GUIDE · SERVER DEFENCE
How to stop ban evaders on a FiveM server
Banning a player closes an account, not a door. The real work is recognising them when they come back. This guide covers why evasion works, which identifiers are expensive to replace, and where the defence has to sit.
Why a ban does not hold
A ban closes the account in front of you. The player opens another one, changes their name and walks back in. Nothing on your server can tell the difference: the new account looks clean because it is clean.
Evasion is cheap, and that is why it is common. A FiveM account and a new display name cost minutes. So the decision matters less than the moment it is applied: an evader who is not caught at connect time can stay for months.
What an evader has to reuse
A player changes their name and their Discord account without effort. What they cannot cheaply change is the game account and the device behind it. The whole defence rests on that asymmetry.
- license / license2 — bound to the game account. A new one is a real cost, and most evaders will not pay it.
- steam — an account trail for anyone launching through Steam. A fresh Steam account costs money and time too.
- fivem identifier — a FiveM account trail that repeats even when the in-game account changes.
- Discord ID — easily replaced, but most players will not abandon their community, which is what makes it a catch point.
- Display name — costs nothing. It cannot carry the defence.
Put the defence at connect time
Decide while the player connects and evasion fails. Decide after they are inside and you are only limiting damage. The check therefore has to run as the player joins, not during a manual review afterwards.
Argos Guard compares a connecting player’s identifiers against cross-server ban records and turns a match into a decision at your own threshold. Argos Sentry runs the same check on the Discord side, as a member joins. Together they close both doors: the game server and the community.
Separate hard evidence from signal
Automatic action should rest on identifier matches only. A name similarity, or having appeared in a shared server, is not enough to kick or ban automatically — that is the fastest way to lose legitimate players.
The right shape is this: identifier matches run as a hard rule, name similarities go to a review queue. The evader does not slip through, and you can still justify every decision you made.
Make the wrong decision reversible
Every automated system gets things wrong. So the appeal path has to be open: the player should be able to learn why they were rejected, and the decision should be reviewable.
Argos Guard and Sentry can hand a rejected player an appeal link; approving the appeal adds them to an allowlist so they are never blocked for the same reason twice. That loop protects your reputation and removes the cost of the false positive in one move.
The evasion patterns you will actually see
Evasion is rarely clever. It is one of four patterns, and each leaves a different trace — which decides which identifier catches it.
- New Discord account, same game account — by far the most common. The display name and avatar change, the licence does not. A licence or Steam match catches this immediately.
- New game account, same Discord — the player buys or creates a fresh FiveM account but keeps the Discord they actually use. The Discord identifier catches this one.
- Both replaced, same community — a genuinely new pair of accounts that reappears in the same servers, with the same friends, at the same hours. No hard identifier links them, so this is a link-signal case: overlapping servers and account age, reviewed by a person.
- A purchased or shared account — the identifier belongs to somebody else entirely. This is the hardest case and the one where a single match can be a false positive; it is why account age and membership history are read alongside the record.
What to do in the hour after a ban
Most evaders return fast — often within minutes, sometimes with the same client still open. The useful work happens in that window, and it is almost all preparation rather than reaction.
Before it happens: make sure the identifiers of every ban you issue are stored in a form you can match against, not just a name in a channel. A ban recorded as a name is a ban that will not hold, because the name is the one thing the player controls.
When it happens: compare the arriving player’s identifiers against your own records first, then against shared records. A licence or Steam match is grounds to act immediately. Anything less goes to review rather than to a kick — an automatic action on a soft signal is how a server loses honest players.
After it happens: write down which signal caught them. Over a few weeks that log tells you which layer is actually doing the work on your server, and that is the only honest basis for deciding where to spend effort next.
Frequently asked questions
Can ban evasion be stopped completely?
No. A player arriving with a brand-new game account, a fresh Steam account and an untouched device may be genuinely unrecognisable. The goal is to make evasion expensive and risky rather than impossible.
Does banning by IP work?
It is a weak method: IPs are shared, reassigned, and on mobile connections they change constantly. Because it hits innocent players too, most server owners keep IP bans as a secondary signal at best.
What is the fastest way to detect evading accounts?
Compare identifiers that appear in ban records against each player as they arrive. A license or Steam match is hard evidence; a name similarity is only a signal to review.
What happens if an automatic ban catches the wrong person?
There has to be an appeal path. On the Argos side, approving an appeal adds the player to an allowlist so they are not blocked repeatedly, and the mistake is paid for once.
What should I do about a banned player with no cheat record?
Read the reason on the record. Communities ban for harassment, advertising and staff disputes as well as cheating, and the type of record should decide the action you take.
Is there a ban evasion script for FiveM?
Scripts that work on your own server data can be written, and they do three things: match identifiers against your own ban table, link accounts arriving from the same device or network, and watch the behaviour of freshly created accounts. None of them can see a player’s history on OTHER servers — Cfx.re does not forward one server’s ban to another. That needs a data source that shares archives, or a layer that runs at connect time.
How do I stop ban evaders on my FiveM server?
Put the check where the player arrives rather than where you find out: compare the identifiers they present at connect time against your own ban records and against shared cross-server records. A licence or Steam match should block automatically; a name similarity should go to a person. Then keep an appeal path open, because an automatic system that cannot be corrected will eventually reject someone honest.
Why do banned players come back so fast?
Because the two things a returning player needs are cheap: a new Discord account takes seconds, and a new game account is purchasable. What is not cheap is the licence their game account carries — which is exactly why it is the identifier worth matching on, and why a ban recorded only as a display name will not hold.
Should I ban evaders automatically?
Yes on hard evidence, no on soft signals. An identifier match — the same licence, Steam or Discord id already on a record — is grounds for an automatic action. A name similarity, an overlapping server, or a young account is grounds for a review queue. Automating the second group is the fastest way to ban honest players.
Does a whitelist stop ban evasion?
It raises the cost but does not stop it. A whitelist is a decision made once, at the door; an evader arriving with fresh accounts passes a poorly-specified whitelist as easily as anyone else. The two work together: the whitelist decides who is welcome, and a connect-time identifier check is what makes the decision hold after a ban.