Call of Duty's Anti-Cheat Boss Dispels Cheating Myths, Breaks Down Review Process, and More

Cheating in video games has turned into a multi-billon dollar industry, one that has forced franchises like Call of Duty to build entire teams to combat this epidemic. One of the people leading the charge is a man named David Andrews, a former Department of Defense contractor and member of the Air Force who made the leap into the video game industry. He began this career change working at Rockstar Games, helping combat cheating in Grand Theft Auto Online. Last year, he made the jump to Activision to become the Senior Director of Game Security for Call of Duty.

IGN had the opportunity to sit down with Andrews and peel back the layers on Call of Duty's anti-cheat system, Ricochet. Andrews disspelled myths about Call of Duty's anti-cheat, offered clarity on the process of how they investigate suspected cheaters, how they've hired cheater makers to combat the problem, and much more. It's a rare opportunity, as there's a lot of caution around publicly speaking about anti-cheat in gaming. If you say too much, you could inadvertedly give cheaters a heads-up on how to evade detective, after all.

With that said, we drilled down on Call of Duty's long running issue with cheaters in an attempt to make it less mysterious. It's an important subject ahead of Modern Warfare 4's release in October and something Activision is working hard to spotlight.

This interview has been lightly edited for clarity and length.

IGN: Before we dive specifically into Call of Duty, tell me the difference between working on Grand Theft Auto Online, Red Dead Online, and Call of Duty, because one's obviously hyper-competitive, while Grand Theft Auto is a completely different ecosystem.

David Andrews: I think the interesting pivot for me is that the GTA Online gameplay loop is very different. Same thing for Red Dead Online, and that's where cheat developers tend to go. They're trying to shortcut whatever that gameplay loop is for their customers. And so on GTA and Red Dead, it was much more about economic progress within the world. So we had problems with money drop lobbies and things like that in the old bad days on GTA Online, which we did eventually fix. The nature of the cheating is different there. In terms of the impact and the disruption that it can cause to the players, very similar.

[There are] persistent online sessions in GTA Online versus rolling lobbies on Call of Duty. A cheater that goes undetected for too long is going to have an impact no matter what that is. There was also lots of griefing in GTA Online powered by cheats and things like that. As different as the core gameplay loops are between the two games, and you could probably say this about anything across the industry, cheating is still just ultimately super disruptive. It's a terrible experience. It's bad for our players, and the mission is always just to try to prevent as many of them as we can from getting into the game and then get them out as quickly as we can for those that make it through.

IGN: Is there something that companies can do together to solve these issues? I saw you last night talking about Wardogs and their approach. Everyone has a different strategy, but is there anything the industry can collectively do?

David Andrews: There's a ton of overlap that we see within the industry. It is an industry-wide problem. If anybody running a live service title is going to have this kind of issue with cheating, and no matter how advanced or what your particular approach is for a particular title or whatever you're doing, cheaters are always going to get through. I thought that a really good message from that Wardogs video was that no matter how good you are at this part of the game, people are going to get through. Cheat developers are incredibly financially incentivized. It's a multi-billion dollar industry out there selling cheats, and they're all looking for their cut of it. I think in terms of what we can do as a group, we definitely all talk with each other informally, always trading war stories and maybe some approaches in terms of what's going on.

Certainly I've seen in my past at Rockstar as well as here at Activision, you'll have cheat developers and cheat resellers out there that are selling not just for one title. There's very rarely somebody who's just developing for Call of Duty. They might have their fingers in Fortnite or Valorant or some other title out there, as well. There's usually opportunities for us to compare notes a little bit whenever that's possible for us to do. By and large though, we all keep pushing forward in terms of all of the things that are available to us. Different companies have different litigation strategies and things like that, but we're all marching in the same direction as much as we can.

IGN: What have you learned about cheatmakers? What’s the motive? It’s hard to wrap my head around why someone would pay $70 for a game just to not really play it.

David Andrews: Money is totally a huge motive for quite a lot of them, but there are also a strain of cheat developers, or I even call them cheat development-adjacent folks, who are just in it for the love of the game. They just really love that title and they have a technical sort of bent of mind and they want to understand how the game is working. And then that naturally leads into this place where you might be putting together a cheat to figure out ‘How does this game actually work?’

And in that space, I've had some success in turning some of those cheat developers or cheat-adjacent people to the light side by basically, bringing them over, and hiring them into the team. They bring a huge expertise and a really unique point of view to add to the team, and it can be a really huge value add for us. We've done that successfully a few times.

