RICOCHET Anti-Cheat: what it is and what it means for your account

RICOCHET Anti-Cheat is the system Activision uses to find and act on cheating in Call of Duty. Any third-party software in Warzone, Black Ops 7 or Modern Warfare 4 runs into it. This guide sets out what Activision has said about how it works, and what that means for an account.

We sell cheat software, so we have a stake in this subject. Everything below comes from what Activision has published, listed under the guide. None of it is a claim that any build, ours included, goes unnoticed.

What RICOCHET is

Activision announced RICOCHET in October 2021 as a set of measures rather than a single program:

• server-side tools that look at match data for signs of cheating;
• investigation by a dedicated team, fed by those tools and by player reports;
• account security updates;
• on PC, a kernel-level driver.

The PC driver

The driver first shipped with Warzone’s Pacific update at the end of 2021 and came to later titles after it. Kernel-level means it runs with the same depth of access to Windows as a graphics driver, so it can see software that tries to interact with or change the game.

Activision says the driver installs automatically with the game, starts when the game starts and shuts down when you close it.

Checks that do not run on your PC

Not every check happens on your machine. RICOCHET’s server-side tools look at what happens in matches, and reports from other players start investigations of their own. A cheat can be noticed by what it does to a player’s games, not only by what is found on their PC.

What happens before a ban

Activision has also described measures it applies inside a match to players it has flagged, alongside bans:

• Damage Shield: the flagged player’s shots do almost no damage.
• Disarm: their weapons are taken away.
• Cloaking: other players become invisible to them.
• Hallucinations: decoy players that only a flagged player can detect, aimed at cheats that read where other players are.

So a ban is not the only outcome, and it is not always the first one.

Limited Matchmaking

An account that raises an alarm is not always banned straight away. Activision can move it into Limited Matchmaking while it reviews the account: it keeps playing online, but only against other accounts in the same state. Players call it a shadowban. Call of Duty shadowbans covers how it works, how it affects a party and how it ends.

TPM 2.0 and Secure Boot

On PC, RICOCHET now checks that a computer starts in a trusted state. Activision made TPM 2.0 and Secure Boot a requirement for Black Ops 7 from its beta in October 2025, extended it to Warzone in December 2025, and lists both as required for Modern Warfare 4. Since June 2026, a Black Ops 7 or Warzone PC that fails the check is moved to a separate matchmaking pool with a few playlists.

This is a requirement of the games, separate from anything we sell: if you already play them on PC, both are probably on. TPM 2.0 and Secure Boot for Call of Duty shows how to check and turn them on, and check your PC before you buy covers the rest of what a build needs.

What it means for your account

• Any account that runs third-party software can be banned. Detection changes without notice. A build that works today says nothing about whether it is detected tomorrow.
• “Undetected”, “Ricochet-proof” and “ban-proof” are claims no seller can stand behind. We do not make them. Our build statuses say whether a build works with the current version of the game; they are not a statement about detection.
• Use only an account you are prepared to lose. That is the honest summary of the risk, and the FAQ says the same.

If you are comparing sellers, how to check a Call of Duty cheat seller before you pay treats a detection promise as the first warning sign.