The Ban Written Before the Purchase: Vanguard's Hardware Blacklist and the Blind Spot of the Used-PC Market

August 12

Late September. A VALORANT player in Germany buys a used Ryzen 7 5800X3D processor on Kleinanzeigen. Kleinanzeigen is one of Germany's busiest classifieds marketplaces for secondhand goods; processors, graphics cards, entire rigs all pass through it. The price is a few dozen euros. Old part, new upgrade, ordinary arithmetic.

He installs the processor, launches VALORANT, and the game throws him out. Not once. When he asks Riot support, the answer comes back: the CPU's serial number was blacklisted in Vanguard on August 12.

August 12. Six weeks before the part reached his hands.

I don't normally write about this kind of thing. My notebook holds shot maps, economy curves, PPDA lines. Six years of working the numbers inside matches taught me one thing: if the scoreline tells a story, you sit beside the scoreline and read the story again. My first xG notebook taught me that a match can be read twice. Here I have to read a ban twice — once the way the story spread, once the way the evidence was assembled.

Because there is a date at the centre of this, and that date is probably accusing the wrong person.

What kernel-level actually means

Vanguard is Riot's kernel-level anti-cheat, built for VALORANT. Kernel-level means software sitting deep inside the system. Where it sits matters, because from there it can see not only game files but device fingerprints. Which processor, which serial, which motherboard, which part in which machine.

This is where ordinary discussion slips. People argue about Vanguard in terms of privacy and performance, but the real question is elsewhere: when anti-cheat recognises hardware, what exactly is it punishing? The account? The machine? A component?

You cannot judge this case without answering that question.

Why the machine and not the account

An account ban is the cheapest sanction because an account is the cheapest thing. Ban a cheating account and the cheater has a new email, a new handle, and a fresh start in ten minutes. Publishers worked out long ago that punishing what is easy to replace leaves no teeth. Punish what is hard to replace — machine, serial, hardware — and the teeth return. HWID bans are the last step of that logic.

The decision does not strike me as unreasonable. The opposite is more unreasonable: if a publisher only bans accounts and the cheater returns on a new one every time, competitive integrity becomes a slogan. Integrity is not only about who won; it is about whether the answer to why the loser lost was built on a clean field.

But the boundary needs stating plainly. No patch changed here. No champion was rebalanced, no map pool rotated, no tournament server version shifted. Patch notes are the weather; the data is the climate. This story is climate, not weather. What changed is an enforcement list, and nobody has measured the size of its effect.

What changed, more precisely, changed for one cohort. A patch usually hits a playstyle or a champion pool. This hit a hardware group: people who buy used parts, build refurbished rigs, upgrade a setup one step at a time on a budget. That cohort has no lobby, no representative, no contract with Riot. It has a support ticket.

How the story arrived

The story came first from Reddit, then Kotaku, then PCWorld. Three steps, three kinds of reader: community, gaming media, mainstream tech press. The route itself tells you where the story is growing. When a community complaint is picked up by mainstream tech press, it stops being an incident and becomes a precedent.

One thing needs clearing up. Riot has said nothing about this case. Every fact available is the player's own account. PCWorld called such cases rare, but gave no number for rare. What share of used parts carries this risk, what share of cases are false positives, what share of appeals succeed — none of that is in our hands.

I read a lot of writing that turns one incident into a trend. In 2026 I analysed all 83 Bundesliga matches after the restart, in the empty-stadium era. Home points fell from 1.54 to 1.32; home win rate fell from 43.2% to 33.7%. I controlled for team quality with a five-match rolling xG and still labelled it provisional. Provisional at 83 matches. Here we have one case, self-reported, unconfirmed by the publisher.

Provisional does not mean ignorable. One case can show that a mechanism exists; it cannot show how often the mechanism fires. Those are different questions, and most media confusion comes from collapsing them.

A sanction that follows an object

Here is the real ground.

