Call of Duty Reveals the $8.5 Billion Business Behind Cheating

Call of Duty Says Cheating Is an $8.5 Billion Economy — And the Cheat Is Only the Beginning

A cheater appearing in a Call of Duty lobby may look like a fairly simple problem: someone buys an aimbot, wallhack or controller manipulation tool, loads into a match and makes everyone else's evening considerably less enjoyable.

According to Activision's RICOCHET Anti-Cheat team, however, that player sits at the end of a much larger commercial machine — one involving cheat developers, layers of resellers, stolen or prepared accounts, spoofing services, hardware-based tools and customers who may be handing illicit operators far more personal information than they realise.

The scale claimed for that wider market is striking. A February analysis by threat intelligence platform Intorqa estimated that cheat subscriptions across 15 games generate roughly $3.5 billion annually. Once account sales, boosting, spoofing and related services are included, Intorqa forecast the broader cheating economy at around $8.5 billion per year.

That helps explain why RICOCHET says it is no longer treating cheating simply as a succession of individual accounts to ban. Its strategy increasingly resembles an attempt to disrupt an illicit supply chain.

Cheat developers are only the top of the pyramid

RICOCHET describes cheat developers as sitting at the top of a layered marketplace.

Some operate publicly, while others allegedly distance themselves from customers by relying on intermediaries, support teams and vendors. Primary sellers distribute the software directly and supply resellers, which in turn push products through different storefronts and online communities.

RICOCHET says it tracks hundreds of these vendors.

The structure gives developers an obvious advantage: they can reach a large customer base without necessarily handling every transaction, support request or public-facing storefront themselves.

It can also make the market appear much more diverse than it really is.

According to RICOCHET, apparently competing cheat brands are sometimes selling effectively the same underlying product with a different logo, name or storefront. Resellers may buy, modify, reuse or steal source code before packaging it under another identity.

That fragmentation has another useful effect for sellers: when one product is detected or associated with bans, the same technology can potentially survive under different branding while discussion among customers is split across multiple communities.

In other words, the cheat marketplace may offer considerably more logos than actual innovation.

RICOCHET is targeting the businesses behind the cheats

Activision says its response combines technical detection with account protections, hardware security requirements, investigations and legal pressure.

The company says its efforts have disrupted more than 375 reseller operations, resulted in more than 80 cease-and-desist demands, and helped shut down 31 primary cheat vendors.

The objective is not merely to remove the person currently cheating in a match, but to attack the infrastructure that allows another account — and another customer — to replace them.

RICOCHET says legal action can disrupt revenue streams, payment systems and commercial relationships. From a player's perspective, the result may simply look like a cheat provider suddenly disappearing or a reseller becoming unavailable. Behind the scenes, Activision argues, those outages can reflect pressure elsewhere in the distribution network.

Cheat sellers do not necessarily advertise that interpretation.

RICOCHET says it has seen developers explain extended periods of downtime on social media by citing illnesses, surgery or even car accidents rather than acknowledging that their software had been detected or had become unreliable. The anti-cheat team characterises such explanations as part of an effort to reassure paying customers while disruption continues.

Whatever the explanation in any individual case, confidence matters in a subscription business. Customers are less likely to keep paying for a supposedly undetectable product if they believe using it could rapidly cost them their account.

Cheats, accounts and evasion keep the market running

RICOCHET divides the ecosystem into three connected pillars: cheats, accounts and evasion.

The first is the most familiar. The category includes aimbots, wallhacks, rage cheats, unlock tools, DMA-based hardware and external devices intended to manipulate gameplay, including Cronus, XIM and Titan products. Sellers can offer access through weekly or monthly subscriptions or more expensive packages marketed as private, custom or exclusive.

RICOCHET says it counters these tools with both technical detections, designed to identify unauthorised software interacting with the game, and behavioural systems that examine gameplay patterns associated with automated assistance.

But detecting the cheat does not completely solve the problem if the person behind it can immediately return.

That is where the second pillar — accounts — becomes important.

RICOCHET says demand from banned players supports a secondary economy involving stolen accounts, aged accounts, Ranked Play-ready profiles and boosting services. The problem exists alongside ordinary account theft: the Consumer Financial Protection Bureau cited research involving 10,000 gamers globally in which one in three respondents said their gaming account had been hacked during the previous two years.

Activision says two-factor authentication helps both legitimate users and its anti-cheat operation by protecting accounts while reducing the availability of compromised profiles that can be used after enforcement.

Hardware-backed protections create another barrier. RICOCHET points to TPM 2.0, Secure Boot and Remote Attestation as mechanisms for establishing greater trust in a PC before a match begins.

The third pillar is evasion.

Spoofers and related services are designed to help repeat offenders bypass hardware-based enforcement and return after being banned. RICOCHET says it combines technical and behavioural detection with security measures including Microsoft Azure Attestation to make that process more difficult.

The team says it issued more than 70,000 new hardware bans last month as part of those efforts.

The significance of the three-pillar model is that none of these markets operates entirely on its own. A cheat customer may need the software itself, another account after enforcement and an evasion service to get around device restrictions. Increasing the difficulty or price of one component therefore puts pressure on the others.

Cheat customers may be buying more risk than they realise

Perhaps the more uncomfortable part of RICOCHET's account concerns what customers give cheat providers in return.

The team says some cheat communities require users to pass verification systems before receiving access to private forums or downloads. According to RICOCHET, those processes can expose information including real IP addresses, Discord accounts, hardware information, email addresses and payment details. Some vendors allegedly go further and request photo identification.

RICOCHET also warns that cheat developers can embed malware in their products.

That creates an unusual trust arrangement. Someone purchasing software specifically designed to circumvent a game's security systems may simultaneously be asked to weaken protections on their own computer and trust an illicit vendor with identifying information.

From the seller's perspective, that customer is not necessarily dealing with a conventional software company. The wider ecosystem described by RICOCHET includes vendors that disappear after taking payments in so-called "exit scams", sellers that rebrand after detection periods and distributors dealing in recycled or stolen code.

The risk, then, extends beyond losing a Call of Duty account.

The real strategy is making cheating increasingly expensive

There is also a straightforward economic calculation behind RICOCHET's approach.

According to the anti-cheat team, subscription cheats can cost around $40 per month on average, with higher-end products exceeding $100. Spoofing services can add another recurring charge, while DMA-related hardware and replacement accounts push the cost higher still.

RICOCHET estimates that an individual could spend more than $1,000 per year maintaining access to cheats and associated services. Some users, it says, can spend hundreds or thousands of dollars over a year across software, evasion tools and accounts.

That makes the anti-cheat strategy partly an exercise in economics. Every account ban, hardware restriction, compromised reseller or unavailable cheat potentially raises the cost of remaining inside the system.

In my view, that is the most revealing part of RICOCHET's account of the problem. Detecting an aimbot matters, but treating cheating purely as a technical contest between anti-cheat engineers and cheat developers misses the commercial infrastructure that keeps replacing whatever gets removed. If Activision's description of this interconnected market is accurate, disrupting its economics may ultimately be as important as detecting its code.

There is an important qualification: much of the operational picture presented here comes from RICOCHET itself, which is describing both the threat and the effectiveness of its own response. Its disruption figures and descriptions of vendor behaviour should therefore be understood as claims from the company fighting those operators, rather than an independent audit of the entire cheat industry.

Still, the broader picture explains why banning one obvious cheater was never likely to be enough.

Behind that account can sit a subscription, a reseller, a replacement account, a spoofing service and potentially several layers of people making money from keeping the cycle alive. RICOCHET's strategy is increasingly aimed at making every trip around that cycle more difficult — and considerably more expensive.