← All posts
1 min readmethodologynetworkresearch

Why Friend Ban Density Predicts Cheating Better Than K/D

We tested 8 detection engines on 3,000 Steam accounts. Ban rate among friends predicted cheating with 0.75 AUC. K/D and headshot % were near random. Here's why.

When we started CS2Scan, we assumed aim stats would carry the model. They didn't.

The experiment

We sampled ~3,000 accounts by crawling the Steam friend graph. We had ground truth for banned vs. clean from subsequent VAC/game ban acquisition. We scored eight families of signals independently.

Results:

  • Network (ban density in friends): ROC-AUC ~0.75
  • History: ~0.62
  • Opacity: ~0.58
  • Precision / Accuracy / Efficiency / Anomaly: ~0.51-0.55 — barely above coin flip

This is not a bug. It's how cheating spreads socially.

Why friend graphs work

Cheats are distributed in communities. People buy from the same provider, queue together, boost together, trade banned accounts. A clean player might have one banned friend from 2017. A cheater in a cheating circle will have 15 out of 60 friends with bans, many recent.

It's hard to fake a clean friend graph. It's easy to fake a 1.8 K/D.

You can build a clean-looking stat line by:

  • Toggling aimbot at 30% strength
  • Only wallhacking for info
  • Playing anti-eco carefully

You cannot easily build a friend list where everyone else is clean if you live in banned circles.

How CS2Scan calculates it

  1. Resolve the target's public friend list (up to 250 friends)
  2. For each friend, call GetPlayerBans
  3. Compute % with any VAC/game/economy ban, weighted by recency
  4. Compare to population baseline (~5-8% ban density is normal in active CS2 populations)

If the friend list is private, the engine returns N/A and drops out. We don't guess.

How to use this yourself

Even without CS2Scan, open 30 friends manually. If you see >25% banned, treat the account as high-risk regardless of stats. If you see <5%, a high HS% is far more likely to be legit skill.

This is also why new accounts are high Opacity risk — no history, no graph to check.


Read the full methodology: What CS2Scan actually measures