The problem with HWID bans is not that they are harsh. The problem is that what they punish is an object, and objects can be sold.

A serial number is a property of hardware, not of a person. A person committed the offence. The sanction was written against a serial. So the sanction stays with the object rather than the person. If the object is sold, gifted, pulled out of a grandfather's old PC, returned refurbished from an RMA, the sanction travels with it.

That is the structural flaw. Not a bug in the code — a bug in the design. The moment the machine becomes the unit of enforcement, the ban stops being a personal record and becomes a property record, with no property registry attached.

An analogy clarifies it. Suppose a footballer is caught doping and the sanction is written against the serial number of his boots. Someone else buys the boots later. He still cannot play. Nobody would call that fair. Yet that is the structure we are in, with a CPU instead of boots and a server instead of a stadium.

Cross-sport comparisons need care, because equivalents are not automatic. Map control in esports is not possession in football; it is territorial control. The human-AI relationship is closer. Here too: an account ban is a red card for a player; an HWID ban is the club's licence revoked. The second has more teeth and does more damage.

The timestamp is the evidence

The most important number in this case is not money. It is a date.

Blacklisted August 12. Bought in late September. The moment this person became the owner, a decision against the part had already been written six weeks earlier.

I call this the simplest form of natural experiment: a variable dated from outside, which cannot be explained by the accused's behaviour. Empty stadiums were a natural experiment; I just brought the spreadsheet. Here you do not need the spreadsheet. You need a receipt and a date.

For an appeal process, this is about the easiest case imaginable. If the purchase date is later than the blacklist date, the current owner cannot be the offender. That is not argument, it is arithmetic. No forensics, no VOD review, no long investigation.

And yet this is exactly where my hesitation sits. I trust the model, but I audit the model before I trust the model. There is only one model here, and it is one-sided: the player's account. We do not know what Riot actually logged. We do not know whether the serial was blacklisted, the machine, the account, or some combination. We do not know why the previous owner was banned — cheating or something else. With those unknowns, the phrase wrongful ban cannot be used. Unverified one-sided report can.

What one case can do is raise the question. And the question is: if someone genuinely lands in this position, what route should be open to them?

Where the shadow grows

One line in the story deserves separate attention. The player was reportedly told that replacing the graphics card would not solve it, because other components had also been affected.

Small sentence, large meaning. It suggests the flag may not be confined to a single CPU serial. It could be a multi-component association, or a whole-machine fingerprint. If so, the problem is not that buying a used part was a mistake. The problem is that this rig cannot be recovered.

Economically that distinction is enormous. One component means tens of euros. A whole rig means hundreds or thousands. The player himself concluded a full PC replacement might be the only way back.

I do not treat that line as proof of Riot policy — it is the player's paraphrase of a support exchange. But the direction matters. It shows the shadow of HWID collateral damage is not obliged to stop at one part. The larger the shadow, the larger the cost of being wrong.

The arithmetic of the secondhand market

The gaming PC market runs on two layers. One is new goods, where brand and warranty set the price. The other is used goods, where uncertainty sets the price. Every used marketplace discounts a little, because the buyer knows there is no guarantee of how long a part ran, who ran it, or how. That uncertainty is the currency of the market.

HWID bans insert a new layer into that uncertainty, one the buyer cannot inspect. The part works. Temperatures are fine. Stability is fine. But an invisible record hangs off it. That is not a physical defect, it is an administrative one, and that is precisely why it cannot be caught before purchase.

In a market like Germany this matters especially, because buying used parts is a normal, established habit. EU consumer protection gives buyers rights, but those rights generally concern physical defects, not a publisher's anti-cheat decision. Who is liable here is not written down anywhere clearly.

One inference is possible, flagged as an inference. In the phone market, IMEI-flagged devices lose resale value. If HWID flags became common, certain used CPU models could see a similar discount. That is unproven; it is a plausible consequence worth watching.

