Spoofing, Pulled Bids and Flashing Size: Reading Liquidity That Disappears on the NQ Heatmap

US law defines spoofing in one line: "bidding or offering with the intent to cancel the bid or offer before execution" (7 U.S.C. §6c(a)(5)(C)). The Dodd-Frank Act added it to the Commodity Exchange Act in July 2010, and since then it has been both a civil violation the CFTC pursues and a federal crime. The key word is intent. A 300-lot bid in E-mini Nasdaq-100 futures (NQ) that vanishes as price gets close looks the same on a heatmap whether its owner meant to trade and changed their mind or never meant to trade at all, and the law only cares about the second. Contract basics for NQ and MNQ are in the tick and point value guide; how heatmaps show resting orders is in Bookmap for NQ.

Cancelling is normal

Most orders on an electronic futures book never trade. A 2015 CFTC staff paper on automated trading noted that order-to-execution ratios are commonly as high as 10 to 1, even in liquid products. Market makers refresh quotes every time price ticks, algorithms rest orders at several levels to hold queue position and pull the ones that are no longer needed, and a manual trader who moves a limit order because the setup changed has cancelled one order and placed another. CME expects heavy messaging too: in its Q3 2026 benchmarks, the Messaging Efficiency Program ignored firms sending 50,000 or fewer messages a day in a product group, and in the NQ group it charged only above a weighted message-to-volume ratio of 180 to 1, tightening to 120 to 1 above 100,000 messages a day and 60 to 1 above 150,000.

So a bid that disappears is ordinary. A thick level that holds until price touches it and then evaporates, then reappears a few ticks lower, is also seen every day, and on its own it proves nothing.

What turns a cancel into spoofing

The CFTC's 2013 interpretive guidance says spoofing needs intent beyond recklessness, that a good-faith cancellation is legal (a partially filled order, a properly placed stop-loss), and that a partial fill doesn't excuse an order that was meant to be cancelled. A single instance can be a violation; there's no need for a pattern.

CME enforces the same idea through Rule 575, in force since September 15, 2014. In plain words it prohibits entering an order you intend, at the moment of entry, to cancel or modify so it won't execute; messages meant to mislead other participants; messages meant to overload or delay the exchange's or other participants' systems; messages sent intentionally or recklessly that could disrupt the exchange's systems; and messages that disrupt orderly trading, whether intended to or sent with reckless disregard. For the last two, recklessness is enough. CME's FAQ adds that there's no safe minimum time an order must rest, and that resting orders at several prices for queue position and cancelling them is fine without other signs of intent. The pattern regulators look for is the one in almost every case below: a genuine order on one side of the book and larger orders on the other side that are there to move other traders, cancelled once the genuine order fills.

Landmark cases, including four in Nasdaq-100 futures

Two details matter for anyone watching an NQ heatmap. According to the CFTC's 2018 complaint, Mohan's scheme used at least one iceberg order, showing only part of its size, on the side he wanted filled, while the spoof orders on the other side were fully displayed; iceberg orders on CME explains why the hidden part never shows on the book. And in the Sarao order book on May 6, 2010, according to the CFTC, his orders were modified more than 81,000 times that day while only 81 contracts traded. The visible size was enormous, and according to the CFTC, none of it was meant to fill.

What the heatmap can and can't tell you

A heatmap shows how much size rests at each price and how that changes over time. It doesn't show who placed it, why, or whether a block of 300 is one order or sixty. With market-by-order data some platforms show order counts and individual order sizes, which narrows the picture, but intent is invisible on any feed, and the regulators in the cases above needed account-level records to prove it.

What a trader can do is treat displayed size as information that holds only until price tests it. Size that travels with the market, staying the same distance ahead as price rises or falls, is leaning on price rather than offering a place to trade, and price often follows it when it steps back. Size that pulls every time price comes within a few ticks says the level won't stop price on its own. The size that counts is size that trades: a level where volume prints and the resting orders refill is being defended, which is what absorption looks like, and it's the opposite of a pulled bid.

None of this identifies spoofing, and it isn't meant to. It sorts liquidity into what's been tested and what hasn't, which is the useful part for a trade decision. A stop parked behind a wall that might not be there is the expensive version of the same mistake; liquidity sweeps and stop runs cover what happens around those levels.

The rule also applies the other way. Placing orders you don't intend to fill, to nudge price toward your real order, is the conduct in the table above, whatever the account size. Prop firms prohibit order-book manipulation in their own rules as well, on simulated accounts where it can't affect the market at all.

I watch NQ on Bookmap next to NinjaTrader, and the size I take seriously is size that has already been hit and stayed.