How Bans Work
Hardware Bans & Modern Anti-cheat Measures
Modern anti-cheat software vendors issue hardware bans, leaves trace files, and they track the PC in many other ways. These bans have multiple sophisticated techniques for tracking the user between bans. To fully bypass a ban, you must understand which techniques these anti-cheat vendors deploy to track the PC.
Common Anti-Cheat Software
Familiarize yourself with common anti-cheat software used by game developers to protect their games. This will help you better understand how to bypass bans and what precautions to take when using cheats.
Easy Anti-Cheat
Easy Anti-Cheat (EAC) is a kernel-level anti-cheat by Epic Games that detects and blocks cheats in real time. It tracks users through a combination of hardware ID (HWID) fingerprinting, system file analysis, and account identifiers. Bans can be permanent, issued without warning, and are often linked to both the game account and the hardware used at the time of detection.
BattlEye
BattlEye is a kernel-level anti-cheat system designed to proactively detect and block cheats before they can affect gameplay. It uses techniques like HWID tracking, memory scanning, and behavior analysis to identify violations. Bans are typically permanent, may be delayed for detection obfuscation, and are tied to both the game account and hardware used.
Anybrain
Anybrain is an AI-powered, behavioral anti-cheat system that uses machine learning to analyze player "biometrics" rather than just scanning system files. It builds a unique profile of how a user plays—tracking mouse movements, reaction times, and keypress patterns—to distinguish between human input and software assistance. It is often used as a "silent" layer alongside other anti-cheats to detect subtle aimbots or hardware cheats (like DMA) that mask their files but cannot mask their unnatural input perfection. Bans are often issued based on behavioral flags and can track a user across accounts based on their specific playstyle "fingerprint."
Riot Vanguard
Riot Vanguard is Riot Games’ custom kernel-level anti-cheat system used in titles like Valorant. It runs at system startup and continuously monitors for unauthorized software, using methods like hardware ID tracking, driver scanning, and behavior analysis. Vanguard bans are permanent, HWID-based, and often enforced silently with no warning or appeal.
FACEIT
FACEIT Anti-Cheat is a kernel-level system designed specifically for competitive Counter-Strike 2. It uses advanced detection methods including driver and memory scanning, HWID tracking, and behavioral analysis to catch both public and private cheats. Bans are typically permanent, linked to hardware and account, and enforced across the FACEIT platform with no tolerance for appeals.
Anti-Cheat Expert
Anti-Cheat Expert (ACE) is Tencent’s proprietary anti-cheat system used in games like PUBG Mobile and Arena Breakout. It operates at the kernel level, utilizing HWID tracking, file integrity checks, and real-time behavior monitoring to detect cheats. Bans can be immediate or delayed, are often permanent, and may affect both the device and account across multiple Tencent titles.
Ricochet Anti-Cheat
RICOCHET is Activision’s anti-cheat system, featuring both kernel-level and server-side components. It uses HWID tracking, memory and driver analysis, and in-game behavior monitoring to detect cheats. Bans may be instant or delayed, are usually permanent, and often affect all linked accounts and hardware across current and future Call of Duty titles.
Ban Enforcement Methods
Flagged Hardware
These bans are flags that automatically target the PC. They are stored on the anti-cheat vendor's servers on the internet in the cloud and cannot be removed.
Hardware, such as:
hard drive (HDD), solid state drive (SSD), flash storage (NVME)
network card (NIC)
processor (CPU)
graphics card (GPU), etc.
...all have MAC addresses. These addresses are hard-coded into the device and are not designed to be changed. Thus, this is a consistent and reliable way to track users and issue bans that stick and can be difficult to bypass. This is what is flagged.
These are known as hardware or hardware identifier (HWID) bans.
How can I remove hardware flags?
The quickest and easiest way (takes less than 5 minutes): use the spoof function of our Spoofer tool.
The cheap way? Research free spoofer tools on the internet.
Be advised: these spoofers are not updated by a dedicated, experienced reverse-engineering team who's entire job is solely keeping track of the latest flags issued by modern anti-cheat. You will run into cases where the free spoofer does not spoof some or all of the tracked components. Second, free spoofers can be deployed with malware and viruses. Keep in mind what a spoofer is doing - it is changing deep components of your PC. We highly recommend you do not use free spoofer tools.
Trace Files
Some anti-cheat vendors will also deploy trace (or tracking) files into your system. These files can be embedded deep within the PC's operating system (in the kernel). These files are often difficult to remove and require deep experience in reverse engineering to identify and successfully remove.
Additionally, these trace files are ever-changing between updates by the anti-cheat which in most cases are not published to the public.
How can I remove all trace files?
The quickest and easiest way (takes less than 5 minutes): use the clean function of our Spoofer tool. The cheap way? Do a Clean Windows Install.
IP address
While IP bans are unreliable (most internet service companies issue dynamic IPs), some anti-cheat vendors opt for this method. Your PC has an address, much like a house. When an anti-cheat vendor bans the IP address, the PC is flagged.
How can I bypass IP address bans?
Easy, use a VPN. Or, unplug your modem/router for 5 minutes.
Ban Enforcement Obfuscation
Anti-cheat vendors employ multiple methods to hide what is causing a ban. These include:
delayed bans (hours, days, or even weeks)
ban waves, thousands of users banned at once - often combining two or more cheat brands into one ban wave to further confuse cheat developers
What does a Hardware Spoofer do?
As the name suggests, a hardware spoofer tool randomizes PC identifiers like the MAC addresses of the PC's components, SMBIOS identifiers, and so on.
Some spoofers, such as ours, deploy other additional mechanisms to help mitigate bans.
Types of Spoofers
Spoofing software comes in two flavors: temporary and permanent.
Temporary Hardware Spoofers
Temporary hardware spoofers, work temporarily. Any changes made by the spoofer are reverted to normal when the PC is rebooted. Temporary spoofers are the least invasive and safest way to spoof. They will not affect the licensing of the software you use, Windows, or the hardware's functionality.
We always suggest using a temporary spoofer.
Permanent Spoofers
Permanent spoofers are typically a one-time use. These will permanently change the MAC addresses and other identifiers of the PC.
The downside of permanent spoofers is that they can cause permanent issues with your hardware. MAC addresses aren't designed to be permanently altered; by doing so, you introduce irreversible changes to your PC's hardware.
For this reason, we never recommend using a permanent spoofer.
Account Creation
Just make a new account and carry on, right? Not anymore. Anti-cheat tracks this as well. Through a combination of fingerprinting methods we discussed above in addition to: email addresses, passwords, usernames, and so on.
So what about buying accounts?
Good thought! This is the quickest and easiest way to removed potential fingerprinting vectors between accounts. However, some account sellers use mass account creation methods that essentially lump all of their batch-made accounts into a single pool which is then identified by the anti-cheat and a ban is issued.
So how do I safely bypass account creation flags?
There isn't a quick answer here. The only way to do this is by experience. Find a reputable seller you trust. The account selling market is fast-paced and ever-changing. Finding the right seller is the highest priority.
What are NFA vs. FA accounts?
In the account marketplace, there are two acronyms used to identify accounts:
Full Access (FA) account
you will receive full account credentials
the good news: these have a near-zero chance of account loss or seizure by another user, you own the account including recovery information
the bad news: FA accounts typically cost 20% to 40% more per account
Non-Full Access (NFA) account
you will receive (typically) only the username and password
the good news: the cheapest way to get an account
the bad news: little to no control of the account; usually the original owner will recover the account; most sellers will only warranty NFA accounts for 12 hours or not at all
Where can I buy accounts from trusted sellers?
There are a few account selling platforms we suggest:
Eldorado
G2G
Z2U
I will just make the account myself?
If you don't wish to buy accounts - that's cool. However, creating your own accounts requires a significant time investment to do this correctly. We won't outline the entire process here.
create a new account using random email addresses
an easy way to do this is to buy a domain and use a wildcard/catchall email address setup
verify the phone number using a service like TextVerified
use a VPN to keep your IP address masked
either clean trace files with our spoofer or do a Clean Windows Install
Is there an easier and safer way to cheat?
Yes. While it involves a higher up-front cost, DMA or Direct Memory Access cheats are the gold standard for cheating in modern titles utilizing quality anti-cheat softwares like those mentioned in this guide. Read more about DMA here: What is DMA?
Conclusion
Hey - that was a lot, right? Good on you for reading through this guide. This should provide more clarity to how bans work, how to bypass them, and how to keep your PC masked from anti-cheat software.
Last updated
Was this helpful?