In a 2018 survey by the security firm Irdeto, 77 per cent of online gamers said they would probably stop playing a multiplayer game if they believed other players were cheating. Six in ten said cheaters had already spoiled their experience, which explains why publishers now treat cheating as a threat to the whole business and not as a minor nuisance.
The obvious way to stop it would be to watch what each player sees, yet almost no anti-cheat system works like that. Instead it studies the computer, the game's memory and the numbers a player produces, and those turn out to be far more revealing than any picture of the screen.
Why Looking At The Screen Would Not Help
A cheat is not really something that appears on a monitor. It is a program that reads information the game is holding in memory, such as the positions of opponents behind walls, and then either draws it over the picture or quietly moves the crosshair on the player's behalf.
Some older tools did grab occasional screenshots, and a few services still can. Cheat makers answered by drawing their overlays in ways that screen capture does not pick up, or by removing the visuals entirely and letting the aim assistance work unseen. A clean screenshot therefore proves very little about what is running underneath.
There is also a matter of scale and privacy. Reviewing video from millions of computers would be enormously expensive, and it would expose private messages, browser tabs and anything else open at the time. Checking how the machine behaves is cheaper and, in one narrow sense, less intrusive than watching the display.
Why Fair Play Is Checked By Software Everywhere
Any online service where something of value depends on honest behaviour faces the same problem. The company cannot sit beside each user, so it has to judge trust from technical evidence collected at a distance.
The principle reaches well beyond shooters and battle arenas. At an online casino such as 7gear casino, the operator never sees a player's screen either, so fairness rests on results that are generated on the server, on account checks that spot bots and duplicate sign-ups, and on monitoring that flags unusual patterns of play before a payout is approved. What players value in that setting is the same thing gamers want from a ranked match, which is confidence that nobody at the table has a hidden advantage.
Games follow that model closely, although the stakes are usually rankings and tournament places. A modern anti-cheat combines a small program on the player's computer with heavy analysis on the publisher's servers, and neither half needs to see a single frame of video.
Five Signals That Give A Cheater Away
Anti-cheat systems such as Easy Anti-Cheat, BattlEye, Riot's Vanguard and Valve's VAC rarely depend on one method. They gather several independent kinds of evidence, some on the computer and some on the server, and they only act when the overall picture is convincing. Each signal covers a weakness in the others, which is why a cheat that beats one layer is often caught by the next. The five described below are the ones that do most of the work.
What Is Loaded In Memory
The most direct signal is the game's own memory. To show enemies through walls, a cheat has to read data that belongs to the game process, and to move the aim it usually has to inject its own code into that process.
The anti-cheat client looks for both. It compares running code against a database of known cheat signatures, much as antivirus software does, and it checks that the game's files and memory have not been altered since launch.
Signature matching only catches cheats that have been seen before, so the client also watches for suspicious behaviour, such as an unknown program opening the game process to read from it.
Which Drivers Started With The Computer
Sophisticated cheats hide below ordinary programs, inside the core of the operating system known as the kernel. From there they can feed false information to any scanner that runs at a higher level.
This is why several systems now install their own kernel driver, and why Vanguard loads at start-up, before a cheat has the chance to conceal itself. In 2025, Battlefield 6 and Call of Duty: Black Ops 7 went further by requiring Secure Boot and a TPM 2.0 chip, which help the anti-cheat confirm that the computer started in a trusted state.
Who Touches The Bait
Developers also set traps for software that should not be there. In February 2023, Valve added a small block of data to the Dota 2 client that normal play never reads, so any program that touched it revealed itself at once.
Around 40,000 accounts were permanently banned as a result. Valve said it was extremely confident in every case, because an honest copy of the game had no reason to look in that location. The trap worked because the cheat could not tell the bait apart from the real game data around it.
How The Crosshair Moves
The server holds a different kind of evidence, which is the full record of what every player did. Human aim is slightly messy, with overshoots, small corrections and reaction times that have a natural lower limit, whereas assisted aim tends to be too quick and too tidy.
Valve's VACnet, described by programmer John McDonald in 2018, examined changes in a player's view angle around roughly 140 shots taken across eight rounds. At the time it was reviewing about 600,000 matches a day on some 1,700 processors. Cases it flagged ended in a conviction 80 to 95 per cent of the time, compared with 15 to 30 per cent for reports filed by players.
The same approach extends beyond aiming. Servers can also refuse impossible actions outright, such as a player moving faster than the game allows or firing more often than a weapon permits.
Which Machine Keeps Coming Back
The last signal concerns identity. A banned cheater can open a new account in minutes, so anti-cheat systems record identifiers from components such as the motherboard, the storage drives and the network card.
When a fresh account appears on hardware that was banned last week, it can be blocked before a match begins. Bans are also often issued in delayed waves, which stops cheat developers from working out exactly which update or behaviour was detected.
Determined cheaters try to disguise these identifiers with spoofing tools, which in turn become one more thing for the client to detect.
What Anti-Cheat Still Cannot See
None of these signals is perfect, and cheat developers study them as closely as the defenders do. The current blind spots share one feature, which is that they move the cheating away from the monitored computer or keep it inside the range of normal play.
- Hardware readers — a special card passes the game's memory to a second computer, where the cheat runs out of the scanner's reach.
- Camera-based aim tools — software on another device watches the picture and steers a modified mouse or controller.
- Subtle settings — a cheat tuned to help only slightly can stay within the numbers of a very good human player.
- Account sharing — a stronger player logging in for someone else leaves no trace of forbidden software at all.
- Honest mistakes — unusual drivers or overlay tools occasionally trigger false alarms that need a manual review.
Closing these gaps has a cost of its own. A kernel driver can observe nearly everything on a computer, and a flaw in one could crash the system or hand an attacker deep access, which is why many players remain uneasy about installing them.
Developers argue that the access is narrow and carefully audited, while critics reply that ordinary users have little way to check what the driver actually does. Both points are fair, and the balance between a clean match and a private computer is still being negotiated game by game.
Watching The Machine, Not The Monitor
Anti-cheat software catches players without seeing their screen because the screen was never where the evidence lived. Memory contents, start-up drivers, planted bait, aiming statistics and hardware identifiers together describe what a computer and its owner are really doing.
The contest is not finished, since each new defence prompts a new workaround and raises fresh questions about privacy. What has changed is that a cheater now has to fool several unrelated systems at once, and doing that for long is much harder than hiding a box on a display.
FAQ
Can anti-cheat software see my screen?
Most systems do not watch your screen. A few can capture occasional screenshots, but detection relies mainly on scanning game memory, checking drivers and analysing gameplay data on the server.
What is kernel-level anti-cheat?
It is an anti-cheat that runs a driver inside the core of the operating system. That position lets it spot cheats hiding at the same deep level, though it also raises security and privacy concerns.
Why are cheaters banned days or weeks later?
Delayed ban waves hide which cheat or behaviour was detected. If bans arrived instantly, cheat developers could test changes quickly and learn exactly what the anti-cheat had noticed.
Can anti-cheat ban an innocent player?
False positives are rare but possible, usually caused by unusual drivers or overlay software. Most publishers offer an appeal process, and statistical flags are often reviewed before a permanent ban is confirmed.
