A ban can arrive later
The software or activity was used.
A signal or review identified a possible violation.
The account was suspended or closed.
There can be a gap between using software, gathering evidence and receiving a ban. If an account is banned after an update, earlier activity, a continuing problem and another cause can all remain possible.
Why the dates matter
Blizzard describes batch bans and individual enforcement in WoW. Its post does not identify the technical causes of the incidents in this directory. [1]
Blizzard also explains, for StarCraft II, that ban waves can limit what cheat developers learn about detection. That explains the general timing issue; it does not establish a specific WoW delay. [2]
The cause labels, in plain English
Build exposure or leak
A copy of the software escaped its intended group, potentially exposing one build or code shared across several. Rebuilding alone cannot establish that the problem is fixed.
Details and limits
A build leak means a release, private download or source code reached someone outside its intended group. Knowing that a copy escaped still leaves the question of how accounts were identified.
The exposure might be limited to one build and a small group, or extend further through shared code. Finding the file does not establish how many accounts were exposed.
Rebuilding may change the exposed software, but it cannot clear earlier account flags or prove that the underlying problem has gone. A leak does not come with a one-wave limit.
Signature or file identification
A file or code pattern identifies the software; its reach depends on whether the pattern appears in one release or several.
Details and limits
A recognizable file or code pattern can identify the software, whether it belongs to one release or is shared by a family of builds.
What matters is the pattern the report identified. A changed filename or fresh download tells you little about whether that pattern is still present.
Unique builds, obfuscation and a claimed signature fix do not, on their own, establish that detection stopped.
Monitored bypass
A provider or researcher says a technique intended to get around a check became recognizable to the checker. That explanation needs evidence beyond the size of a ban wave.
Details and limits
When a provider or researcher describes a monitored bypass, they mean that a technique intended to get around a check became something the checker could recognize.
If the same weakness exists across releases, several builds or products could be affected. A useful explanation identifies the technique and versions involved.
A large or repeated wave is not enough to establish that explanation or show that every user was flagged, because the ban notice does not identify the mechanism.
Detection vector
This means the signal used to identify prohibited activity, so saying "a vector was triggered" is not much of an explanation unless someone identifies that signal.
Details and limits
A detection vector is the signal used to identify prohibited activity. That could be a file pattern, something observed in the client or activity seen by the server.
A report becomes useful when it names the signal, the affected builds or users, and the dates. Without those details, it is difficult to assess either the exposure or the claimed fix.
Identifying one suspected signal does not explain the whole detection system, and later bans may still have another cause.
Behavior or server-side evidence
Game actions or account activity may provide evidence without identifying the program, though attributing a ban to user behavior still requires proof.
Details and limits
Game actions, account activity and reviewed player reports may provide evidence even when the executable itself has not been identified.
An account may have used a bot, a rotation and an unlocker together. Its ban does not, by itself, tell us which part supplied the evidence.
Blaming user behavior requires evidence as well. An individual ban should not automatically become proof of technical detection, nor be dismissed as just a player report.
Unknown cause
The report has no established cause, which leaves a gap in the evidence rather than a clean record.
Details and limits
We have a report, but not enough evidence to establish its cause.
The date, edition and provider response are still worth recording, since later evidence may answer the questions left open.
An unknown cause does not erase the incident. It means leaving the explanation open until there is something better than a convenient story to support it.
One incident may fit several of these labels. File, memory and behavior checks are general security concepts; using those terms does not establish which checks WoW used. [3]
Small wave does not mean small risk
A leak might have a narrow scope, but calling it a leak does not tell us how narrow. Even a small, single wave leaves the question of whether the software is safe to use again unanswered.
What makes a fix claim useful?
- Identified problem
- The explanation should identify the product, edition, build, region and reported cause.
- Dated response
- The response should say what changed, when it shipped and which users the change covers.
- Follow-up evidence
- Follow-up reports should distinguish accounts first used after the fix from accounts already exposed before it.
A new download establishes that a release happened; whether detection stopped requires evidence about what happened after it.
Update speed needs a start and finish
To compare update speed, we need the time support broke and the time it returned for the same game version. A busy changelog shows activity, but cannot tell us how long users were unable to play.
How we label reports
Each profile links to the original report and, where available, the provider's reply. Privacy complaints and service closures are recorded for what they are, rather than counted as game detections. Equally, an empty incident list only describes the evidence we found; it cannot establish that nothing ever happened.
Original sources
- [1] Blizzard: Actions taken to address exploitative gameplay (WoW, 17 June 2020)
- [2] Blizzard: How we fight cheating in StarCraft II
- [3] Microsoft: Advanced technologies at the core of Defender Antivirus
Reviewed 12 September 2026. The definitions are our analysis. Sources support the general principles; each product profile cites its own incident evidence.