What Happens If RawCheats Gets Detected?

Detection is not a question of if, it is a question of when and for how long. Every cheat provider eats detection events on a recurring basis because Easy Anti-Cheat and BattlEye ship signature updates on variable Tuesdays specifically to land detection cycles. What separates a sustained operation from a one-week flash-in-the-pan is exactly what happens in the minutes, hours, and days after a detection lands.

Minute 0 to 5: live test accounts flag

We run live test accounts in every supported game — Fortnite, Rust, PUBG, Marvel Rivals, Overwatch, Arc Raiders. They use the cheat the same way customers do, on unmodified production builds, configured against the live game. When EAC or BattlEye ships a signature update that targets our build, our test accounts get banned within minutes of running the new anti-cheat client.

Detection event ingestion is automated. The loader telemetry pipeline notices the test-account ban state change and triggers two actions: the forum status board flips that product's row to "Updating" (visible to every customer), and the loader's distribution flag pauses launch capability for that product.

Minute 5 to 15: subscriptions pause cleanly

Every active subscription for the affected product enters a paused state. Customers attempting to launch get a clear message that the product is in patching and an ETA based on historical patch times (6-12 hours typical, 24+ hours rare for ban-wave events). The pause is automatic and irreversible until engineering ships the patched build — there is no "override and launch anyway" option because that would risk customers walking into freshly-deployed detection.

Pro-rated credit accrual starts the moment the pause flips. Every hour of downtime adds an hour of credit to each affected subscription. The dashboard reflects accrued credit live so customers can see what they will receive without filing a support request.

Hour 1 to 6: engineering reverses the new signature

Engineering attaches to the patched anti-cheat driver and reverses the new signature. The work involves: identifying what changed in the AC's detection logic (new module scan, new memory pattern, new behavioral signal), tracing the detection to the specific code path in our cheat that triggered it, modifying the cheat's code or rendering pipeline to avoid the signature, building the patched module against the cheat's CI pipeline, and shipping the build to the loader distribution.

Internal target for routine signature updates is 6 hours from detection to patched build. High-severity changes (e.g., a new overlay-detection path that catches our external rendering) take longer and may run 12-24 hours. The forum status board posts engineering progress updates as the patch lands.

Hour 6 to 12: patched build deploys

The patched module pushes to the loader's distribution and every paused customer can launch again. Subscriptions resume automatically. Pro-rated credit is locked in based on actual downtime. No customer-service action is required.

For customers who were hardware-banned during the detection window (this happens to a small subset who launched in the narrow window between the AC update landing and our test accounts catching it), the path forward is Raw Spoofer before next login. The spoofer randomizes disk serials, MAC addresses, SMBIOS data, and monitor EDID — all the identifiers EAC and BattlEye write to ban lists.

Day 1 to 7: post-mortem and hardening

After a patch lands we review what specifically triggered the detection, whether the pattern is likely to repeat, and whether to harden the cheat's detection surface preemptively against the technique. Major detection events get a brief post-mortem posted to the forum so customers understand what changed and why.

This is where in-house engineering shows its value over reseller marketplaces. A reseller cannot reverse a new AC signature because they do not own the cheat source — they wait for their upstream supplier to patch, which can take days or weeks. We patch from our own source tree because we wrote it.

What customers should do during detection

Three things:

1. Do not launch. If status is red or yellow, wait. Launching into a paused state is blocked by the loader anyway, but pushing on it can trigger account-level flags from the anti-cheat side.
2. Watch the forum. Engineering posts progress updates. ETAs are honest — if the patch is going long, we say so.
3. If you got banned in the narrow window before the auto-pause caught the detection, run Raw Spoofer before logging in on a new account. The spoofer is what clears hardware-ban risk; reinstalling Windows alone does not.

The longer story across customers

The realistic distribution of detection outcomes:

• Most customers: see "Updating" on the forum, wait 6-12 hours, receive pro-rated credit, never touched the banned state.
• Small subset: launched in the narrow detection-discovery window, got account-banned, ran spoofer, continued on new account.
• Tiny subset: launched without spoofer, took a hardware ban, had to buy a spoofer to recover.

The middle bucket is the one buyers should plan for. Spoofer ready, forum status check before launch, humanizer enabled — and the realistic worst case becomes an account-level event, not a hardware-level event.

For full detection-status mechanics and the live forum, see the forum. For the ban-defense layer the spoofer provides, see Raw Spoofer. For broader undetected-status context, see are RawCheats undetected.