A market with no medical

In 2026, consulting for the New England Revolution during the transfer window, I flagged Georges Mikautadze after Euro 2026: three goals, 0.68 xG per 90, 2.1 progressive carries per match. The club moved. The deal collapsed at the medical — a prior knee issue surfaced. I had modelled output and not injury history.

The following month went into rebuilding the template. Every player profile now carries a minutes-load table and an injury-days paragraph. The writing became more responsible and less sensational. A few breaking-news opportunities went elsewhere.

The lesson was not don't buy. The lesson was that a market needs a disclosure instrument. The medical is that instrument. Nobody uses it to price a player; buyers use it to know what they are buying. A transfer rumour is a hypothesis; a medical and a spreadsheet are evidence.

For a used processor, there is no medical.

You buy a used Ryzen, check the pins by hand, listen to silicon lottery stories, but you cannot check whether any anti-cheat system holds a record against that serial. No pre-purchase screening, no guaranteed remedy afterwards. The gap between those two zeros is exactly where this case happened. And a buyer with no pre-purchase screening is not a careless buyer; he is a buyer in a market that has not built the instrument yet.

Two meanings of rare

Now the numbers have to be faced.

The only source on prevalence is PCWorld's word rare. Rare meaning what? One in a thousand? One in a hundred thousand? One in ten? The word may be accurate and it still cannot be measured.

Rare in engineering and rare in policy are not the same thing. In engineering, rare means tolerable risk because the rest of the system works. In policy, rare means an excuse if the affected person has no route out. The same number carries two meanings, which is why the number alone is never enough.

My own rule: no trend announced on fewer than fifty matches. Here the sample is one. One self-reported, publisher-unconfirmed case. What that sample supports is assuming the mechanism exists, then asking how badly the mechanism could fail.

The answer splits in two. At the individual level it is quite bad, because a wrongful ban means either money spent or a game abandoned. At the systemic level it is unknown, because we cannot tell an isolated rarity from an unreported cluster. The distance between those two is wide enough that one cannot be substituted for the other.

Who pays

It is worth remembering who pays.

Not the cheater. He is probably on another rig, on another account. The person paying is the one who bought a used part to lift his setup one step within his budget. He broke no rule. What he did was complete a transaction.

The purpose of a sanction is behaviour change. Punish someone who did not commit the act and no behaviour changes — except his own, and the behaviour he learns is avoidance. That lesson spreads. One case across three outlets and thousands of used-part buyers reach the same conclusion, which is rational and also larger than the evidence warrants.

The contrarian read

The received reading: Vanguard has gone too far, innocent buyers are being punished, HWID bans should end.

I do not believe the last part.

Remove HWID bans and ban-evaders get a free reset. Ban the account, keep the machine. Without hardware enforcement, account enforcement turns into a subscription model for cheating. For an honest player that is a worse outcome, because the number of cheaters he faces goes up, not down.

So what is the real problem? Not that the ban is harsh. That the ban is a record with no public registry.

IMEI existed; serials do not

Comparisons help if the equivalent is chosen carefully.

Phones have IMEI checks. Before buying, a buyer can see whether a device is stolen or blocked, and the check is free, fast, and in the buyer's own hands. Cars have VIN history: accidents, liens, odometer. Insurers and dealers have run that structure for decades because the product is expensive and the market is organised.

PC components have no equivalent. The market is enormous, the product is small, and there is no central record. So objects with invisible status change hands. That is not a buyer failure, it is a design gap in the market.

A verification layer is imaginable. A portal where you enter a serial and learn whether it is flagged. An appeal where proof of purchase clears a flag when the transaction is proven to postdate it. A disclosure obligation at the marketplace level. None of these exist, and none were demanded before this case.

Heat high, base thin

Second contrarian observation: the gap between narrative heat and evidentiary base.

One Reddit post, one Kotaku report, one PCWorld article, and the story sounds like a systemic crisis. The crowd was the variable we never put in the model. Here the crowd is forum outrage, which cannot be mapped, only measured. Heat high, base thin — that is the condition in which I write slowest.

