An account ban follows a login, an IP ban follows the public address your connection presents, and an HWID ban follows a hardware fingerprint built from the PC itself. If a new account and a genuinely different network are both blocked on the same machine, the evidence points to the hardware layer; if changing only the network restores access, it points to the IP layer. Platform and silent matchmaking restrictions form a fourth category that can resemble all three.
The useful question is what identifier stayed constant between failed attempts. Work from that evidence before changing anything, because a fix aimed at the wrong layer wastes time and can make a publisher treat the next attempt as ban evasion.
The four ban layers, side by side
Ban type | What it's keyed on | Survives a new account? | Survives a new network? | What actually lifts it |
|---|---|---|---|---|
Account ban | Game or publisher account ID | No, if it is the only flag | Yes | Successful appeal or a rules-permitted new account |
IP ban | Public network address | Yes | No | A new public address or genuinely different network |
Hardware (HWID) ban | Composite machine fingerprint | Yes | Yes | Successful appeal; cheat-detection appeals rarely succeed; otherwise a persistent identifier change |
Platform / matchmaking block | Platform identity or trust status | Usually | Usually | Publisher or platform review |
These layers are independent. A publisher can flag an account and the PC used by it, while a community server can block the public IP seen during the same incident. Removing one key leaves the other record intact, which explains why a partial change may appear to do nothing.
Ban type and enforcement method are also separate axes. The key tells the service what identity it recognizes; enforcement decides whether you see a permanent-ban notice, fail at login, lose matchmaking, or receive no clear message. Two players can meet the same hardware match and see different screens because the publisher controls the response.
There is no dependable severity ladder based only on the message shown. An explicit account notice may be easier to diagnose than a silent platform restriction, while an IP block is usually easier to isolate than either. Track what changed and what did not.
Account ban: the account is flagged, the machine isn't
An account ban is keyed to the identity you use to sign in: a game account ID, publisher login, email-backed identity, or a linked platform identity such as Steam or Riot. The server denies that identity regardless of which PC or network presents it. Labels such as permanent ban describe the account decision; they do not prove that the hardware was recorded.
If the account is the only flagged object, another account can technically connect from the same machine. Whether you are allowed to create or use one is a separate rules question. Many publishers prohibit attempts to return after enforcement, so changing accounts should never be treated as a consequence-free test.
The confusing case is a stacked account and hardware flag. A fresh login reaches the game, the anti-cheat reads the same machine profile, and the publisher associates that login with an existing hardware record. The new account can then be stopped even though its email and account ID had no history. That outcome does not mean every account ban was secretly an HWID ban; it means the PC supplied a second matching key.
IP ban: rarer than the internet thinks
An IP ban uses the public IPv4 or IPv6 address visible to the server. It does not use the MAC address printed on your network adapter: a MAC normally identifies an interface only on the local network segment and is not carried across the internet as your public identity.
Modern residential addressing makes a public IP a noisy key. Internet providers rotate dynamic addresses, and carrier-grade NAT, or CGNAT, can place many households behind one public address. A broad IP block can therefore affect uninvolved players or move to a different customer after reassignment. Games and individual servers still use IP restrictions, but account and hardware evidence provide a more stable identity for competitive enforcement.
A genuine IP restriction usually stops applying from a genuinely different network. A router reconnect may obtain a new dynamic address, although many providers keep the same lease, so a mobile connection is a clearer diagnostic than repeatedly rebooting the router.
A VPN changes the address the server sees. It changes none of the firmware, storage, registry, or trust values used to build a hardware fingerprint. Which of the two is the right tool for your situation is its own decision; VPN vs HWID spoofer works through it.
Hardware ban: it follows the machine
An HWID ban is keyed to a composite profile rather than one universal serial. An anti-cheat can normalize several machine values, send a fingerprint to the service, and compare later launches against the publisher's stored record. The exact mix and weighting are not public or identical across engines.
Firmware-level inputs can include the SMBIOS or BIOS serial and the motherboard UUID. Storage contributes the physical disk serial reported by the device or controller and the filesystem's volume serial, often called VolumeID. Network and Windows inputs can include a MAC address and MachineGuid at HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid. CPU or GPU identifiers and other device properties may add supporting evidence rather than acting as a single decisive HWID.
