How to Spot Cheaters, Secure Your Account, and Report Effectively

Team RICOCHET issued more than 800,000 permanent bans across Call of Duty: Black Ops 7, Black Ops 6, and Warzone in 2025 alone, according to Activision's year-end anti-cheat recap. That number is remarkable, but here's the part that stings: the gaming industry absorbs nearly 9,000 account takeover attacks every single day, according to Imperva's security research, and a significant portion of those compromised accounts are packaged and resold on black markets before the original owner even notices something is wrong. That's the uncomfortable reality sitting underneath every suspicious lobby you've ever played. The cheating problem and the account security problem are the same problem, and fixing one without addressing the other leaves you half-protected.

Lock Down Your Account Before You Queue

The highest-leverage action any player can take costs nothing and takes under ten minutes: enable two-factor authentication (2FA) on your Activision account. Go to your Activision account settings, navigate to security options, and activate 2FA via your preferred method, whether that's an authenticator app or SMS. The same step applies at the platform level: Xbox, PlayStation, Steam, and Epic all support 2FA independently, and each layer you add makes credential stuffing attacks significantly harder to execute.

Beyond 2FA, the checklist looks like this:

• Use a unique, strong password for your Activision account. A password manager generates and stores these automatically, eliminating password reuse across platforms.
• Set a recovery email that is itself secured with 2FA, and make sure your account recovery questions or backup codes are stored somewhere offline.
• Save your platform purchase receipts. If an account dispute ever reaches the appeals stage, Activision support will ask for proof of ownership, and receipts are the cleanest form of evidence.
• Keep your game client, operating system, and GPU drivers current. Outdated drivers or third-party software that hooks into system processes can interact poorly with Ricochet's kernel-level driver, occasionally generating false positive detections that are painful to appeal.

The resale economy for stolen accounts is fast-moving. Once credentials are harvested, they are verified, sorted by cosmetic inventory value, and listed for sale, sometimes within the same day. An account with rare operator skins, high-tier weapon blueprints, and an established rank is worth more to a black-market buyer than a fresh account, which means the players with the most to lose are also the most targeted.

What Cheating Actually Looks Like In-Match

Not every strong player is cheating, and bad reports waste developer triage time. Knowing what genuinely suspicious behavior looks like matters.

Aimbot signatures tend to cluster around a specific pattern: instant, pixel-perfect headshots from distances where normal aim assist would provide zero magnetism, combined with snap tracking that locks the moment a target appears from cover. The key tell is consistency across an entire match, not a single lucky kill.

Wallhack behavior is subtler but identifiable over time. A player who consistently pre-aims doorways from angles that provide no audio or visual cue, who rotates to your position before you've fired a shot, or who tracks teammates through solid geometry without any information to justify it is exhibiting behavior that Ricochet's telemetry systems are specifically tuned to detect. Movement anomalies like teleportation or physics-defying rotations are a different category entirely and usually indicate network manipulation or a speed-based exploit.

What you should not do: type anything in chat, call out the suspected cheater in the match, or post their name in public threads without verified clip evidence. None of that helps Ricochet. All of it creates noise.

Capture Evidence That Actually Gets Reviewed

The difference between a report that informs a developer's cheat signature and one that disappears into a queue is evidence quality. Thirty to ninety seconds of continuous, unedited gameplay footage showing the suspicious behavior is the target. Shorter clips risk cutting off the contextual pattern; longer clips are harder to triage.

When you capture, include:

• The map name and game mode in your clip notes or filename.
• The approximate match time (e.g., "12:40 remaining in the second half") where the incident occurs.
• A scoreboard screenshot showing the player's K/D or other anomalous statistics, saved alongside the clip with the match date and time in the filename.

Console players can use the built-in share functions on PlayStation and Xbox to capture and store clips with automatic timestamps. PC players running the native Call of Duty client can use the built-in capture tool, or third-party recording software that logs timestamps. Whatever method you use, organize clips in a dedicated folder by date. If you're reporting multiple matches, the folder structure becomes important when attaching evidence to a support ticket.

How to File a Report That Ricochet Can Use

There are two reporting channels, and they serve different purposes. In-game reports, submitted through the post-match scoreboard or the player profile menu, automatically attach match metadata including server-side logs and player telemetry. These are the fastest and most direct path for Ricochet's automated systems to correlate your observation with what the kernel-level driver saw.

Support tickets submitted through Activision's official support site are for cases where you have clip evidence to attach and need more than the in-game report's character limits allow. A strong ticket includes:

Developer anti-cheat teams triage by evidence weight, not by how urgently or angrily a report is worded. A calm, specific, well-documented report moves faster through review than an emotional one with no attachments. Avoid submitting the same incident through multiple channels simultaneously; duplicate reports create noise rather than priority.

If You Get Banned: Appeals and False Positives

Machine learning-based anti-cheat systems, including Ricochet's kernel-level detection layer, operate with high confidence thresholds, but they are not infallible. False positives do occur, particularly when third-party software (capture tools, RGB lighting controllers, performance overlays) interacts with Ricochet's driver in unexpected ways.

If you receive a ban you believe is incorrect, do not create a secondary account to continue playing. This is the single most common mistake players make, and it significantly complicates the appeals process by creating additional flags on the account cluster associated with your hardware. Instead, go directly to the official Activision support portal and locate the appeals option for your specific ban type. Come prepared with account ownership documentation: the email address on file, platform gamertag, and any purchase receipts from the Activision store or platform storefronts. Be realistic about timelines; bans grounded in kernel-level detection data can have limited reversal paths, and the appeals team will communicate what evidence they can or cannot share about the decision.

The Collective Side of Anti-Cheat

Ricochet does not operate in a vacuum. The 800,000-plus bans issued in 2025 were informed in part by aggregated player reports that helped the team identify cheat signatures and prioritize manual review queues. Reporting is a numbers game: consistent, high-quality reports from multiple players observing the same account accelerate the signal that pushes a case to the front of the queue.

The complementary habit is using private lobbies for practice sessions where possible, removing the variable of public matchmaking when you're working on mechanics. For competitive players in Ranked Play, reporting suspicious opponents immediately after a match, while the metadata is fresh, gives Ricochet the cleanest possible data window to work with.

For confirmed developer updates on Ricochet's detection cadence and ban wave timing, the official Activision blog and the Call of Duty community channels on Discord, Reddit, and X are the authoritative sources. Third-party clip-sharing threads that name individual players without evidence create harassment risks and do nothing to accelerate bans. The official channel is the only channel that matters.

The math on account security and clean reporting is straightforward: the time investment is under fifteen minutes total, the cost is zero, and the impact scales across every match you and your teammates play. Ricochet's systems get sharper with better data. Your account stays yours with better hygiene. Both habits compound over time.