HFT market makers are often responding to an IOI (Indication of Interest) which an exchange will broadcast when they have orders on the book. A responder that's

HFT market makers are often responding to an IOI (Indication of Interest) which an exchange will broadcast when they have orders on the book. A responder that's interested in the trade will typically respond with an IOC (Immediate or Cancel) order. The order book is handled on FIFO (First-in, First-out) fulfillment method. If the IOC order isn't filled/partially filled, it is immediately cancelled. This is standard practice and encouraged by exchanges of their market makers. Spoofing can be done many ways, but it's usually something like submitting a day order at an unreasonable price, then cancelling, say 10ms later. Of course, reality is a bit more nuanced than that. Source: I've worked in IT in Finance my entire career and have often dealt with SEC/FINRA/FBI requests for order history, and identifying which of our client(s) made the orders. Typically for specific tickers on specific dates, but sometimes for all tickers on specific dates, or for specific tickers for several years. Last I had to run these reports, it was for a small dark pool (like an exchange with unpublished prices). We typically had 10s of millions of orders a day. Quite a bit smaller than an HFT firm will be handling, but still quite a bit of data to work with and have to hand over on DVDs.