Fraud Risk Scheme:
A market participant places visible orders at multiple price levels (“layers”) without the intention of execution to create a false market depth and influence perceived supply/demand. While the order book is manipulated, the actor executes real orders on other accounts or instruments and then cancels the “dummy” orders to capture the profit.
Detection:
Series of orders placed at multiple price levels and rapidly canceled (multi-level cancel pattern).
Strong asymmetry in order book depth on one side, followed by price movement predicted by these orders.
High cancel-to-trade ratio for certain accounts.
Orders placed near best bid/ask but then massively canceled when a profitable price movement occurs.
Coordinated activity across multiple linked accounts (same IPs, devices, KYC information).
Temporal correlation between cancellations and actual positions taken on other accounts.
Repetition of the pattern during specific time windows or for specific instruments.
Prevention:
Real-time monitoring of cancel-to-trade ratios with automatic alerts.
Minimum order latency rules (orders must remain active for a minimum time) or fees/penalties for excessive cancellations.
Limits on size/frequency of new orders for suspicious accounts.
Correlation of KYC, IP, and device information to detect linked accounts and block duplicate accounts.
Order-book imbalance detection and triggering investigations when price movements immediately follow massive cancellations.
Information sharing between brokers/exchanges and reporting to market authorities.
Retroactive testing (backtesting) of rules and simulations to refine alert thresholds.
Share your feedback:
What tools, techniques, and processes are used in your organization to detect and prevent such fraud schemes?
