delta 50 option with a 0.01 price tick has 2.5 ticks per futures tick. This significant difference in tick influence helps open the door to the spoofer screwing with the index option market. Hello Mr Shake and Bake.

Mr Shake and Bake only intervened when the market was pretty quiet. This would have been so he could have spoofed at best in the market with no real risk of actual trading. That is, Mr Shake and Bake seemed to have no intention of trading. Mr Shake and Bake would let it run for a few minutes and then take some time off to gloat I suppose.

Let's look at the consequence of the shake and bake for the option market maker (MM) in the following chart.

You can see the theoretical price of the option gyrates with the Shake and Bake when priced off the spoofed WBA whereas without spoofing it would sit comfortably between the bid and the ask. In one scenario the MM would just lose priority as they cancel and repost orders. However, the MM may also end up selling low and buying high as it views false edges appearing for trading. That is, the MM could see the theo above 1.52 on the option and buy at the ask of 1.52. The MM could then see the theo below the 1.51 and sell the option at 1.51. That would lock in a nice loss which would continue as long as the MM doesn't adjust to the shake and bake.

Just for completeness, if Mr Shake and Bake used 2000 lot spoofs, or if the 1000 lots were used and the natural market was half the size in volume, the delta 50 action would look like this:

This example is interesting as it highlights it is not just the primary market we need to be concerned about. If there was a spoofer in the CME E-Mini S&P futures then, as it is a primary price leader, many other markets, including options, ETFs, stocks, warrants, etcetera, may be being affected.

We never did put any work into mitigating Mr Shake and Bake. It was fairly infrequent and fairly obvious. The trader working that desk at the time was as thick as a short plank. He made people nervous if he dared to reach out and touch a button on the HFT machine. However, the spoofing didn't really pose too much of a problem even to him. A properly trained machine learning layer, or reasonably simple heuristic, would have mitigated but there was no real need. There was a marked increase in option trading volume as a consequence, implying it was a real issue harming the market even if not our trading. Mr Shake and Bake's harvesting seemed to work.

Now, could Mr Shake and Bake have been prosecuted by a regulator? I would have liked that. I'm not really sure. Perhaps just a small dose of Rat Torture. The activity was clearly automated as the square wave WBA action was precisely timed, regular, and obvious. The Shake and Bake was timed for a quiet market indicating a reluctance to trade in the futures market, even though the orders were at risk of trading. The intent could be hard to prove. Normally spoofing is seen as a criminal activity and thus it would have had to be proved beyond a reasonable doubt. Were there incriminating emails, voice records, or, perhaps clarity for no-intention in the source code? Who knows? I think it unlikely a prosecution could have succeeded. Particularly as the spoof was at best, not at depth, so there was an imminent danger of transactions.

Bad intentions

Imminent danger is not enough to save you in most jurisdictions. It is about intent.

Think of insider trading. A bad insider may lose money on the trade but they still may be prosecuted for their misuse of information. That's the case but you'd think public humiliation and general laughter would be enough for a bad insider trader. Usually, only the traders with ill-gotten gains, rather than ill-gotten losses, are prosecuted. Similarly, for a spoofer, even if your trades were at risk and do not trade, perhaps you are at risk of prosecution due to your intention not to trade. A bad spoofer is still a spoofer.

One of the high profile cases in spoofing is that of Navinder Singh Sarao. The US is looking for an extradition from the UK to the US for this version of an alleged Dr Evil. Sarao denies all the allegations. There is such hyperbole around this case from some quarters that you'd think the guy single-handedly caused the entire 2010 Flash Crash with his alleged E-Mini spoofs. The truth seems a little different. To me, there is little doubt he is a spoofer as he refers to his “spoofs” in emails to his developer. However, like the bad insider trader, it doesn't always go his way, as Bloomberg reported,

“I need to know whether you can do what I need, because at the moment I'm getting hit on my spoofs all the time and it's costing me a lot of money,” Navinder Singh Sarao wrote in a February 2009 e-mail to a programmer he'd tapped to build trading software, according to the grand jury indictment filed Thursday in federal court in Chicago.
[Bloomberg, September 4, 2015,]
Even if the execution is suspect, the intention seems clear, no?

Sarao's case is different to Mr Shake and Bake as it is alleged his orders were plced one side of the market at depth and not a best. There would seem to be less risk of a trade, though the February 2009 email referenced above suggests not. A trader seeing copious volume at various levels above the market may conceivably be spooked into thinking that translates to downward pressure on pricing but that seems a little naive. Obviously, a simple WBA would not be affected in that scenario but a broader algorithm that evaluates volume at depth might. I don't think too many proper black boxes would be spooked though.

