Spoofing, icebergs and what the book hides

The book is a record of stated intentions, and stated intentions can be false. Before you learn to read the DOM in Module 2, you need to know the two main ways the picture is distorted: orders that are shown but not meant (spoofing) and orders that are meant but not shown (icebergs). You also need a realistic sense of how much of the market's true intent is visible at all.

Spoofing

A spoof is a large limit order placed with no intention of being filled. Its purpose is to make other participants believe there is heavy interest at a price so they trade in the direction the spoofer wants, and it is cancelled before it can be hit.

  Bid  | Price   | Ask
  -----+---------+------
       | 5000.75 |  140
       | 5000.50 |  120
       | 5000.25 |   95
   110 | 5000.00 |
   900 | 4999.75 |        <- appears, sits for 2 seconds
   180 | 4999.50 |

A 900-lot bid on a product where the average level holds 150 is designed to be noticed. Traders reading the DOM see "a wall of buyers" and lift the offer. The spoofer, who was short or who wants to sell, hits their buying, and the 900 vanishes.

Spoofing is illegal on regulated exchanges in most jurisdictions and has been prosecuted with large fines and prison sentences. It still happens, particularly in less policed venues, and even where it is rare the fear of it is enough to make a raw size read unreliable. The defence is simple: a resting order only matters if it is still there when price arrives. Size that disappears as price approaches was never liquidity.

Iceberg orders

An iceberg is the opposite deception. A participant wants to buy 2,000 contracts at 4999.75 without showing it. They submit an order that displays 20 and automatically refreshes 20 more each time the displayed portion is filled. On the DOM you see a bid of 20. On time and sales you see 20 trade at 4999.75, then 20 more, then 20 more, and the bid is still 20.

  Time      | Price   | Size | Side | DOM bid at 4999.75 after
  ----------+---------+------+------+--------------------------
  10:14:02  | 4999.75 |  20  | bid  |  20
  10:14:02  | 4999.75 |  20  | bid  |  20
  10:14:03  | 4999.75 |  20  | bid  |  20
  10:14:03  | 4999.75 |  20  | bid  |  20
  10:14:04  | 4999.75 |  20  | bid  |  20

Five prints, 100 contracts sold into the bid, and the bid has not shrunk. Sellers who thought they were hitting a small bid have run into a wall they cannot see. This is one of the cleanest signals in order flow: traded volume at a price far exceeds the size that was ever displayed there, and price refuses to move.

Some platforms detect this automatically and label "reloading" or "iceberg" activity. You can also spot it manually by comparing the cumulative volume printed at a price on the footprint with the largest size that ever showed on the DOM at that price.

What else the book does not show

For a single centralised futures contract, the book plus time and sales is close to the whole picture, with the exception of stops and intentions. For a US stock it is a fraction. For spot crypto on one exchange it is that exchange only. Keep this in mind when you decide which product to practise on.

Key idea: The DOM shows displayed intent. The tape shows what actually traded. When they disagree, trust the tape: prints cannot be cancelled.

A practical stance

Treat displayed size as a hypothesis and prints as evidence. Concretely:

• A big resting order means nothing until price gets there. Watch whether it holds, pulls or gets hit.
• Repeated prints at one price with no change in displayed size mean hidden size is present.
• Volume that trades far in excess of displayed depth means the book understated real liquidity.
• Price that moves through displayed size easily means the size was thin, pulled, or spoofed.

This is why Module 2 spends a whole lesson on pulling and adding, and Module 3 on comparing printed volume to expectations. You are always testing the displayed book against what the market actually does.

Try it: On a DOM, find the largest resting order you can see on either side. Note the time and size. Watch until price either reaches it or moves away. Record which of four things happened: it was hit and filled, it pulled before price arrived, it was partially hit and then pulled, or price never got there. Do this ten times over a week and see how often displayed size did what it advertised.

Recap

• Spoofing shows size that is not meant; it is illegal on regulated exchanges but the risk makes raw size reads unreliable.
• Icebergs hide size that is meant; they reveal themselves when traded volume at a price far exceeds the displayed size and price holds.
• Stops, hidden orders, off-exchange trades and algorithmic intent are all absent from the displayed book.
• A single futures book is close to complete; a single stock or crypto exchange book is a fragment.
• Treat displayed size as a hypothesis and confirm it against prints.