I think for their users, the motivation is like you mentioned: You pay $70 or whatever it is for a title just to not play it. It's because they want to be seen to be good and they're not actually good at this game. They kind of suck, which is fair enough. I'm not the best at Call of Duty myself personally, but I wouldn't turn to a cheat to go try to do something about that. But they are in friend groups, they're in social circles that really highly prize competency at these games. And so they go out and this is their only option to be any good at them, so they go out and buy cheats.

IGN: I’d love some insight into the cat-and-mouse game, since there’s a whack-a-mole situation that likely happens with trying to stomp out cheatmakers. There will always be cheaters, regardless of the steps you take.

David Andrews: The main mission is always just to protect the integrity of that live legitimate player experience, just making sure that they're having the best possible experience the way that our game developers intended for them to have. We do that a lot of different ways. The cat-and-mouse game is absolutely part of this, and there's some balancing efforts that go in there, in terms of figuring out when's the right time to ban a cheater once you've detected them. I think in the past, quite a lot of us in the industry indexed pretty heavily towards ban waves for a variety of reasons. One of them is that if you catch enough of the cheat customers in one big roundup, you might knock that cheat offline for a period of time and you actually get more clean running than you would otherwise by just issuing bans as you get them.

That's certainly where I started out philosophically, but as the years have gone on, I don't necessarily believe that that's the most effective way anymore. I think the most effective way is shifting left, preventing cheaters from getting into the game and then once they get into the game, getting them out as quickly as possible. Every single ban that we do gives feedback to the cheat developers and it helps them troubleshoot their problem, which is how did we detect them? It gives them feedback on how to circumvent us, but then that's just a challenge for us to get better at our jobs and do a better job of creating new detections, creating new novel ways of finding cheaters, preventing them and getting them out of the game.

There are a lot of conspiracies about cheating in Call of Duty, such as maybe the perception of how bad it really is due to viral clips. From your perspective, what are some of the myths of the cheating situation in Call of Duty?

David Andrews: I think you've touched on one there. The numbers that we see internally remain really, really positive. We shared during the Black Ops 7 beta that we had a very, very low match infection rate. That's maintained over the course of the title. It's incredibly low. If you're an average player and you're in ranked or you're in Warzone, you're doing whatever you want, you're not encountering a lot of cheaters. But [if] you go on social media and [watch] content creators and pros, they're having a different experience to what you're probably having, and then you're sort of internalizing that. You're seeing, ‘Well, my favorite streamer is encountering cheaters every day.’ I go online, I see something unfair or something inexplicable that I'm not quite sure what happened there. I'm just going to assume that's a cheater as well because I've seen this around. It just doesn't tend to be true for our average players.

Our match infection rate is incredibly good still, but that does still highlight for us that there are hotspots. There are problem areas. We don't want to try to go out there and say ‘We've solved cheating, you're never going to see a cheater.’ Certainly content creators and pro players that are playing at the very tip top edge of ranked play are going to encounter more cheaters right now. We're working on it all the time to try and get them out of the game.

That's the biggest one I think right now. Perception is just quite prevalent that there's a huge cheating problem. It's not to say there is no cheating problem. Obviously Ricochet still exists. We're all still gainfully employed and we're still trying to work on this problem, but it's certainly taken a pretty giant step forward with Black Ops seven with the introduction of TPM and Secure Boot requirements, and we're looking to just keep making more steps forward in the next title.

I wanted to ask a little bit about the review process. So, say I'm suspected of cheating. I've been reported and you guys are going to take a look at my account. What does that look like? Is there a human reviewing it? Is it AI-reviewed? And how long do they spend looking at that? Because I imagine there are a lot of reports. So, how do you sift through that to make sure you guys are giving its due diligence?

David Andrews: I'll say that things come in from a variety of different directions, and the vast majority of our bans that go out are through reviewed but automated systems. So for instance, for a particular cheat, we might deploy a signature that identifies like, ‘Oh, in running memory, if you see this string, this string only exists for this cheat.’ And then we fire that back and we'll collect that data for a little bit on all those accounts that are triggering that detection, look at them en masse, and also one by one and just make sure that those really do look like cheaters. That process is pretty involved.

We look at game data, we have everything that you input into the game clients while you're in a match. All of that data is with us and so we can identify clear outliers there. We also look at trends and behavior, like what is your kill death ratio over time? Does it spike in certain circumstances? What's your win-loss ratio? Things like that. We also will look at replay renders. We have tooling internally that we can just recreate an entire match and look at it and see if it looks suspicious or not. These are just some of the tools that we have internally. So we'll apply that to that whole batch, that whole population of potentially detected cheaters. And if it passes through that validation stage, then we'll say, ‘Okay, that signature is good. People that are popping that signature are going to get banned from now on.’ There's also things that are more manual. All the same tools kind of apply.

