A market works because the orders you see on display are, at least in part, real: someone actually wants to buy or sell at that price. Spoofing exploits this trust with fake orders, placed to be cancelled before they are filled. A pump and dump exploits it with inflated news: you buy a thinly traded stock, push it with enthusiastic messages and sell it to whoever arrives later. Both practices are illegal in the United States and in the European Union, but the line with legitimate strategies is thin, and it almost always comes down to intent.

Spoofing and pump and dump in brief

Spoofing manipulates the order book: whoever does it enters large buy or sell orders they do not want filled, to make others believe there is a lot of demand or supply. When the price moves the desired way, they execute a real order on the other side and cancel the fake ones.

A pump and dump manipulates information: the organisers buy first, then spread exaggerated or false news to attract buyers, and sell once the price has risen. Whoever buys late is left with a stock that quickly falls back to its earlier value, or lower.

How spoofing works, and why cancelling is not enough

Cancelling orders is normal: most orders displayed on electronic markets are changed or withdrawn before they are filled, because prices move and market makers keep updating their quotes. This is legal.

It becomes illegal when the order is placed already intending to cancel it. In the United States the Dodd-Frank Act of 2010 explicitly banned bidding or offering with the intent to cancel before execution. In between lies the grey area: a large order withdrawn after a few moments can be a prudent choice or a feint, and what tells them apart is the overall pattern of trading, internal messages and repetition over time.

The 2010 flash crash and Navinder Sarao

On 6 May 2010 US markets lost roughly a trillion dollars in value within minutes, most of it recovered shortly afterwards. The joint report of the US authorities identified as the trigger a large automated sell programme for 75,000 S&P 500 futures contracts, worth about $4.1 billion.

Years later the name of Navinder Sarao also emerged, a British trader working from home on S&P 500 futures with large sell orders that he then cancelled. In 2016 he pleaded guilty in the United States to spoofing and wire fraud; according to prosecutors his fake orders had contributed to the conditions of the crash. In January 2020 a Chicago judge sentenced him to time already served in custody plus one year of home detention, citing his extensive cooperation with investigators.

In the courts: Coscia and JPMorgan

Michael Coscia was the first trader convicted under the new anti-spoofing provision. A Chicago jury found him guilty in November 2015 over an automated programme that entered large orders to be cancelled within moments, and on 13 July 2016 he was sentenced to three years in prison.

The biggest case involves a bank. On 29 September 2020 the CFTC, the US derivatives regulator, settled a case against JPMorgan for spoofing in precious metals and US Treasury futures between 2008 and 2016: $920.2 million in restitution, disgorgement and penalties, the largest amount the regulator had ever imposed. The bank admitted the facts, which is rare in these settlements.

Pump and dump, from phone calls to social media

The classic version was done over the phone. In the nineties the brokerage Stratton Oakmont pushed shares of small companies on its clients while its managers controlled part of those shares. The founder, Jordan Belfort, pleaded guilty in 1999 to securities fraud and money laundering, and the court ordered him to pay $110.4 million in restitution to the victims.

Today the channel is social media. In December 2022 the SEC and the Department of Justice charged eight influencers followed by more than 1.5 million people with buying stocks, recommending them to their followers and secretly selling them as the price rose, with profits estimated at no less than $114 million. The trial judge had dismissed the criminal charges; in October 2025 the Fifth Circuit Court of Appeals reinstated them. The allegations have not yet been proven.

What the research says

Andrei Kirilenko, then chief economist of the CFTC, with Albert Kyle (University of Maryland), Mehrdad Samadi and Tugkan Tuzun, in “The Flash Crash: High-Frequency Trading in an Electronic Market” (Journal of Finance, 2017), studied the S&P 500 futures of 6 May 2010 trade by trade: high-frequency traders did not trigger the crash, but their behaviour amplified its volatility. The lesson: in a very fast market, whoever removes or adds orders at a moment of stress can amplify a move already under way.

Thomas Renault (IÉSEG School of Management and Université Paris 1 Panthéon-Sorbonne) analysed millions of Twitter messages about small listed companies: an abnormal surge of messages coincides with a sharp rise on the same day, followed by a clear reversal over the following week, stronger when the messages come from stock promoters.

Tao Li and Baolian Wang (University of Florida) with Donghwa Shin, then a doctoral student at Princeton, hand-collected 500 organised pump and dumps in cryptocurrencies: in the first 70 seconds the price rises by 25% on average and volume by 148 times, then the reversal starts at once and within about an hour most of the effect is gone. Whoever comes in late almost always buys from the organisers.

The rules in the United States and in Europe

In the United States spoofing is explicitly banned by the Dodd-Frank Act of 2010, and pump and dumps fall under the general rules against securities fraud. In the European Union the Market Abuse Regulation, in force since 3 July 2016, bans any order that gives false or misleading signals about supply, demand or price, and the related directive requires member states to punish serious, intentional cases of manipulation with a maximum penalty of at least four years in prison.

What it means for the retail investor

Nobody can tell from outside whether an order in the book is real or fake, and nobody has to read the messages on social media. For investors this means three things:

• a small stock that suddenly rises amid lots of enthusiastic messages is a signal for caution, not an opportunity: research shows the price often falls back within days;
• market orders on thinly traded stocks are the most exposed: a limit order protects you from the worst price, even if it may not be filled;
• anyone recommending a stock should say whether they own it: if they don’t, or if they promise quick and certain gains, it is worth asking who is selling to whom.

How commission-free apps sell your orders to whoever executes them is covered in the article on paid orders; how a shareholder can vote without risking anything, in the one on empty voting. On InvestingBot prices are delayed by 15-30 minutes and thinly traded stocks stay out of the Screener: that is not enough to detect manipulation, but it avoids looking first at exactly the stocks where it is easiest.

In summary

• Spoofing uses fake orders placed to be cancelled; a pump and dump uses inflated news to sell to whoever arrives later.
• Cancelling orders is normal: it becomes illegal when the order is placed with the intention of not being filled.
• Coscia was sentenced to three years in 2016; JPMorgan paid $920.2 million in 2020 for spoofing between 2008 and 2016.
• In 2022 eight influencers were charged with making at least $114 million by recommending stocks they then sold.
• In the cryptocurrency pump and dumps studied, the price rises 25% in 70 seconds and the effect fades in about an hour.
• For investors, a small stock rising amid lots of noise on social media is a signal for caution.

What is spoofing?

It is entering buy or sell orders you do not want filled, to make others believe there is more demand or supply than there really is, and profiting from the price move that follows.

Is cancelling an order illegal?

No. Cancelling or changing orders is normal and happens all the time. It is illegal to place an order already intending to cancel it before execution, to deceive other traders.

What is a pump and dump?

It is a manipulation in which someone buys a thinly traded stock, pushes its price with exaggerated or false news and sells it as it rises. Whoever buys late is left with a stock that usually falls back quickly.

Did Navinder Sarao cause the 2010 flash crash?

According to prosecutors his fake orders contributed to the conditions of the crash, and in 2016 he pleaded guilty to spoofing. The US authorities’ report, however, points to a large automated sell programme as the trigger, and research shows high-frequency trading amplified the volatility.

How can I recognise a possible pump and dump?

The typical signs are a small, thinly traded stock, a sudden rise, lots of enthusiastic messages on social media and promises of quick gains. The more of them appear together, the more caution is warranted.

Is spoofing banned in Europe?

Yes. The EU Market Abuse Regulation, in force since 3 July 2016, bans orders that give false or misleading signals about price, and serious, intentional cases are crimes with maximum penalties of at least four years in prison.