The Behavox guide to spoofing

US authorities this week announced the largest takedown of criminal activity in the futures market to date, bringing six cases involving eight individuals across every corner of the world.

Seven of the eight individuals were charged with the crime of spoofing, an illegal trading practice that can be used to manipulate the commodities markets.  

Only three other individuals have ever been publicly charged with the crime of spoofing, so what does it actually involve?

What is spoofing and layering?

Spoofing is a practice in which traders attempt to give an artificial impression of market conditions by entering and quickly canceling large buy or sell orders onto an exchange, in an attempt to manipulate prices.

Though the tactic has long been used by some traders, regulators have only recently begun clamping down on the practice. The 2010 Dodd-Frank Act specifically forbids spoofing.

Layering is a more specific form of spoofing, and occurs when a trader places multiple orders that he has no intention of executing. The fake orders trick other market participants by creating the false impression of heavy buying or selling pressure.

The rogue trader places subsequent sell orders for the security at successively lower prices as the best ask price falls (to increase the appearance of selling interest). When the price has dropped sufficiently, the trader makes a real trade, buying the stock at the now lower best ask price, and cancels all the sell orders.

Spoofing is hard to detect because it is typically a solo act and communication trails are often thin and easily attributable to other instances of market activity or just trivial discussions.

Moreover trade data in isolation is not easy to monitor because placing and cancelling orders is not immediately indicative of spoofing.  

The tools to protect against spoofing are aggregating multiple data points (trade, comms, market data) in one place to run analytics in concert.

Behavox can detect spoofing on three fronts:

1. Trade data: Behavox can create scenarios that look for placing and cancelling of orders within a short time frame related to a particular ticker.

2. Trade and communications: the presence of tickers in communications internally, mentioned between persons followed by active engagement in the placing and cancelling of orders OR execution of a trade following a rapid, inexplicable change in market price.  

3. Communications: we can help with specific lexicons based on all relevant previous enforcement cases with regard to spoofing  – such as discussions on quotes, orders, and instructions.

Behavox stresses the importance of maintaining good chat room policies; are there permanent chat rooms with traders from different banks? If so, why? Should you look at reporting on chat rooms?

Are your traders having an unusually high volume of comms with competitors or brokers? If so, why?

Are your traders displaying unusually strong relationships with others in financial services, if so, why?

The unique Behavox Platform reveals relationships that are abnormally close between competitive firms and can be identified quickly by monitoring teams.

This function is facilitated by the platform’s ability to identify external contacts and also map individuals based on data extracted from their electronic signatures.

The use of machine learning to analyze who is ‘trusted’ most by each monitored employee is insightful to surveillance and control groups aware of the competitive environment and the capital markets landscape in which they operate.