Order Book is a great tool for traders and investors which
is normally offered by many trading platforms and exchanges. It gives
participants information about the current liquidity provided by market makers
on buy and sell sides. In other words, by looking at the order book’s different
price levels, one can easily understand that it is a place where demand meets
supply. In the center, there is a market price highlighted – this is the price
where the deal happens at that second, where the demand just met the supply.
The following figure (© Interactive Brokers) visualizes it very well:

When interpreting the order book information it is important
to have in mind two perspectives: Market Maker Perspective and Price Taker
Perspective. Market Makers are large financial institutions that are obliged to
prove liquidity to the market in other words they are the sell side. On the
other hand, we have price takers, hedge funds, pension funds, prop firms,
retail traders and investors – the buy side.

As one can see, in the center there is a column of Price, on
the left hand side of price column we have Bid Size column and on the right
hand side we have Ask Size column. Bid Size column in yellow and particularly
numbers 1, 3 and 15 show number of lots that someone wants to buy (Market Maker
Perspective) at the respective price level. It is quite normal to see
increasing bid size the more below we go. This is also logical, the lower the
price, the higher the demand. On the right hand side, there is a column of Ask
Size in Green which shows offers in other words, supply, in other words, limit
sell orders. In this case the ask size or supply size increases the higher the
price, as more participants want to sell
at a lucrative prices(Market Maker Perspective). In the center, one can see a
blue cell “1 @ 165.45”, this is the last market trade or the last
matching between demand and supply for 1 lot (1 lot = 100 Units of the stock).
In addition to this, in the price column, one can see a price of 165.46 in
yellow, this is the best bid and the one in green 165.52 is the best offer, in
other words, the spread for this instrument is 6 basis points or 6 cents. This
also means, that you as a price taker can only buy at 165.52 and sell at
165.45. During the trading day and from broker to broker the spread width can
vary to 1 cents or even to zero and in some very extreme cases there can be an
inverted spread where offer is less than bid.

So, how can this great tool be used by “bad
guys” to manipulate others’ psychology and thus behavior and thus market
price? In order to answer this question, we should also explain one more thing:
If you look at the Bid Size and Ask Size Columns, right underneath you will
notice total bids of 22 and total offers of 12. Your interpretation should be
that buyers want to buy 22 hundred stocks and sellers want only 12 hundred to
sell. There is obvious misbalance here you would think, as there is much more
demand than the supply, thus, logically the price should go up. “Well,
then I am in”. If you are an “unsuspecting investor” you would very
likely buy this security not waiting till those large orders actually get

This is exactly the interpretation what gets
manipulated. Namely, what perpetrators a.k.a. manipulators do is that they send
a huge order on one side of the order book, which creates misbalance and thus
misleading interpretations. Misleading Interpretations might and some are
creating a “chain effect” – where multiple participants get enticed
into the scheme and they actually do not wait till the large orders are
executed but they enter the market for themselves. This increasing activity
pushes the price in one direction. The perpetrators – owners of those large
orders, use this opportunity to enter the market on the opposite direction (with
now improved prices), cancel their original large orders and leave the stage
with nearly risk free profits.

There are different techniques how this can be
done. One of the simplest is the scenario called Fictitious Orders a.k.a.
“entering orders without an intention to execute them”. Another very
much similar scenario is Spoofing. The third and the most complex one is called

Fictitious Larger Orders. This scenario
as well as two other includes three major steps: Build-Up, Un-Winding and
Cancellation. During Build-Up stage of Fictitious Orders Scenario, a
perpetrator (probably with a relatively large trading account or at least large
buying power for example a prop trader) sends a very large limit buy order. If
we take the above example with 22 on Bid side and 12 on the Ask Side, Let’s say,
that the perpetrator bids 1000 lots of the instrument @ 165.41 (below
the best bid, in other words, below spread
The top level of the book is instantly updated with Bid Size of 1022 and Ask
Size of 12. The more participants see this misbalance the better it is for the
manipulator as it is more likely that more people will interpret this
misbalance as follows: “hmm…increase in demand, this is probably a hedge
fund having some upgrade or earnings news on this stock, I want to join the
party” and buy in. The more market buy orders, the higher the pressure on
price as the more existing liquidity will be consumed and the price will
eventually move up (chain effect). The manipulator is waiting for just that
moment. He will sell this security (either because he had a position
previously, or sells short) or in other words, “un-wind” the original
direction. In the last stage he either completely cancels the initial large
order or he modifies it so that it is not any more significant or relevant
(e.g. modifying the quantity from 1000 lots to 1 lots only, or modifying the
price so below that market will never reach it).

