The DOM looks like a complete picture of supply and demand, but it is not — it shows only the orders that choose to be seen. Two very different practices exploit that gap: iceberg orders hide genuine size behind a tiny visible tip, and spoofing displays large size that was never meant to trade. One conceals real liquidity and the other fabricates fake liquidity, and both mean the ladder in front of you can be systematically misleading.
Why the DOM does not tell the whole truth
The DOM displays resting limit orders, but nothing forces a participant to display their full size, and sophisticated players routinely do not. What you see on the ladder is the visible book; behind it sits hidden and reserve size that never appears until it trades. This matters because most DOM-reading intuition assumes the displayed numbers are the real supply and demand, and they are not. A level can hold far more than it shows (concealed real orders) or far less (fake orders that will vanish), so the ladder is better understood as a partial, sometimes deliberately manipulated, view. Recognising that gap is the first step to not being fooled by it.
Iceberg orders explained
An iceberg, or reserve, order is a large order that displays only a small portion — the tip — while the bulk stays hidden, automatically replenishing the visible size each time the tip is filled. A trader wanting to buy 1,000 contracts without advertising it might show only 50 at a time; as each 50 is taken, another 50 appears, so the level seems to hold an ordinary size while quietly absorbing far more. Icebergs are a legitimate, exchange-supported tool — offered natively by venues such as the major futures and equity exchanges — designed to let large participants work size without signalling their full hand and moving the market against themselves. They conceal real liquidity, they do not fabricate it: every contract in an iceberg genuinely wants to trade.
How to spot an iceberg
You detect an iceberg not on the DOM but on the tape, by watching a level absorb far more volume than it ever displayed. If a price shows 50 offered yet the tape prints hundreds of contracts trading there while the displayed size keeps refilling to 50 and price refuses to move, a large hidden seller is almost certainly working an iceberg. The tell is the mismatch: displayed size stays small and constant, executed volume against it is large, and price stalls. Repeated refills at the same level after each hit are the signature. Recognising this early tells you a serious participant is defending a price, which is valuable information about where the real supply or demand lies.
Spoofing explained
Spoofing is the opposite deception: placing large orders with no intention of ever executing them, purely to create a false impression of supply or demand, then cancelling them before they can be hit. A spoofer might stack huge fake bids below the market to make buyers think support is building, luring others to buy so the spoofer can sell into that demand — then yank the fake bids. Where an iceberg hides real intent, a spoof manufactures fake intent. It preys directly on traders who read the DOM naively and trust that a big wall means real orders. The fake size flickers in to move the market psychologically and disappears before it ever becomes a real trade.
How to spot spoofing, and its legality
Spoofing has recognisable fingerprints: unusually large orders that appear and vanish repeatedly, size that materialises as price approaches and is pulled the instant it might actually trade, and walls that never leave a trace on the tape because they are always cancelled before execution. A wall that would be genuine support gets hit and holds; a spoof gets pulled the moment aggression reaches it. Critically, spoofing is illegal market manipulation — explicitly outlawed in the United States under the Dodd-Frank Act and prosecuted by the CFTC and the Department of Justice, with real fines and convictions against firms and individuals. Iceberg orders, by contrast, are entirely legitimate. The distinction is intent: an iceberg intends to trade and merely hides its size, while a spoof never intends to trade at all.
Trading around the DOM's blind spots
The defence against both is the same discipline: never trust displayed size on its own, and let executions arbitrate. Because the tape shows only real trades, it cuts through both deceptions — it reveals the hidden volume an iceberg is absorbing and it ignores the fake size a spoof only ever displays. Practically, that means watching whether a wall is actually being traded against (real, and possibly an iceberg) or merely posted and pulled (fake), and weighting absorption you can see on the tape over size you can only see on the ladder. Treat any single enormous order with suspicion rather than awe, and confirm intent with prints before acting. The DOM is a useful window, but it is a window others know you are watching, and some of them are performing for it.