It was reported by Reuters on 5 February 2016 that Sarao is claiming that there is no UK law against spoofing and that his orders were at risk as they were in the market and anyone could trade against them if they so chose []. There is a good argument to that. I certainly have some sympathy for the idea that if an order is in the market it is at risk and hard to call it as a spoof. However, spoofing is not really concerned with the order being trade-able or not as we've discussed. A bad spoof that trades is still a spoof. It is the intention or state of mind that matters.

Should Sarao be subject to the Rat Torture of extradition?

Things that can look a lot like spoofing but aren't

Spoofing can look a lot like spoofing but isn't. I don't mean to be facetious here but the occasional exchange has been known to suggest spoofing as a legitimate activity. Remember in the Flash Crash part of the story was a thing or two trading for 0.02 or some such crazy low prices? Well, part of the reason for this was that exchanges may have suggested to market makers that they could fulfil their continuous quote obligations by quoting very low prices to buy, or high prices to sell, instead of pulling their quotes completely. It seems a rude hack. Now there would be no intention to trade at that price, but then again, the market participant would be seemingly happy to pick up silly prices if the trades didn't break. I don't really get this as normally continuous quote obligations have spread requirements. It is what it is. It happened. Is it spoofing? It kinda smells like it but it isn't really as there is not an expectation that it will trade but general happiness if that was to occur without a trade break.

Market making is a game of fast cancels to avoid adverse selection and fighting for priority in the order queue so you can best make a spread. Some MMs will put orders in both sides of the market at depth around the current price to gain priority in queue position by marking out territory in advance. There is often a statistical unlikelihood that these will actually trade. Is it spoofing? I'd say nope. There is a hope they will all trade profitably. That is, there is a real intention to trade.

MMs often use a so-called inventory model. With a balanced inventory, e.g. no position, you'd quote on both sides of the market. If you hold a position you may only choose to have your limit or pegs on the other side of the market so you can earn the spread without growing your inventory. A smart and fast MM may be able to do this without pulling all their at depth orders on both sides. A more naive, or more risk-averse, implementation may pull orders at depth so you don't risk positions in the same direction. Another implementation may pull orders at depths on the other side so you are not creating “pressure” against your inventory position. This second scenario may look a lot like a spoof. It is not. It would just be getting out of your own way due to inventory. You can imagine many seemingly legitimate scenarios can look a lot like spoofing even though there was indeed a hope and desire that those queue priorities being fought for do actually trade.

One thing that makes priority games look more like spoofing is when your priority limit order may be fairly large. Now you put in that large order because you genuinely hope it is appropriate and you do intend to trade all of it if given the appropriate opportunity. However, statistically, it is most likely to be modified to be somewhat smaller or even cancelled. Is that a spoof? I think not. There is an original intention, even hope, that you'll trade it all. Some may differ in their view.

Painting the book

A market maker may go to extremes when fighting for priority. Depending on the market, instead of just trying to maintain queue position for a bunch of prices around the market price, they may decide to go for priority at every conceivable price! I refer to this as painting the book. Quite a few people do this. Not just MMs. In some markets when the ordering pre-market window opens there are “opening races” with a flood of orders gushing into the market at the earliest opportunity. All of those orders are fighting to be as close to top of book as possible. A “paint race” really. In a hyper-competitive market, you may like to analyse this quite closely to observe and learn from others. I certainly have. Sometimes you kind of get to know the personalities and behaviours of the traders due to the somewhat unique sizes of their orders in the queues. The inferred trader becomes known to you as 42 lot guy or 7 lot guy. You can observe how they manage their book. It is always interesting to see how nervous, or not, people get trying to pick up pennies in front of the market steamroller.

Is painting the book a spoof? You may be placing an order outside a couple of standard deviations of normal movement. Again, I would suggest there is an intention to trade if you would be so lucky even if not an expectation.

Every market varies quite a bit here with respect to painting as to what is allowed and what is not and when and how the margining, risk, or funding may work. In some markets it breaches rules. Some markets allow it and it may even be necessary to compete. Such practices can annoy other traders when they fail to get priority due to other long-standing queue lurkers. When the market gets close to the level staked out in advance and you decide to vary that order based on inventory, risk, or otherwise; it can look a lot like a spoof. Especially when the trade is cancelled.

