Granthara02.02.04Spoofing, iceberg orders, and why the book lies

All order sequences here are invented. They do not imply manipulation in Bharat Foods. A screenshot or one cancelled order cannot establish a trader's intent.

02.02.04 · Spoofing, iceberg orders, and why the book lies

PreviouslyA top-level 2:1 imbalance and a five-level 1:1 balance can describe the same unchanged book.

The book shows instructions, not promises.

An extra 700-share buy order appears beside the 200-share best bid. The screen suddenly looks buy-heavy. A moment later that extra order is gone and no share from it has traded. Did demand disappear—or was it ever meant to trade? The screen alone cannot decide.

A visible order may be cancelled, a larger order may show only a slice, or a deceptive order may try to shape what others believe.

Updated

700
extra hypothetical bid shares that could appear and vanish without a trade
Part 02 · Inside the Order Book
  1. 02.02.01 Bid, ask, spread
  2. 02.02.02 Market depth and the five-level view
  3. 02.02.03 Reading imbalance in the book
  4. 02.02.04 Spoofing, iceberg orders, and why the book lies
  5. 02.02.05 Traded volume vs pending quantity
0 of 5 read
Learn

First, the ordinary reason: an order is revocable

The five-level board from 02.02.02 starts with 200 bid shares at ₹499. Imagine that a separate 700-share buy order joins that price. The displayed best bid quantity becomes 900. If the additional order is cancelled before a match, it returns to 200 and traded volume does not rise because of that cancellation.

There are innocent reasons to cancel: the buyer may have obtained shares elsewhere, changed a price limit, or decided the order no longer fits their plan. In the ordinary continuous market, unmatched orders can be modified or cancelled under exchange rules. One cancellation is not evidence of spoofing.

See it

Three reasons the visible book is incomplete

Tap each case. The first is an ordinary choice, the second is a disclosed-quantity order, and the third requires deceptive intent that a single screen cannot prove.

The 1,000/200 example illustrates NSE's disclosed quantity condition. It is separate from the five-level Bharat Foods board.

Try it

A 700-share bid is cancelled before trading. What is justified from that fact alone?

Learn

Iceberg describes a different limit

An iceberg order is a common name for a large order that displays a smaller piece at a time. NSE calls the relevant order condition Disclosed Quantity. In its example, a 1,000-share order with 200 disclosed shows 200; after that slice trades, another 200 is released, and the process can repeat. Whether this condition is available depends on the market and session; for example, NSE's pre-open rules do not allow it there.

A replenishing level does not mean a single investor certainly owns every new 200 shares you see. Other orders can arrive at the same price. The point is narrower: visible depth can understate the total quantity one eligible order intends to trade. Hidden quantity is not a promise that it will fill your order at your desired price.

Learn

Spoofing is about what was intended

Spoofing means placing conspicuous orders to create a false picture of demand or supply while intending to cancel them rather than trade them. A sequence may involve taking trades on the opposite side while the large display influences others, then removing it. That is manipulative conduct, unlike a permitted disclosed-quantity order.

SEBI's surveillance material describes such patterns, but proving one requires the order and trade history and evidence about intent. Size alone is not enough; frequent cancellations alone are not enough. Some orders expire or are cancelled for legitimate reasons. The word ‘lies’ in this lesson's title is a warning about what the display cannot establish, not a claim that every order or every participant is dishonest.

If you are making a decision, the usable response is to check executions, persistence, price levels and the size you intend to trade. Do not assume a wall will defend a price, and do not accuse a real participant based on a retail screenshot.

Try it

NSE's example shows 200 shares from a 1,000-share order, then another 200 after the first slice trades. Which reading is accurate?

Remember

The displayed book is revocable and may show only part of an eligible order; spoofing is intentional deception, which one large order or cancellation cannot prove.

Everything this chapter has told you, in order

  1. 02.02.01Bid and ask are waiting terms; their gap is the spread, while LTP records an earlier trade.
  2. 02.02.02Five-level depth shows displayed quantity at five prices on each side, not the whole book or a guaranteed fill.
  3. 02.02.03An imbalance describes displayed quantity in a chosen price window, not the number or intent of traders.
  4. 02.02.04The book shows revocable orders and sometimes only a visible slice; deceptive intent needs more evidence.
Next
02.02.05 — Traded volume vs pending quantity

Next: separate shares already traded from shares still waiting in the book.