There is a specific risk nobody is naming. If the case later proves incomplete or one-sided, the story flips, and the flip lands on the original reporting. Community-origin stories that climb to mainstream press have a history of this.

Third: this cannot happen to anyone. It can happen to people buying specific kinds of used components, from specific kinds of marketplace, after a specific date. Narrowed that far, the claim becomes provable. Widened to anyone, it becomes unprovable.

The Morocco lesson fits oddly well here. Nobody expected Morocco in a semi-final in 2026 because they did not play the game large — they played it small. Compact shape, low attacking volume, opponents funnelled into low-value crosses. PPDA of 14.2, xG allowed of 0.78 per match. The smaller the claim, the easier to defend. Same discipline here: keep the claim small until the evidence can carry it.

The reverse risk

There is a danger visible only when you look toward better design rather than louder criticism.

Suppose Riot, under pressure, announces that proof of purchase lifts a hardware ban. Applied without verification, that opens a hole. A cheater sells his flagged rig to a friend, the friend submits a receipt, the ban lifts, the rig returns. The appeal system becomes a ban-evasion tool and honest players share a server with the same cheaters again.

So the fix is not appeals exist. The fix is that an appeal contains a verifiable relation: the transaction date is later than the flag date, and it can be proven. Here that date happens to exist, and it is the case's most useful asset.

A sound appeal has three layers. The buyer proves when he bought it. The publisher verifies the flag predates that. The decision is communicated in writing. The third layer sounds least important and in practice reduces the most damage, because without explanation people infer, and inference usually runs the wrong way.

The governance gap

One thing turns this from small to large, and it has nothing to do with gameplay.

Riot is rule-maker, enforcer, and commercial stakeholder at once. There is no independent arbitration. The affected party's only route is a support ticket. In that structure the question is not whether the ban was correct; the question is who explains why, how, and on whose authority.

I have spent years writing about referees and VAR, and the same sentence applies exactly: the decision is announced, the reasoning is not. The stadium screen shows the line, not why the line falls there. The crowd — here, the player — is the party most in need of an explanation and least likely to receive one.

PCWorld's own framing points at this: clear appeal routes and explanations of how hardware bans work matter for player and team confidence. Agreed, with one addition. Explanation is not only for trust, it is for prevention. A player who does not know what to avoid cannot avoid it. Don't buy used parts means nothing, because buying used parts is legal and most of the world's gamers do exactly that.

Streaming insulated, retail exposed

Map the transmission. Upstream sits the publisher's anti-cheat policy. Midstream sits player hardware and the used-PC market. Downstream sits consumer trust and confidence in sanction fairness.

Streaming, broadcast, sponsorship and betting are close to neutral here. They run on results, rosters and meta. The sector taking the hit is secondhand retail, where a flagged part loses utility value. The publisher carries reputational cost, but that cost comes from a wider context: Riot's ban-consistency debate was already running before this case. One incident amplifies an old argument; it does not create one. That distinction matters, because a lot of analysis calls a new crisis what is really a new example of an old doubt.

What I'll watch next

I cannot write this up as a major crisis, because the evidence does not permit it. What I can say is small, specific, and checkable: hardware-scoped sanctions without a public registry create an asymmetry, and asymmetries do the most damage to community trust.

Four signals over the coming months. One, whether Riot issues a formal statement — silence extends the story, a clear explanation can end it. Two, whether independent cases surface; one case proves a mechanism, three begin to prove a pattern, and that difference is the whole game. Three, whether marketplaces or retailers add a disclosure layer, as IMEI checks once became normal in phones. Four, the simplest indicator of all: whether this case is resolved, and whether it is resolved on the strength of a date.

The closing question stays open. If a serial number's memory outlives its owner, is the next step in anti-cheat better detection — or an accounting system, where every sanction carries a date, a reason, and an appeal route?