A shadow ban is attached to an account and usually means that account has entered a restricted matchmaking or review state; an HWID ban is attached to the machine and follows new accounts used on it. The cleanest way to tell is to compare a new account on the same PC, then on a different network, and check the original account's publisher appeal status. Long queues or high ping alone cannot settle the diagnosis.
The short answer
With a shadow ban, you can normally sign in, reach the menus, and start a matchmaking search. The restriction appears inside the game: queues stretch out, lobby quality drops, XP progression may freeze, or party features stop working. Nothing has to announce an account ban because the whole point of the review pool is that normal access looks available.
An HWID ban works earlier. The launcher or anti-cheat handshake reads a hardware ID profile, matches it to a machine-level record, and can block a fresh account before it reaches a normal lobby. Reinstalling the game, changing the account, or changing the public IP address does not remove the machine record.
Treat a shadow ban as a review window, not a final verdict. It may clear without permanent action, or it may resolve into an account ban; where that action follows a cheat detection, enforcement is commonly reported to escalate to the machine. You can also have a shadow-banned original account while a second account meets an HWID block, so one result does not cancel the other.
Symptom by symptom
The familiar symptoms overlap more than forum answers admit. Very long matchmaking queues, high ping on a stable connection, repeated opponents, poor lobby quality, and sudden disconnects can point to an account review, a network problem, or a restricted pool. This is especially visible in Warzone, where shadow bans are most common, but a queue symptom still does not identify which layer caused it.
Where the failure happens is more useful. An account-scoped restriction tends to show itself after login through matchmaking, progression, invites, or the publisher's portal. A machine-scoped restriction tends to appear at launch or during the anti-cheat handshake, before there is a lobby to degrade.
Signal | Shadow ban | HWID ban | Network / IP restriction |
|---|---|---|---|
What it's attached to | Your account | Your machine | Your connection |
How you find out | Nothing is announced; behaviour changes | Usually blocked at launch or at the anti-cheat handshake | Varies; often region or server oddities |
Matchmaking | Very long queues, low-quality lobbies | You often never reach matchmaking | Wrong-region servers, high ping |
XP and progression | Frozen or not awarded | Not applicable, you're not in | Normal |
Party and invites | Often blocked | Not applicable | Normal |
New account, same PC | Works normally | Restricted straight away | Restricted straight away |
New account, different network | Works normally | Still restricted | Works normally |
Survives a Windows reinstall | Not relevant | Yes | Not relevant |
Typical duration | A review window, commonly reported as about one to two weeks | Does not expire on its own | Varies by publisher |
The network column is a diagnostic handoff rather than a third ban explainer. If changing only the connection changes the result, use how IP bans differ from hardware bans to identify that layer without guessing.
For the time and expiry side, how long bans actually last by game separates published policy from community reports. A single duration estimate cannot diagnose the ban type.
The ten-minute test that actually settles it
Keep the test controlled: change one variable at a time and compare where access fails. Do not buy another copy of a game for diagnosis, and do not keep producing accounts after you have a clear result.
Use a clean second account on the same PC and the same network, where the publisher permits another account. Play only enough to finish required onboarding and reach the title's normal matchmaking pool. If it is restricted from the start, the evidence moves away from an account-only shadow ban and toward the machine or connection.
Run that same second account through a phone hotspot. Keep the PC and account unchanged. If the restriction disappears, the network is part of the result; if it fails at the same point, an HWID ban becomes the stronger explanation.
Check the publisher's ban-appeal portal with the original account. Activision shows “Under Review” while a case is open, which is direct evidence of an account-scoped review. It does not prove that the machine has no separate flag, and other publishers may use different status language.
Read the three outcomes plainly:
The second account works on both connections: the original account is the restricted object.
The second account fails at the same stage on both connections: the machine profile is the likely common factor.
The second account fails on the home connection but works on the hotspot: the restriction has a network component.
There are two caveats. Some games place new accounts in onboarding or limited pools by default, so the account needs enough normal play to reach comparable matchmaking. Rapid account creation can also draw a fresh review and ruin the control, which is why one clean comparison is more useful than a stack of throwaway attempts.
