RICOCHET Anti-Cheat

The description below is taken only from Activision's own published statements.

The Call of Duty Security and Enforcement Policy states that "RICOCHET Anti-Cheat™ looks for indications of cheating in multiple ways. This includes client- and server-side detection systems, monitoring applications running on a machine during gameplay, detecting anomalies in gameplay using behavioral models, validating that hardware has not been tampered with, and more." The same page summarises the target behaviour as "attempts to manipulate the game, to reveal information that should not be known, or to take automated actions with superhuman speed or accuracy," and adds that "Reports by other players may also support enforcement."

Kernel-level driver. Activision says "The PC kernel-level driver monitors and reports applications that attempt to interact with protected Call of Duty titles, allowing the RICOCHET Anti-Cheat team to determine if a machine is utilizing unauthorized processes to manipulate the game." On data, it says the driver "monitors the machine and processes interacting with a game using RICOCHET Anti-Cheat to determine if they are manipulating the game." The driver runs only while a protected title is running.

Machine learning. Activision states that "ML algorithms examine gameplay data from the server, helping to identify suspicious behavior trends."

Hardware integrity. From Black Ops 7, TPM 2.0 and Secure Boot are required on PC, validated by a remote attestation system that checks those settings "with Microsoft Azure servers in the cloud."

In-game mitigations. Alongside detection, Activision lists mitigations named Damage Shield, Cloaking, Disarm, Hallucinations and Splat.

Account-level, applied across all devices linked to the Activision account and able to apply across past, present and future Call of Duty titles. Activision also issues separate hardware bans that apply to the device rather than the account.

Activision states that "Active enforcements are tied to Activision accounts and are implemented across all devices linked to the account," and that "Permanent bans are lasting and final, and can apply across titles, including past, present, or future titles in the Call of Duty franchise." Temporary bans "can vary in length depending on the severity of the infraction." Other outcomes include limited matchmaking and Ranked Play restrictions.

Hardware bans are handled separately. Activision says "Hardware bans apply to the device and not the account," and that affected devices "cannot be used for online gameplay."

Appeals. Activision's policy states "Only permanent bans may be appealed," through its ban appeal page. The appeal page adds that "Permanent bans will only be overturned if we determine the infraction was due to your Activision account being hacked," that "Temporary bans and accounts in a limited matchmaking state are not eligible for appeal," that hardware bans are not eligible for appeal, and that "Decisions made as part of the appeals process are considered final."