In order for this scenario to work, obviously,
there has to be several assumptions met: 1. The instrument should be followed
by number of participants and order book should be available to all of them. 2.
Initial Large Order should be large as compared to the average daily volume on
the market of the security e.g. stock ABC trades 100 000 units on average every
day. At least 25% of this average daily volume should be regarded as
“enough” to have some effect (at least short term intra-day) on the
market price. The higher the original order obviously the higher the odds.
Logically, from here, such manipulators with large trading accounts (let’s say
from 1 000 000 €) would aim at thinly traded securities and low caps e.g. a
stock priced at 5 € and ADV of 200 000 units per day. Theoretically, such an
account has all means to manipulate this kind of relatively illiquid markets as
the total buying power largely exceeds the amount which would be needed to fill
in day’s average volume and thus consume all daily liquidity. 3. If short
selling restrictions apply like in some countries within EU, then this account
should have a position to be able to unwind.

Spoofing. This scenario is nearly the same as the
scenario described above with one hook. This is typically being done by a
“fast” trader e.g. an ALGO or some other automated trading system.
What a “fast” ALGOs can do is send a very large order within
(in our example, this would be e.g. a 1000 lots Limit Buy @ 165.50) and
take them down before spread manages to adjust itself so that the large order
is hit. The effect of the spoofing is smaller in terms of basis points and more
short term oriented than that of the scenario above. Hence why, the activity of
spoofing is means more frequent sending and canceling/modifying the large order
than in the case of the scenario. This scenario can however entice not only
other ALGOs but also other carefully monitoring traders of order book.

Layering. Layering
like spoofing is more likely executed by “fast” traders than not.
Here is why: Layering is a smarter way of doing both of the scenarios above.
The manipulator decides to mask his activity by splitting the large order into
smaller sized but still significant layers of multiple orders. If we go back to
our example, the manipulator would split the 1000 lot limit buy into 10 layers
of 100 lots and send first 100 lot at the level of 165.50, the next at 165.49,
etc.. till the tenth layer at 165.40. Order book after these layered would
obviously look like more busy with built up demand on the left hand side. The
rest of the story is known. Other price takers interpret the change in the
order book as positive, act on it, which in turn leads price to go up.
Originator of the Layered Orders cancels all or some of the layers and sells
the security for improved prices.

All of the three scenarios can be done in different
combinations of actors, instruments (underlying vs. Derivative), exchanges e.g.
either by a single trading account in a single instrument or by multiple
trading accounts (but the same party) in the single instrument or in a
cooperated manner by different parties in a single instrument or in a
cooperated manner by different parties in multiple correlated securities(Cross
Product/Market). These possibilities make these scenario very hard for
compliance to fully cover and have surveillance for.

One of these possibilities would be the following scenario: One
of the three prop traders (with cumulative buying power of few million dollars)
has a levered long position in the CFDs (Contracts for Difference exactly
replicates the price of the underlying but is a OTC instrument mainly designed
for retail traders) with an underlying of a Stock ABC. He is not happy with the
recent price performance of their position and asks his friends whether they
could help. His plan is that the two of them should at the same time send large
limit buy orders in the underlying stock during the last 15 minutes before the
close (most active periods on the exchange are openings and closings), hoping,
that other participants would see the potential increase in buying for this
security, which in turn would lead them to actually jump on the train and move
prices of the underlying stock higher. This upwards move, would automatically
be reflected on the CFD price too (also, if this was a call option or some
certificate with 10x leverage even better). The trader with a levered position
in the derivative would just be waiting for this moment to close his levered
positions for better prices. After he is flat, he would ask his friends to
cancel their original large orders and would thank them.

In this case, we are dealing with a combination of pre-arranged
spoofing/layering amongst multiple parties during the closing period (thus,
potentially with a “marking the close” impact) involving multiple
correlated instruments and exchanges(Cross Product/Cross Market Manipulation). In
other words, this example is a combination of number of other market
manipulation scenarios. If you think about it for a moment, then you will be
soon realizing that there can be not only many different combinations of this
type but also many different combinations of combinations.

The reality of the trading surveillance world as of now is
that the surveillance programs available tackle each and every scenario
separately but not in a combined way, in other words, no surveillance system I
am aware of can nowadays link different scenarios to each other and analyze all
possible combinations of human behavior. Having said that, it seems to me that
even with such an increased regulatory scrutiny and surveillance programs,
white collar criminals unfortunately still can be optimistic about their

If you are interested to hear more about this, please, let us know. Via our trainings on Market Abuse you can get to know the methodology.

Kind Regards,

GK Consultancy