Why a shadow ban happens when you did not cheat
A silent review can start from signals that are not proof of cheating. A burst of mass reporting, unusually strong performance, a sudden region change, two players sharing one connection, or a major hardware change can make an account look unusual enough for review. A VPN can contribute to a location mismatch, but it cannot change the machine underneath the traffic.
In Call of Duty and Warzone, the review state sits inside RICOCHET's enforcement and Activision's account process. Fortnite and Apex Legends use different publishers and anti-cheat paths, so a symptom copied from a Warzone thread is not automatically proof of the same restriction elsewhere.
A false positive is possible. So is a review that ends in permanent enforcement. The useful response is to preserve the clean account state, avoid the behaviour that produced reports or region churn, and let the publisher's status become the evidence instead of treating every difficult lobby as a conviction.
What an HWID ban is actually keyed to
An anti-cheat does not need a single magic serial. It can build a composite from the SMBIOS/BIOS serial, motherboard UUID or system UUID, RAM module serials, the drive's firmware serial, the filesystem volume serial (VolumeID), and every physical NIC's MAC address. Those values identify the machine at firmware, storage, and network layers.
Windows adds softer signals such as HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid. Newer enforcement stacks can also consider the TPM 2.0 endorsement key and Secure Boot state. The TPM key is rooted in the platform, while Secure Boot supplies a trust-state signal rather than an ordinary serial number.
The record is best understood as a set matched against a threshold. One changed member does not necessarily break the association when the motherboard, storage, and platform signals still agree. That explains why a new account changes nothing, why a new SSD may be insufficient, and why partial resets produce contradictory forum reports.
A Windows reinstall can regenerate MachineGuid and the volume serial, but it does not rewrite the SMBIOS/BIOS serial, motherboard UUID, drive firmware serial, NIC identity, or TPM endorsement key. You can check what your machine is currently reporting without assuming that a fresh desktop means a fresh hardware fingerprint.
Easy Anti-Cheat, BattlEye, and Riot Vanguard can collect the same machine signals wherever their components run. Publisher ban lists remain separately administered, so one ban does not automatically ban every title using the engine, but the reused fingerprint creates cross-title exposure. The separate guide to what actually triggers a hardware ban covers the detection-to-enforcement causes without turning this diagnosis into a causation article.
What to do in each case
For a shadow ban, stop changing variables. Leave the original account alone, avoid repeated logins through changing regions, and use the publisher's official appeal or status page. Do not create more accounts as a supposed fix; each new attempt adds noise and may create another review. The guide to how appeals really work explains what evidence helps and why an appeal should not promise a reversal.
For a confirmed HWID ban, be realistic. An appeal after an actual cheat detection almost never succeeds, and account changes do not alter the machine record. The practical recovery route is to change the identifiers that record matches, while accepting that no tool can restore a banned account or guarantee a publisher's decision.
TraceX Spoofer is the free, permanent option to rewrite the identifiers the record points at. TraceX rewrites the supported identifier set once; after the rewrite, you delete the tool. There is no daemon, background process, or per-session routine to keep running.
Diagnosis should come before any recovery action. Follow the recovery steps in order so you preserve account evidence, handle the appeal decision, and avoid paying for hardware that may not change the composite.
What fixes neither one
Several popular fixes change the wrong layer or too little of the machine profile. They can make the next test harder to interpret without clearing the restriction:
A VPN changes the public IP address and route. It does not touch the motherboard serial, disk serial, MAC address, MachineGuid, or an account review.
A fresh account is a diagnostic control, not a cure. It leaves the old account state and the machine fingerprint intact.
A new SSD changes one storage member of a larger set. The motherboard, SMBIOS, network adapter, TPM, and other drives remain available.
A Windows reinstall can replace operating-system identifiers and the volume serial. It does not replace firmware-level or motherboard-level identity.
Buying the game again changes entitlement, not enforcement scope. Do not spend money to repeat a test that the same account, machine, and network comparison can answer.
Use the read-out to make the decision. If the original account is under review and the clean account behaves normally, leave the hardware alone. If the clean account fails at the same early stage on two networks, treat the machine as the common factor. If only the connection changes the result, investigate the network layer instead.