Allowing spoofing?

The simplest argument is that if the order is at risk it shouldn't be considered a spoof. It can be traded with. End of story. This is not totally unreasonable. Especially from the point of view of someone sweeping a few price levels. A spoofer would be road kill in that circumstance.

In my heyday in Korea, I'd typically average around six to seven percent of the index option market with the occasional day over ten percent. Well over a million index option contracts with the old multiplier on those bigger days. You have to run things very exactly with tight tuning to trade a million index options in a day. I hated that spoofer with a vengeance for interfering with my orderly view of the world. The world is better when it behaves just as you've rehearsed. I suspect the spoofer was having a bit of fun by fighting against people like me as they threw their spanners, or square waves, into the works.

It may be that Sarao believed that the only way he could compete against the HFT machine was to thrust, parry, and fake. In a trading pit, you can imagine people acting like they do have a big order, or acting like they don't have a big order, so they don't get screwed on price. Is that so different?

An iceberg order is an interesting symmetry to the spoof. Here you are kind of faking by presenting a big order as a small one. The hidden component of the iceberg replenishes the visible as it gets traded away. You're lying about your intention to trade a small size as a larger quantity already sits at the exchange hidden from view. Exchanges kindly provision those order types so you may efficiently disguise big orders as small ones. Why the distortion? Is faking a small order really that much different to faking a large order? Hmmm.

Computers traditionally haven't been that great at poker as it is a game of incomplete information with faking, bluster, and posturing all part of the game. Though that seems to be changing as AI improves. It does make you think. Perhaps spoofing is part of the last bastion of human ingenuity to beat the computer overlord. Maybe that itself is enough reason to ordain it as acceptable.

Perhaps the chaos from voracious spoofing would make the randomness of the order book so extreme that there is no information in there at all. All you could do for your legitimate trades is understand where the market is trading and put your legitimate order in the market without a supply and demand context. In such a scenario you could argue that spoofing has actually made the market completely fair for all participants! There would be no micro-alpha in the depth sizes. I can imagine a lot of buy-side investors would like such a signal free market to push their large institutional orders through.

It is worth thinking more regarding what a market may look like under the hammer of voracious spoofing. Given throttling due to technical, regulatory, and financial limits, there would not be virtually infinite spoofing at any marketplace. Exchanges have limits of tolerance and the ability to control and specify order traffic. Parties with correlated open interest would be incented to bias the order book in their favour for their existing positions. Other parties would be interested in creating an asymmetry in the book they could lie in wait for.

You'd imagine the likely chaos from the Game of Orders, without true trade intention, would likely destroy all information value in the order book. There would be no true picture of supply and demand from quotes. Trades would reign supreme. The spoofers without position would try to create asymmetries of advantage. The incented with positions would try to limit signals against them by having the order book stacked in their favour, or at least not against them. Stacking one way would be vigorously opposed by their market colleagues with conflicting positions.

There may be two ways of looking at this in a game theoretic sense: 1) either the equilibrium is a balanced order book with no information; or, 2) the order book perhaps represents the overall open interest of this and correlated markets within the tolerance of risk associated with orders without trade intentions. I suspect the risks associated with scenario 2 would make it look like scenario 1 and we'd end up with a balanced order book within noise thresholds. Either way, the usefulness of the order book as an indicator of supply and demand is destroyed. We would all have to throw out a chapter or two of our favourite market micro-structure textbooks.

Further to this dystopian view, perhaps the current reality is such that only less mature markets contain significant information of supply and demand in the modern order book. Think about it. Sophisticated investors should already be using algorithms to appropriately disguise their intentions. This is common and the algo's child orders leave faint impressions. That is, participants are already evading leaving supply and demand traces in the order book. Anecdotally the maturity argument seems somewhat true enough to me when I compare order books in Asia to the US. There tends to be more information in Asian order books. This hints at a seemingly obvious thought: the equilibrium of strategy evolution may be such that the order-book end game is a book where trade intentions are not reflected. This lack of information may be no different to an order book under voracious spoofing.

A somewhat axiomatic extension may be that any order book imbalances are thus spoofs by definition. A proper market participant would not transmit their real market intentions so clumsily. That could minimise the opportunity for a Mr Shake and Bake as the market would simply ignore the square wave signal as it would surmise that no one would be so stupid.

If spoofing does not add nor detract from market information, why complicate life and ban it? Markets are robust beasts that can cure many evils on their own thanks to the incented vigilance of the participants despite the motivations of those same participants to undermine that very same market.

