Spoofing and Iceberg Orders, Explained
Spoofing and iceberg orders are two ways large traders hide or fake their real intentions in the order book, but only one of them is legal. Spoofing means placing big buy or sell orders you never plan to fill, just to trick other people into thinking demand or supply is building, then cancelling those orders before they execute. It's a form of market manipulation, and it's illegal in regulated markets. An iceberg order is the honest cousin. It's a genuinely large order chopped into small visible pieces, so only the tip shows at any moment, which lets a fund buy or sell a big position without scaring the market. Both make the order book look different from reality, so knowing they exist helps you read price action with a bit more skepticism.
Not every large order on the book is real, and not every real order is visible. How traders interpret iceberg and spoofed size as context with caution.
Key points
- Spoofing is placing orders you intend to cancel, to create a fake impression of buying or selling pressure, and it's illegal in regulated markets.
- An iceberg order is a large real order split so only a small slice shows in the order book at once, and it's a legal way to reduce the price impact of a big trade.
- The tell for spoofing is a big order that flashes onto the book, nudges price, then vanishes without ever getting filled.
- The tell for an iceberg is a price level that keeps absorbing trades and refilling, as if the size behind it never runs out.
- Both distort what the visible order book (the live list of resting buy and sell orders) is telling you, so a large order on screen isn't proof of real intent.
- You can't spot either one with certainty from a retail screen, so treat them as reasons for caution and context, not a trading edge.
Frequently asked questions
Is spoofing illegal?
Yes. In regulated markets like US stocks and futures, spoofing is banned and enforced by regulators, and traders have been fined and even jailed for it. What makes it illegal is intent: placing orders you never actually plan to execute, purely to move other people.
What's the difference between spoofing and an iceberg order?
It comes down to intent and honesty. A spoof order is fake and meant to be cancelled. An iceberg order is real, and the trader fully intends to fill it. They're just hiding the total size so the price doesn't move against them while they work the order.
How can I tell if a price level is being spoofed?
Honestly, you often can't be sure. A classic pattern is a large order that appears on the book, pushes price a little, then disappears before anyone can trade against it. If big orders keep flashing in and vanishing near the same level, that's a red flag rather than proof.
Why would someone use an iceberg order instead of one big order?
To buy or sell a large position quietly. If a fund showed a huge order all at once, other traders would step in front of it and push the price away, making the fill worse. An iceberg drips the order out in small visible pieces so the market barely notices.
Where can I study order flow like this myself?
You can explore order-flow and market-structure ideas with AlgoAgent, the AI agent inside Agenticks. Describe what you want to look at, like how a price level absorbs volume, and the agent can help you pull the data, build a study, and review what happened. Treat the output as context to learn from, not a guarantee about what price will do next.
Related on Agenticks
This content is for educational purposes only and does not constitute financial advice. Trading involves risk, including possible loss of capital.