A spoofing alert flashes on your chart: a large bid was pulled and scored as likely fake. What now? The alert is the start of a decision, not the end of one, and knowing what went into it makes that decision much easier.

What spoofing is, briefly

Spoofing means placing orders you intend to cancel before they execute, to give other traders a false picture of supply or demand. In US futures markets it has been explicitly prohibited since the Dodd-Frank Act amended the Commodity Exchange Act in 2010. Regulators prosecute it using order-level data that identifies traders. A retail alert has nothing like that, so it can only say a pull looked spoof-like, never that a specific trader was spoofing.

Anatomy of a BookScope alert

Vantedge BookScope, the Level 2 indicator in the BookPilot plan, builds each spoofing alert in stages:

  • A level grows to at least 2.2 times the average of the levels behind it and is tracked as a wall, shown as a box on the chart.
  • BookScope follows the wall: appeared, approached, pulled, filled or expired.
  • If at least 60% of its peak size disappears without trading, it is marked as pulled, with a pull mark on the box.
  • The pull gets a spoof probability from 0.0 to 1.0. At 0.6 or above, a signal marker and alert appear, and the on-chart DOM ladder flashes in the Pulled Wall colour.

The direction is a fade: a pulled bid wall is a short signal, and a pulled ask wall is a long signal.

Judging an alert in the moment

The score is built from four observable facts, so you can check them yourself:

  • Was the wall approached? Price within 2 ticks adds 0.20. A wall pulled while price was far away says less.
  • How long did it live? Under 5 seconds adds 0.15. Brief, large orders are more suspicious than ones that sat for half a minute.
  • Did its size keep changing? Frequent changes add 0.15.
  • Was there aggressive volume on the other side? That adds 0.15, and suggests someone was using the wall's cover.

An alert that scored 0.95 on all four counts is a different thing from one that scraped past 0.60.

Common false alarms

  • Routine quoting. Liquidity providers adjust size constantly. A partial reduction below the 60% pull fraction does not count, but large legitimate adjustments can.
  • News. Ahead of scheduled releases, many participants pull orders at once for honest reasons.
  • Thin books. Overnight, a modest order can look like a wall. BookPilot's default trading window of 08:30 to 15:00 exchange time avoids most of that.

Watching alerts vs automating them

By the time you have read an alert, judged it and clicked, the moment has often passed. Vantedge BookPilot trades the same Pulled Wall signal without that delay. It places a limit order 1 tick behind the touch, cancels it after 3 seconds or a 3-tick run-away, and applies a fixed bracket. Before that, it checks its Rules of Engagement and, with Forecast Confirm on, the micro-forecast.

That does not make manual trading of alerts pointless. Some traders use alerts as context for their own entries rather than as triggers, for example skipping a long when a large ask wall has just been flagged as pulled and faded the other way. Others keep a log of alerts and outcomes to learn how their market behaves.

Many traders do both: run BookPilot and keep BookScope on the chart, so they can see why each trade happened. The comparison page explains how an automated strategy differs from visual tools that only show you the book.

Fighting alert fatigue

If alerts fire so often that you stop looking, raise the thresholds rather than ignoring them. A higher Pulled Wall Ratio (3.0 in the guide's Conservative profile) tracks only bigger walls. A higher Fire Probability (0.70) keeps only the most spoof-like pulls. Fewer, clearer alerts beat a constant stream.

A spoofing alert is a statistical judgement and can be wrong in either direction, while futures losses are very real. Practise acting on alerts, by hand or through BookPilot, in Market Replay and SIM before any evaluation, funded or live account. See our risk disclaimer for more.