We'll still look at the account holistically. We'll look at it per match. We'll look at it in terms of how often they are being reported. All these kinds of data points are valuable to us and then we'll make a determination. That's kind of the stuff that you might see if a social media clip is posted and they aren't already banned. These are the things that we start looking into to see, ‘Okay, well what's going on with this account? What do their last few matches look like? Let's try to make a determination here.’

IGN: There was an incident a week or two ago with a former COD pro player named FormaL, and he triggered the detection in the Modern Warfare 4 beta. Call of Duty’s social team said that wasn’t supposed to happen. Do you know what happened there? What is the percentage of people being banned that shouldn't be banned, and what's the process of making sure that doesn't happen?

Former Call of Duty pro and legend FormaL got permanently banned in the Modern Warfare 4 beta live on stream 💀The Oris is so good it’s got pros getting their accounts flagged 🤣 pic.twitter.com/8MlHBfbH3G— ModernWarzone (@ModernWarzone) September 2, 2026

View on X

Former Call of Duty pro and legend FormaL got permanently banned in the Modern Warfare 4 beta live on stream 💀The Oris is so good it’s got pros getting their accounts flagged 🤣 pic.twitter.com/8MlHBfbH3G

David Andrews: So, the thing I'll say for that one is I think, obviously, we replied to that particular instance, but he certainly wasn't the only person that was caught up in that slight error there. Betas are for us, as well. We're constantly kind of tuning and testing our systems and transitioning from Black Ops 7 to Modern Warfare 4. There's a lot of tuning that has to take place there to make sure that all of our behavioral thresholds are accurate.

Also, someone like that player is quite high, and so very highly skilled players are kind of constantly brushing up against the threshold where we say ‘Beyond this, no human could achieve that.’ So they're just right there. They're quite close. And so we constantly are looking at this. The answer to the question is really, we're constantly reviewing the output of our systems. We don't just do that review one time and then we set it and forget it.

We're constantly looking back to see, ‘Is this thing still performant?’ Because also we want to know that we're still catching cheaters, but also is it overperforming? Is it catching people that it shouldn't be catching? We've built quite a lot of safeguards over the years. One of the things that impressed me coming in [is that] if there's some conjunction of events where a false enforcement is issued, we tend to catch it fairly quickly and then we will kind of identify systematically who were all the people impacted.

So in that one, it was one of about 200 people, I think, that were caught over the course of both beta weekends with that particular problem. We identified the problem, which won't happen again, and we restored all those people to good standing. So it's just constant review, constant monitoring, always looking at what's going on.

Do you have any involvement with the videos of process servers showing up to people’s houses to give them a cease and desist, or are you just enjoying them?

David Andrews: I certainly enjoy it for sure. I think that we do have a pretty comprehensive grasp on everything that's going on within the cheat community, and that extends to trying to identify devs and potentially put together actions like that. We don't necessarily initiate litigation or send cease and desists to everybody. There is some prioritization and triaging that has to happen. We do go after popular cheats obviously, but we also go after cheats that are technologically sort of more advanced than other cheats as well. And for these incredibly persistent cheat developers who are, again, just enormously financially incentivized, it kind of doesn't matter how often we detect them sometimes. And they'll gaslight their own customers into thinking like, 'Oh, it was you. It was your behavior and game that got you banned. It's not my cheat that got you banned.' And so when they're that stuck in, they're that persistent, they're that sticky, we have to do things like that and certainly the team helps contribute to that.

IGN: I would love to know your stance on how you guys are supporting older Call of Duty games, as cheaters are out there taking advantage of the fact that nobody's really watching them because they're older games.

David Andrews: Yeah, that's unfortunately one that I won't be able to answer.

Editor’s note: Activision linked IGN to a statement recently provided to Windows Central regarding an update that patched out a security issue with the original Modern Warfare 2. The statement notes that more support updates for older Call of Duty games are coming soon: "An update released this week addressed all known vulnerabilities in Modern Warfare 2. The team continues to support our legacy titles, with additional updates coming soon. We encourage anyone aware of additional issues to report them through Activision's Bug Bounty Portal."

How has cheating evolved since you started at Rockstar? We talked about the difference in games, but how have you seen the industry evolve? Has the financial incentive only increased over time, especially as free-to-play games get introduced?

David Andrews: Anytime you're dealing with a free-to-play title, the barrier of entry is just so much lower and that means a broader player population, that means more demand for that title, and more incentive. It’s definitely grown over the years. I think from my particular perspective, the sophistication of the cheat developers is definitely growing as well. [Cheat developers have] their own sort of, we call it OPSEC, operational security, in terms of protecting their identity, because they know what they're doing is not right and they know that the publisher or developer is going to come after them eventually.