Strangely enough, perhaps the largest beneficiary of voracious spoofing may be the large institutional trader, the buy-side.

All that said, I don't buy it... yet.

Then again, maybe I just say that as I'm predisposed to pleading for any of my much-appreciated order book micro-alpha to remain?

Other spoofs

There are other reasons spoofing may be bad. In a quieter market, or market system, bait and switch, or promoting by diming to hit the diming opposition can be used and is evil. You can stuff quotes down an exchange's pipeline to artificially delay it, similar to a denial of service attack, and cause some benefit to you. You could push around an auction, such as an opening or closing call auction, with spoof orders finding some benefit. Some pricing benchmarks are based on quotes rather than trades and are thus susceptible to spoofs. Then again, you can also improperly influence markets with actual trades and not just quotes. Spoofing seems worse than a trade as such an order typically has a marginal cost of zero. At zero cost there seems no bounds to the havoc a Dr Evil could dream up.

It is worth noting that none of these are HFT evils. They are simply trading evils. They could be done by an HFT but it is unimaginatively weak thinking to put such bad behaviour at the feet of HFTs. Sarao is a good example of the mostly manual trader screwing with the market with a little non-HFT automation. Allegedly.

Would a transaction tax cure spoofing?

It would be naive to use a transaction tax to quieten the market to foil spoofing. That would not necessarily threaten the economics of a spoofer. All you'd succeed in doing is both making the market inefficient, thus harming its related economy, and pushing away trading to other markets. Also, you can see Mr Shake and Bake wouldn't have been affected by a transaction tax. The economics of the occasional order for many derivative spread gains would still stack up for Mr Shake and Bake.


I think I still hate spoofers.

If you look at various market making scenarios, it is easy to see that a lot of legitimate intentions to trade can look suspiciously like spoofing. How can you really tell? Discovering intention seems invasive. I'd not like to see the SEC and CFTC team up with the NSA. You have to ask yourself: are the false positives really worth the chase?

I can see that there is not only a Luddite argument for spoofing to fight against the machine but perhaps spoofing could make markets fairer by chaotically disguising supply and demand. Aren't markets about supply and demand though? Is it simply enough that, regardless of intention, the order is in the market and it is indeed trade-able? After all, the risk is real.

Yep, I still hate spoofers and their evil spoofing. Age wearies and confusion has mellowed my thoughts. I'm no longer feeling motivated to “take Arms against a Sea of troubles” caused by spoofing. And yet, I'm no Atticus Finch. That is, I'm holding my spoofer pitch-fork but I no longer want to join the lynch mob. How about you?


PS: Sorry about all the references to Hamlet. It is dear to my heart as my common avatar on twitter is myself appearing on a video screen with a few dancers on stage as Hamlet's ghost. This was in a rewrite / reinterpretation of Hamlet that my eldest daughter, Bec, wrote and directed. I'd be flattered but my daughter chose me as she felt I looked sickly. Perfect for a ghost. Thanks darlin'!


  1. Good overview, Matt. Regarding your examples, I think most spoof orders are on the book for far less than 2 seconds, since a time period that long could open the spoofer up to actually getting filled. I recall a few SEC & CFTC cases where the orders are resident for milliseconds, not seconds.

    Why is that important? Because only (naïve) technology-driven traders would be fast enough to respond to such short bursts. To a human these would look like flickering quotes, if he could see them at all. So, to complement your original thesis, these games are aimed mainly at HFTs who aren't paying attention.

    1. Indeed. The worst is the party that pumps best, you join, they fade and hit you. From market service provider to sucker in a millisecond. Always a toxic embarrassment. The final bolgia of Dante's Eighth Circle is home to various sorts of falsifiers and it seems too good for that kind of spoofer.

  2. would a solution (that probably wont ever happen) be to charge the trading fee at the time the order is put in instead of when it is executed? Or is that just crazy?

    1. It's not crazy. Brazil charged for cancellations so they could lower the quote rate and it ended up killing their two sided liquidity, especially for stock options. So, it is dangerous in efficiency terms. It would be difficult to get right and not interfere with efficiency. Personally I think the efficiency argument should win and we should look elsewhere, but it is not a crazy thought.

      Many people don't realise there are already fees that fund the SEC on public stock transactions. These fees are pretty small and aren't too onerous so many don't even notice, but, again, we have to be careful what we wish for.