I Rebuilt a $1.1 Million Spoofing Scheme From Public Data

Every fake order and every real fill, timestamped, sitting where anyone could have looked.

On Monday, the SEC settled with Frank Cerisano Jr., a 58-year-old trading out of his house in Las Vegas, over a spoofing operation that ran from May 2021 to April 2025 and cleared about $1,115,672.

What got me to even care about this was the profit behind it.

In the case, there were at least 3,000 unique spoofing instances, which works out to about $372 per spoof. Call it six spoofs a day and it comes out to roughly $23,000 a month.

Nobody does 3,000 of anything by accident, so this was clearly a sophisticated operation which begs the question of how exactly did a guy in a bathrobe clock in and manipulate prices six times a day for four years?

If we can figure out how he did it, can we, just for fun, see if it’s still plausible to do right now?

Cerisano’s email to a broker: “I really Feel that My Account never should have been Closed, anyway the reason the Account was Closed was because of Layering, an easy way around this would be if the system only let Me put orders in on one side of the Market Meaning I Could only bid or offer but not both, this would take Care of the problem please advise thanks ..”

The trade, as a trade

We don’t want to make this post a sleepy academic explanation on microstructure, so to understand what happened and how spoofing works, let’s walk through one of the trades:

1. On Jan. 10, 2025 after the close, a mid-cap ETF had an bid/ask spread of 61.58x62.04.

2. The trader entered 9 sell orders from one account, at progressively lower prices. This brought down the ask to $61.65.

3. In a second account at a different broker, he was simulatenously buying, getting filled at an average price of $61.67.

4. In the original account, he then canceled the sell orders and the ask went back to the original $62.04.

5. He then ran the above steps in reverse:

   1. 10 buy orders pushing up the bid to $61.87

   2. Sold the shares in his second account at that price, collecting a $2.8k profit in 19 minutes.

So in sum, he sent fake orders to lower the price for his second account to buy in, then he made fake buy orders to raise the price for his second account to cash out.

It’s simple, definitely illegal, but that’s pretty much the end-game of spoofing.

Finding the ETF

The complaint anonymizes the ETF used, but it quotes exact prices at exact timestamps, which for anyone with a market data subscription is pretty easy to reverse-engineer:

• A mid-cap ETF trading between $61.58 and $62.04 on January 10, 2025

• I checked the daily bars for the obvious candidates and IJH, the iShares Core S&P Mid-Cap ETF, printed a low of 61.59 and a high of 62.20 that day.

  • Surprisingly, this is a $128 billion fund, one of the largest mid-cap vehicles in the world.

Next, I pulled the consolidated quote tape for IJH that evening, and the spoofing record is all there (chart below):

• At 6:25:46.107 p.m., a 300-share offer appears at $61.81 against the standing $62.04.

• The offer steps down through $61.78, $61.75, $61.71, $61.68, $61.65, exactly the ladder the SEC describes.

• At 6:31:31 it snaps back to $62.04 in a single update, which is what mass cancellation looks like.

• Then the bid walks up from $61.57 to $61.87, and starting at 6:37:19 you can watch him peel the buy ladder off tier by tier, about one cancel per second, until the final order dies at 6:44:05.336 p.m.

• Additionally, the complaint says “approximately 6:44:05 p.m.”, so there’s a good chance this was the actual trade.

The only thing that matters is the book

During regular trading hours (RTH) none of this works, and you can exactly why (chart below).

I pulled all 735,000 of that day’s IJH quote updates and computed the time-weighted spread by half hour: