Ban types explained: HWID, account, IP, shadowban and flags
What each kind of ban is tied to, where it is enforced, and which ones a spoofer touches at all. Much of this is community inference, not published fact.
Short answer
HWID bans are tied to hardware identifiers, account bans to the account record, IP bans to the connection, and shadowbans to matchmaking, not access. A spoofer only touches the hardware layer, and a machine can be flagged without being banned yet.
On this page9
- Why do people confuse ban types?
- What are the six ban mechanisms?
- How does a HWID ban work?
- How do account bans and shadowbans differ?
- How common are IP bans in games?
- What is the difference between a flag and a ban?
- How do family and library sharing bans work?
- What is documented and what is only inferred?
- Common questions about ban types
Why do people confuse ban types?
People use the word 'ban' for six different mechanisms, and then wonder why the advice they were given did not work. The mechanisms differ in what they are tied to and in where they are enforced. Those two properties decide whether a new account helps, whether a new machine helps, and whether anything local helps at all. Work out which one you have before you buy anything.
What are the six ban mechanisms?
Read the last column first, because it is the only one that tells you whether a spoofer is relevant to your situation.
| Type | What it keys on | Where it is enforced | Does a spoofer touch it |
|---|---|---|---|
| Account ban | The account record itself | Vendor servers, at sign-in or match join | No. Entirely server-side and tied to the account |
| HWID ban (hardware ban) | A set of hardware identifiers read from the machine | Vendor servers, using values the client reported from your PC | This is the only layer a spoofer addresses, and only the identifiers it actually covers |
| IP ban | The address or address range you connect from | Network edge or the game's own servers | No. An IP is a network property, not a hardware identifier |
| Shadowban | A reputation or trust score on the account | Matchmaking, not access — you still play, but the lobbies change | No. Nothing about hardware identity affects a trust score |
| Hardware flag | The same identifiers as a hardware ban, recorded but not yet acted on | Vendor-side records, applied later or at the vendor's discretion | Only in the sense that it affects which identifiers are reported from now on. It does not delete what was already recorded |
| Family or library share restriction | Account relationships between a lending and a borrowing account | Platform side, against both accounts | No. It is an account-relationship consequence, not a machine one |
A single incident can produce several of these at once, such as an account ban plus a hardware flag. That is why the symptom alone rarely identifies the mechanism.
How does a HWID ban work?
A hardware ban is enforced when the client reports your machine's identifiers and the server recognises one or more of them from a previous action. The important detail is that there is no single HWID, only a set of correlated values. The exact set differs between anti-cheats and changes over time. The practical test people use is simple: does a brand-new, never-used account behave normally on the same machine? If a fresh account is restricted immediately, something about the machine is being recognised.
How do account bans and shadowbans differ?
An account ban blocks access, and because it is attached to the account, it travels with that account to any machine. A shadowban does not block access at all: the account still plays, but matchmaking places it differently, commonly with other flagged accounts. Players notice this as an abrupt change in lobby quality. Both live in server-side records and both survive new hardware, so nothing installed locally can fix either one.
How common are IP bans in games?
IP bans against individual players are rare in games, because addresses are shared, reassigned and easy to change by accident. Where one does appear, it is usually short-lived or range-based and aimed at abuse rather than at cheating. It is worth knowing about mainly so you can tell it apart from the rest. If the same account works fine on a different network, the restriction is not on the hardware and not on the account.
Info
What is the difference between a flag and a ban?
A flag is a note, while a ban is an action. The distinction matters because a flag can sit unused for weeks and then be applied in a batch. That is what produces the familiar pattern of many accounts being penalised on the same day. It also means that the absence of a ban today is not evidence that nothing was recorded. That is why nobody can tell you a machine is clean: the only party who knows what was recorded is the vendor.
How do family and library sharing bans work?
Sharing bans follow from the relationship between accounts. On Steam, a VAC ban on an account means that account can no longer share VAC-protected games. A borrower who cheats in a shared library can also cost the lender the game and their sharing privileges. Nothing in that chain involves hardware: it is two accounts, their relationship and a platform rule. Neither a spoofer nor a new machine has any bearing on it.
Warning
What is documented and what is only inferred?
Anti-cheat vendors do not publish which identifiers they read, how they weight them or how long records are kept, and they change all of it without notice. Much of what circulates about ban types is community inference assembled from observed behaviour, and some of it is confidently wrong. Platform rules, such as Steam's own statements about VAC and sharing, are documented. Which identifiers a given anti-cheat reads, and how long a flag survives, is inference. Treat any source that presents that kind of inference as fact with suspicion, including ours.
Common questions about ban types
How do I tell a HWID ban from an account ban?
Try a fresh, never-used account on the same machine. If it is restricted immediately, the machine is being recognised, but if it behaves normally, the restriction was attached to the old account.
How do I know if I am shadowbanned?
You keep access, but matchmaking changes noticeably and consistently. Because a shadowban is inferred from lobby behaviour rather than announced, treat any confident claim about it as a hypothesis.
Can a ban arrive weeks later?
Yes. Flags can be recorded and acted on later in batches, which is why accounts are often banned in waves rather than immediately.
Does a hardware ban follow the disk or the motherboard?
Neither on its own, because it is a correlated set of identifiers and nobody publishes which ones carry weight. That is why a partial spoof is often no better than none.
If my ban is permanent, is a spoofer pointless?
If it is a permanent account ban and you want that account back, yes. A spoofer is only relevant when the machine itself is being recognised.
Sources
Anti-cheat makers do not publish how bans work. What is described here comes from the team's tickets and from watching bans land.
Read next
Still stuck? Open a ticket on Discord
All guides