Large orders that vanish before they trade are part of everyday life in index futures. Spotting the suspicious ones by hand is possible, but only if you know what to look for and accept how much a person can track at once.

ES and NQ books look different

The two big index contracts have very different books. ES usually rests far more contracts at each price and moves through fewer ticks in a typical minute. NQ rests less per level and covers more ticks. A 300-lot is unremarkable in a busy ES book and conspicuous in NQ.

So the first rule is that "large" has to be relative. Compare a level with its neighbours, not with a number you remember from another day or another contract.

A seven-point checklist

Work through these on the SuperDOM when an outsized level appears:

  • Relative size. Is it at least twice the average of the levels behind it? Smaller bumps are normal variation.
  • Distance from price. Is it a few levels away rather than at the touch? Size at the best bid and ask changes constantly as it trades, so walls there are hard to judge.
  • Behaviour on approach. Does it stay as price comes within a couple of ticks, or start shrinking?
  • Removal without trading. Watch Time and Sales at that price. If most of the size goes and few contracts print there, it was cancelled, not filled.
  • Lifetime. Did it appear only seconds ago? Large orders that live briefly are more suspect than ones that sat for minutes.
  • Flicker. Does the size keep jumping up and down? Constant adjustment can be an attempt to stay visible without getting filled.
  • Opposite aggression. While the bid wall sits there, are sellers hitting the bid elsewhere? Someone may be selling under the cover of fake support.

The more boxes a pull ticks, the more likely it was placed to mislead. None of them proves it.

What a person cannot keep up with

Doing this by eye has limits. You can follow one or two levels at once. You cannot easily tell whether a 450-contract drop was 400 cancelled and 50 traded, or the reverse, while also watching price. And the whole event often takes a few seconds, which leaves little time to decide and act.

Automating the checklist

The Vantedge Level 2 engine, used by the BookScope indicator and the Vantedge BookPilot strategy, runs a version of the same checklist on every book update:

  • A level at least 2.2 times the baseline of deeper levels is tracked as a wall. By default it scans the 3rd and 4th levels.
  • Price within 2 ticks counts as approached.
  • At least 60% of the peak size removed without trading counts as a pull. Book and trade data are matched to tell cancels from fills.
  • Each pull is scored from 0.0 to 1.0: a 0.35 base, plus points for approach, a life under 5 seconds, frequent size changes and opposite aggressive volume.

In BookScope, tracked walls appear as boxes with pull marks. BookPilot can trade the fade when the score reaches 0.6. The BookPilot user guide lists every scanner setting.

Adjusting for ES vs NQ

Because the wall test is relative, the same ratio works as a starting point on both contracts. What changes is the bracket in ticks. BookPilot sizes its default bracket in dollars per contract: a $150 target and $100 stop are 12 and 8 ticks on ES, and 30 and 20 ticks on NQ.

On the micro contracts, MES and MNQ, each tick is worth a tenth as much, so the same dollar bracket is ten times further away. The guide suggests around $10 to $20 for the target on micros, or switching to tick-based brackets.

Keep perspective

A pulled order is a clue, not a confession. Plenty of legitimate traders cancel large orders, especially before news. A spoof probability describes how a pull looked, not what its owner intended. Terms such as touch, wall and market depth are defined in the glossary.

Spotting a likely spoof does not make the next move predictable, and index futures can turn fast. Rehearse with the checklist or with BookPilot in Market Replay and SIM before you trade an evaluation, funded or live account.