RICOCHET Says It Disrupted 375+ Reseller Operations. Why Sellers Return

On September 18, 2026, the RICOCHET Anti-Cheat team published a post on the official Call of Duty blog that describes cheating as a business with suppliers, resellers and customers. The team says it has disrupted more than 375 reseller operations, issued more than 80 cease-and-desist demands and helped shut down 31 primary cheat vendors, and it cites an outside estimate that puts the wider cheating economy at about $8.5 billion a year.

What the two market figures measure

The post leans on a February analysis by the threat intelligence platform Intorqa, which put cheat subscriptions across 15 games at roughly $3.5 billion a year. When account sales, boosting, spoofing and similar services are added, Intorqa forecasts the wider cheating economy at about $8.5 billion a year.

Both figures estimate revenue, not player numbers, and neither is a Call of Duty measurement. The post does not publish the method, sample or definitions behind them, so they are a third-party estimate that the publisher repeats.

The layers behind a single cheat

Cheat developers sit at the top. Some operate publicly, but many hide behind intermediaries, using resellers and support teams to keep their distance from customers, direct sales and distribution. Below them, primary vendors sell cheats to customers and supply the resellers who expand an operation's reach. Underneath that, layers of resellers push the same products through overlapping storefronts and communities. The team says it tracks hundreds of these vendors.

Enforcement rarely removes a product in one move. A developer can keep earning from a broad network while resellers handle the customer-facing work that creates exposure. The team says it pairs detection with legal action aimed at the revenue, payment channels and business relationships behind those operations. From a player's side that can look like a vendor going offline for no reason, or a cheater who cannot get back into a match.

Why the same cheat appears under several names

The post says the range of products for sale is narrower than it looks. Many developers sell the same cheats under different names, and the person selling a cheat did not always create it. Resellers buy, reuse, modify or steal source code and repackage it under a new brand. A detected product survives longer once the same code is already selling under other names, and the spread of brands makes the market look more varied than it is.

Vendors also disappear after collecting payments in what the post calls exit scams. Others go quiet during detection periods, attribute the silence to legal action and reopen under another name. The team says sellers also use social posts to explain months of downtime with unrelated excuses rather than admit that a product has been detected.

Cheats, accounts and evasion

The post splits the ecosystem into three markets that feed each other.

Cheats are the most visible. The list includes aimbots, wallhacks, rage cheats, unlock tools and DMA-based cheating hardware, plus external devices such as Cronus, XIM and Titan. Sellers package access as monthly subscriptions, weekly fees or premium tiers, and market them as private, custom or exclusive even when reseller chains distribute the same tool widely.

Accounts are the second market. Removing an account creates immediate demand for a replacement, which has produced a trade in stolen accounts, aged accounts, ranked-ready accounts and boosting. The post cites the Consumer Financial Protection Bureau, which it says referred to research covering 10,000 gamers globally, one in three of whom said their gaming account had been hacked within the previous two years.

Evasion is the third. Sellers offer spoofers and other tools so repeat offenders can return after enforcement, and the team answers with behavioral and technical detections, stricter security requirements and hardware bans.

What 70,000 hardware bans target

In the month before the post, the team says it issued more than 70,000 new hardware bans. Under Activision's security and enforcement policy, a hardware ban applies to the device, not the account, and a banned device cannot be used for online play while the ban is active. That makes a fresh account less useful on the same device; separate account penalties may also apply.

The official RICOCHET Anti-Cheat page describes server-side tools, a kernel-level driver on PC, and hardware-backed checks that include TPM 2.0 and Secure Boot. The September 18 team post also names Remote Attestation and Microsoft Azure Attestation among its security requirements. The RICOCHET page says its hardware-based protections are active in Black Ops 6 and Call of Duty: Warzone as well as Black Ops 7. It says console players benefit through cross-play protections and shared backend systems, and that the PC driver runs only while a protected Call of Duty title is open.

Account security is the other half. Two-factor authentication requirements reduce the supply of disposable accounts, and the post says stronger account security and device checks push cheaters toward more expensive services.

What a cheat costs and what buyers hand over

Subscription cheats cost around $40 per month on average and upwards of $100 at the higher end, according to the post. Spoofers add another recurring fee. The post's estimate is that one bad actor could spend more than $1,000 a year on cheats, evasion tools and replacement accounts before DMA-related hardware and services are counted.

Buyers give up more than money. Many cheat communities require users to verify accounts before they reach private forums or downloads, through schemes that can expose real IP addresses, linked Discord accounts, hardware information, email addresses and payment details. Some vendors ask for photo identification. The post also says cheat developers embed malware in their products.

What the post does not establish

The post gives no time period for its reseller-disruption, cease-and-desist and vendor-shutdown totals, so readers cannot tell how quickly they accumulated. There are no per-title ban numbers, no method for the market estimates and no data connecting vendor shutdowns to match quality. The account-theft figure comes from a regulator's reference to outside research rather than a Call of Duty study, and the post says nothing about the size of the console cheat market.

Hardware checks and account requirements are the parts players meet directly. Whether pressure on the sellers reduces the number of cheaters a player meets in a match is not something the post measures.