TPM 2.0 and Secure Boot belong to the platform-trust layer. A TPM endorsement key is hardware-rooted identity material, while Secure Boot state is a launch or attestation gate, not a serial number. Treating them as interchangeable hides why a Windows reinstall can replace some registry entries and a volume serial yet leave the BIOS serial, motherboard UUID, physical disk identity, and TPM-backed evidence unchanged.
That surviving overlap is why the restriction follows the machine through a new account or network. The anti-cheat reads the profile again at launch, and the service can resolve it to the old publisher-side record. The mechanics of how a hardware ban is applied covers that pipeline in detail.
The same anti-cheat engine can collect the same family of values across its protected roster, so a known fingerprint can create cross-title exposure. Publisher ban lists remain separate, which means a ban in one game does not automatically ban every other game using that engine. For an EAC hardware restriction, Easy Anti-Cheat keys its bans on hardware, not your connection.
The fourth layer nobody names: platform and matchmaking blocks
A platform restriction can sit above the game account. Steam, a console network, or a publisher-wide identity may deny access across linked titles even when the local game login changes. That is still an identity restriction, but its key belongs to the platform relationship rather than the PC's hardware fingerprint or the household's public IP.
A shadow ban or matchmaking block is different again. The account may sign in and launch normally, then face isolated queues, restricted lobbies, delayed matches, or another trust-based limitation. Because enforcement is silent, players often infer an HWID ban from a symptom that never tested the machine identity at all.
Rule out ordinary failures before assigning a ban label. Service outages, damaged game files, entitlement problems, regional queue conditions, and an anti-cheat initialization error can all stop a match without creating a ban record. A silent matchmaking restriction is a different thing again and deserves its own diagnosis; the key point here is that no ban message does not equal an HWID match.
How to tell which one you have
Start with the low-risk option: check your machine before you start testing accounts. A checker can organize local evidence without creating another login or attempting to enter a protected match. Only use the controlled comparisons below where you own or have permission to use the other PC and where the game's rules allow the account test.
Creating alt accounts after enforcement can violate the game's terms and can escalate the restriction. If the rules prohibit it, stop at the read-only checks and use the publisher's appeal or support path. The sequence below is a diagnostic model, not permission to evade a ban.
Same PC, brand-new account on a fresh email: if it is still blocked, the restriction is not explained by the original account alone.
Same PC, genuinely different network such as a mobile hotspot, not a VPN: if it is still blocked, the restriction is not explained by the original public IP alone.
Different PC, original banned account: if it is blocked there too, the account is flagged regardless of the first machine.
Different PC, new account: if that combination works while the same new account fails on the original PC, the machine you started on is the remaining changed variable.
Read the results as a matrix, not four isolated tricks. Failure that follows the original account points to the account layer. Failure that stays with one public connection but disappears elsewhere points to an IP restriction. Failure that stays with the original PC across permitted accounts and networks points to a hardware or local platform-trust restriction.
Mixed flags can produce more than one positive result. The original account may fail on another PC while a permitted new account also fails on the original PC, indicating account and machine records at once. A different PC can also carry its own prior history, so a borrowed system is useful only if its status is known.
No result can force a publisher to disclose its evidence, and a hardware ban may never display the words “hardware ban.” Treat the matrix as a way to eliminate weak explanations and choose a support path, not as proof that overrides the publisher's records.
Why the fix for one is not the fix for another
Account ban: use the publisher's appeal process first. Whether an appeal is worth filing depends on the evidence and the rules; appeals after a confirmed cheat detection rarely succeed.
IP ban: verify that the restriction actually follows the public address, then use a permitted different network or ask the provider about address assignment. This does nothing to an account or machine flag.
Platform or matchmaking block: use the platform or publisher review channel. Replacing network or Windows identifiers cannot lift a decision keyed to a Steam, console, publisher, or matchmaking-trust record.
Hardware ban: appeal if the publisher offers a route. If recovery is permitted, the identifiers must change at the layers the anti-cheat reads, and those changes must remain true at the next launch. The full recovery path once you've identified it covers the sequence and its limits.
A temporary session-level spoof disappears at reboot, which can expose the stored values on the next launch. TraceX Spoofer uses the permanent model:
rewrite the identifiers once, then delete the tool. TraceX does not replace an appeal, clear an account decision, or change a public IP. It applies only when the evidence points to the hardware layer.