Iceberg Order Detection: Methods and False Positive Filtering

An iceberg hides a large order behind small visible quantity. Detecting one means comparing what the book shows against what the tape prints. The mismatch is the signal; filtering false positives is the skill.

The detection method

At each price, track two numbers:

• Displayed size: the resting quantity shown on the DOM at that price.
• Cumulative executed volume: total volume that actually traded at that price over the session.

An iceberg is flagged when:

Cumulative executed >= 5 x peak displayed size

If 8,000 contracts traded at a price whose DOM never showed more than 200, the ratio is 40:1 — almost certainly an iceberg. A ratio under 3:1 is normal turnover.

Platform algorithms

• Sierra Chart: tracks bid/ask trade size vs market depth — flags prices where executed volume persistently exceeds displayed depth. Configurable threshold; default flags at 5×.
• Jigsaw Daytradr: "Pulling and Stacking" indicator plus iceberg detection — highlights refreshing orders that refill after fills.
• Quantower: "Iceberg" indicator overlays detected icebergs directly on the DOM and footprint.
• Bookmap: heatmaps reveal icebergs as bright persistent lines that survive fills — the order never visually disappears even as trades print through it.

Set the threshold to 5× for clean signals; lower to 3× only on highly liquid instruments where noise is minimal.

Filtering false positives

Most detected "icebergs" are not institutional — they are market-maker refresh or coincidence. Apply these filters:

1. Minimum executed volume: ignore icebergs with under 500 contracts (futures) or 10,000 shares (stocks). Small icebergs are noise.
2. Persistence filter: require the order to refresh at least 5 times. One or two refills is market-making; five-plus is intent.
3. Price context: only flag icebergs at round numbers, prior HVNs, or session extremes. Mid-range refresh is usually a market maker.
4. Survival test: a real iceberg survives multiple tests of its price. If the order vanishes on the second test, it was a spoof or a cancelled maker — discard.

Distinguishing iceberg from spoof

• Iceberg: small visible size, large executed volume, order persists through fills.
• Spoof: large visible size, near-zero executed volume, order vanishes before fills.

The discriminator is executed volume. If nothing trades against the big visible order, it is a spoof. If heavy volume trades against a tiny visible order, it is an iceberg. Always check the tape — the DOM alone cannot tell you which.

Detect with the 5× ratio, filter with persistence and context, then confirm with the survival test. Only then does a detected iceberg become an actionable institutional level.