So they're getting better and better at hiding themselves from us and working through intermediaries. It’s quite a complex, very interesting sort of threat landscape for us. At the end of the day, it's really evolved over the years. The other thing that's really evolved is cheats used to be pretty simplistic.

They're just hooking, running memory and doing X, Y, Z thing and figuring out what function does what, modifying those functions, and then off to the races. Everybody's anti-cheats have sort of very much pushed them out of the more traditional easy or straightforward ways of cheating. That's why you're seeing growth in other areas like Cronus and other scripted input devices, computer vision powered aim bots, DMA cheats, things that are either reduced in functionality or more expensive, or sometimes both, than what they used to be. The price of a cheat is definitely going up over the years as we all get more and more effective and fight them more consistently.

IGN: Obviously there's software, but there's also hardware like Cronus, physical things that you can purchase. I think Call of Duty has done a pretty good job of trying to stomp that one out, as well as hard platforms in general, like Xbox and PlayStation. How are you guys combating that kind of stuff? It's probably pretty frustrating to know that there's just stuff being sent out in the mail to people. They're just selling it right there. It's not even really hidden.

David Andrews: Cronus and other scripted input devices like that are a really interesting challenge for us. At the end of the day, they do have sort of reduced functionality versus a full blown sheet. So they're usually taking advantage of things like aim assist and just giving it to you all the time or more accurately or whatever.

But absolutely the fact that you can just buy one at a big box store, you can buy one off of any popular online storefront that you might think of, have it shipped to your house and plug it in, and then you're sort of off to the races is definitely frustrating. It also means we've adjusted our enforcement strategy against Cronus as well. It's not the typical enforcement strategy that we have in other places, because we know that for some percentage of these users that are buying a Cronus and plugging it in and getting the advantage off of it, they may not fully realize that that's unauthorized hardware and that it's going to get them banned.

We've actually taken an enforcement stance of, on a first strike, we'll give you a seven-day temporary suspension. We're letting you know you can't use that thing. If you use it again, you're gone forever. And then on a second strike, we catch you using it again, we do permanently suspend that account and there might be implications for your hardware as well, if it's a console or PC or whatever.

We've actually seen pretty good results off of that. We're seeing some rehabilitated behavior. We've certainly gotten some interesting support tickets in that are like, 'I promise I threw away my Cronus. I'll be a good player now. Please let me back in,' that kind of thing, which has been really gratifying to see. The numbers back it up, some percentage of them, which hopefully we can talk about in the future, but some percentage of them are sort of rehabilitating. They take that seven-day suspension and then we don't see any evidence of suspicious gameplay again, which is great. That's where we want to be. For the rest of them, they get permanent bans, they get console or hardware banned, and that's that.

IGN: Is shadow banning a real thing? And what is the argument for why shadow banning works over a permanent ban?

David Andrews: We have limited matchmaking that we will put a suspicious account into to isolate them while other checks are either running or we're waiting on other data. We're kind of doing this review process of looking at that account more holistically and seeing what's really going on here. It's kind of this stopgap measure to immediately remove them without making it be permanent [or without creating] irrevocable impact to that account and to that player, giving us some breathing room to figure out what is going on with this account and then either restoring them to the player population because it was kind of a false alarm situation."

We have also done some rehabilitation through the limited matchmaking saying, 'Hey, you can't do that behavior that you've just been engaged in and you can come back if you stop,' or whatever. We have a lot of enforcement capabilities. We have limited matchmaking, we have ranked play bans, we've got remote play bans, we've got temporary and permanent account suspensions, we've got hardware bans.

We can do all kinds of things, and each time we're dealing with a particular style or type of cheating, we're sort of evaluating which one of these kind of makes sense for this group of cheaters. Can they be rehabilitated? Are we ultimately 100% confident in this? Is more research required? Whatever the case might be, we'll figure out what to do that's appropriate.

IGN: Anything else you want to get off your chest?

David Andrews: Well, recently, we did a bit of a hiring highlight, and back to the point of hiring cheat devs, we collect people from a wide variety of different talent pools. We've got people on the team that are former malware research engineers, theoretical mathematicians. We've got people from the NSA and FBI on the team doing other sorts of work for us. It's a really interesting space to me. Something that doesn't get talked about a lot is the anti-cheat part of the video game industry, because there are no degrees in this stuff. There are no certifications. It's not been commoditized in that way yet, and so you have to reach out and find interesting talent and really bright and passionate people from different parts of different industries altogether and then bring them into games and be like, 'Yeah, now we're going to go chase cheaters around and get them out of Call of Duty now.'

It's an interesting thing. We're always looking for new, interesting talents, no matter what the background is there, constantly growing people ourselves in these roles. It's a really cool part of the industry to be in.