Technical detection is solved by external cheats. Behavioural detection — human reports and manual reviews — is what actually gets people banned. This guide is about the second part.
The Golden Rule: Look Like the 98th Percentile, Not the 100th
The top 2% of legitimate players have nearly perfect aim. You want to look like them — not like a robot. If you're hitting 97% of shots at all ranges, reviewers notice. If you're hitting 78% (exceptional but believable), you're invisible.
K/D Ratios by Game
Never exceed these in ranked without an established reputation:
- CS2 Premier: 1.8–2.2 K/D, 45% HS rate
- Valorant: 2.0–2.5 KDA, 25–30% HS
- Apex: 8:1 K/D per match maximum
- Warzone: 5–7 kills/match average, 25% HS rate
- Fortnite ranked: Top 10 finish rate under 80%
Pre-Aim Discipline
The most common demo review trigger: pre-aiming at someone through a wall before they could be heard or seen. Discipline yourself to aim at the wall, not the player behind it. Start tracking only when they're 2–3 seconds from appearing.
Miss Deliberately
5–10 deliberate misses per match. Don't spray and get 100% hit rate. On SMGs especially, natural spray has ~60–70% hit rate. Aimbot users who spam with 95% accuracy are immediately visible in demos.
Demo Awareness
Know when you're being spectated (most games have a spectator indicator in competitive). Drop your settings during spectation — lower FOV, higher smoothing. Some cheats have an auto-safe mode that activates when the spectator count goes above 0.
Rotate Accounts
One "sacrificial" account for high-intensity cheating. One main for normal-looking play. Never mix strategies on the same account across sessions.
Browse free game cheats: Cosmo Cheatz →
Trust Factor and VAC Net Impact
CS2's Overwatch replacement, VAC Live, reviews mid-match and can terminate a game while it is still in progress. The system reacts to statistical outliers flagged by VACnet, which scores player behaviour on a rolling basis rather than in isolation. A single mechanical-looking round is unlikely to trigger anything, but a cluster of suspicious rounds across several matches raises your trust factor and puts you in closer proximity to other flagged accounts. The practical effect is that a clean account paired with a flagged account in a lobby can drag the whole group into low-trust matchmaking, so the account rotation mentioned earlier needs to account for who you queue with, not just what you run. Trust factor is not displayed in CS2, but lobbies made up largely of new or low-hour accounts are a reliable sign you have been pooled downward. Checking the age and inventory of opponents is one way to infer where you sit.
Ricochet Detection on Console
Call of Duty's Ricochet system treats console and PC differently, and version matters. On consoles, Ricochet can require a kernel-level driver only if a PC is tethered for crossplay, and detection focuses on input telemetry like impossible flick accelerations rather than memory scanning. On current-generation hardware, the majority of bans stem from report clustering combined with shadowbans that route the flagged player into lobbies of similar accounts for a period before a permanent decision. A shadowban is visible: queue times lengthen noticeably, typically past the two-minute mark in Warzone, and match quality drops. Players often mistake this for server problems and keep playing, which produces more report data and more evidence. The verification step is to check the account's ban appeal status through the official support page rather than third-party ban checkers, which frequently report stale information.
Vanguard Boot Requirements and Misdirection
Valorant's Vanguard runs at boot and blocks a range of drivers and virtualisation features that other games permit. Running a cheat in Valorant is a different risk profile from running one in CS2 because Vanguard scans continuously and is known to interrupt live sessions rather than waiting for a ban wave. A common failure case is a player testing an undetected tool in a deathmatch, seeing no immediate consequence, then using it in ranked — Vanguard's review of the deathmatch telemetry can surface days later, and the ban arrives with the match history intact, so the delay gives a false sense of safety. Verifying whether a tool is actually undetected is not possible from the outside; the only observable signal is whether the account survives a fortnight of normal play. Anyone claiming a tool is undetected with certainty is overstating what can be known, since detection logic is not published and changes without notice.