Plenty of tools promise to expose spoofing. Few explain what they actually measure. Before you pick one, it helps to know what a spoof tracker has to do to be useful, what it can never do, and how to test it on your own market before trusting it.

What spoofing looks like in the data

Spoofing means placing orders you do not intend to fill, to make one side of the book look stronger than it is. In the data it usually shows up as a large resting order, a wall, sitting a few levels from price. As price approaches, the wall is cancelled before it trades. Traders who leaned on that wall are left exposed.

The difficulty is that honest traders cancel orders all the time. A good tool has to separate the suspicious pattern from normal order management, and it can only ever do that with a probability.

A checklist for any spoof-tracking tool

  • It needs Level 2 data. Spoofing happens in resting orders. A tool working only from trades and best bid and ask cannot see it.
  • It tracks walls over time. One snapshot cannot tell a pulled wall from a filled one. The tool has to follow each large order from when it appears to when it disappears.
  • It separates pulled from filled. A wall that shrinks because it traded is real liquidity. A wall that shrinks with no trades at that price was cancelled. That distinction is the core of spoof detection.
  • Its score is explainable. If the tool gives a number, you should be able to see what raised it.
  • Its thresholds are adjustable. What counts as a wall in a thin overnight book is not the same as in the busiest hour of the day.
  • You can test it on recorded data. If you cannot replay past sessions through it, you cannot check whether its alerts were useful.
  • It is honest about certainty. No software can prove intent. A score is a diagnostic, not a legal finding of manipulation.

Visual tool or automated strategy?

Most spoof-tracking software is visual: it draws the book and highlights suspicious walls, and you decide what to do. That suits traders who want to read the tape themselves. The alternative is a strategy that acts on the signal with fixed rules, so the decision is made the same way every time. The comparison page discusses how an automated strategy differs from visual order-flow tools.

How Vantedge tracks pulled walls

Spoof tracking is part of Vantedge BookPilot, which includes the Vantedge BookScope indicator. Both run the same Pulled Wall scanner, so here is how it maps to the checklist.

Finding walls

A level counts as a wall when its size is at least Pulled Wall Ratio times the average of the levels behind it (2.2 by default). By default the scan covers the 3rd and 4th levels from the inside, where size is less jumpy than at the touch.

Following them

BookScope draws tracked walls as boxes on the chart and marks where they were pulled. A wall tracked longer than Max Wall Age (30 seconds by default) is dropped.

Scoring the pull

If a share of the wall's peak size disappears without trading (Pull Fraction, 0.6 by default), it gets a spoof probability between 0.0 and 1.0. The score is built from visible parts:

  • 0.35 base for a pull.
  • +0.20 if price was within Approach ticks of the wall.
  • +0.15 if the wall lived under 5 seconds.
  • +0.15 for frequent size changes.
  • +0.15 for opposite aggressive volume.

Acting on it

Above Fire Probability (0.6 by default) BookPilot trades against the wall: a pulled bid wall is a sell, a pulled ask wall a buy. Rules of Engagement, the forecast filter and the daily limits still have to agree before an order goes out.

Because BookPilot needs order book history, it cannot be tested in the Strategy Analyzer. You test it in Market Replay with downloaded Level 2 data, as the BookPilot guide explains.

Questions to ask before you buy anything

  • Which data feed does it need, and does yours provide market depth for your instrument?
  • Can you see why each alert fired?
  • Can you replay a session and get the same result?
  • Does it act for you, or only show you?

Spoof detection is probabilistic and futures trading can produce heavy losses. Validate any spoof-based signal in SIM and Market Replay before an evaluation, funded or live account depends on it.