Nearly 300,000 League of Legends and VALORANT accounts locked for ranked cheating: big number, but the real issue is identity verification

The figure of nearly 300,000 accounts locked for ranked cheating does not belong to a balance patch, nor to a match result. It belongs to Riot Games' platform enforcement report. Since Vanguard was integrated into League of Legends in September 2026, after already running in VALORANT, Riot has locked nearly 300,000 accounts across both titles for manipulating the ranked system. The company also announced plans to tighten identity verification with MFA, TPM 2.0 and hardware authentication. The number 300,000 easily creates the feeling of a sweeping crackdown. But a data analyst sees a different story: the cost of creating new accounts, the boundary between main and alt accounts, and the gray zone of so-called 'hitchhiking.' Every great spreadsheet begins with an empty cell and a question. Vanguard is a kernel-level anti-cheat system developed by Riot for VALORANT before expanding to League of Legends. This integration is not a balance change. It changes how the client behaves on user machines, and it marks Riot's shift from defending against software cheats to controlling ranked behavior. The company says the goal is to improve player experience and reduce negative effects. The original article classifies sanctioned behavior into three groups. First, boosting: a high-skilled player logs into another person's account to raise the rank. This is a common gray-market service. Riot may lock not only the boosted account but also the booster's main and alt accounts if the offense is repeated. Second, 'hitchhikers': players who use their own accounts but queue with an account being boosted. Riot states that this group may have ranked points deducted even if they did not violate software rules. This is the most procedurally contested point. Third, smurfing: playing on a secondary account at a lower rank than true skill. Riot does not automatically treat smurfing as cheating. It lists eight legitimate use cases, including protecting the highest achievement on the main account and using practice accounts. The enforcement boundary is intent-based and behavioral, not account-count-based. Another notable detail is LP-loss protection. When a ranked game includes a detected cheater or leaver, the remaining players may not lose LP. In theory, this reduces luck in ranked progression and makes LP a more accurate skill signal. But real value depends on how the system detects leavers and cheaters. The most important part of the announcement lies in the future. Riot plans to implement multi-factor authentication MFA, the TPM 2.0 hardware security standard, and device-level hardware authentication. Requirements may vary by rank. The stated goal is to make one-time accounts harder to create, raising the cost for offenders. If fully implemented, this fundamentally changes account economics: a new account is no longer a one-time email address, but a physical device with a traceable footprint. The impact is not limited to hackers. It extends to the entire ecosystem of alt accounts, bought accounts and borrowed accounts. Based on my experience following matches and ranked fluctuations, changes like this usually create a quiet period before the gray market finds a workaround. It resembles a confession: the spreadsheet can detect cheating, but it cannot remove demand. Approximately 120 million League of Legends players and 20 million VALORANT players monthly, according to estimates in the original article, bring the total to about 140 million. Dividing 300,000 by 140 million gives a lock rate of only about 0.2%. In other words, the absolute number sounds large, but the prevalence of ranked cheating, according to the published figures themselves, is relatively small. More importantly, these figures are not sourced independently. Error does not lie; it merely whispers what we are not yet big enough to hear. For teams and academies, the ranked ladder has long been a scouting channel. Boosting erodes the reliability of that signal. When a high-rank account can be the product of a paid climb service, points become noise rather than signal. If this sweep truly cleans the top of the ladder, scouts may start trusting ranks again. But that only holds if enforcement is consistent across all servers. In practice, enforcement intensity may differ by region. If one server tightens while another loosens, the boosting market will migrate to the easier environment, and scouting signal quality will diverge by server. Data never works in a vacuum. From a business perspective, this campaign is platform-protection cost, not revenue. Riot sells nothing by locking accounts; it invests in retention. In a free-to-play model, players who are cheated against and lose their sense of fairness will leave the game. Therefore, the investment in Vanguard, MFA and hardware authentication is really a retention cost. This is economically rational, but it does not remove the privacy question. Kernel-level anti-cheat and hardware-bound accounts are two large leaps in system access. History shows that kernel anti-cheat always triggers controversy, yet the original article barely mentions this downside. The biggest omission of the announcement is not the number, but the process. There is no false-positive rate, no appeal channel, no independent audit. With nearly 300,000 accounts, even a 1% error rate means 3,000 players wrongly affected. The 'hitchhiker' doctrine increases this risk, because it is not based on whether the player installed cheating software, but on being in a queue with an offender. Riot may say they only revoke LP rather than permanently ban, but LP is a skill asset, and revoking it is still a form of judgment. Without a feedback mechanism, players will gradually lose trust in the very tool meant to protect them. The contrarian view is that 300,000 accounts are not the biggest story. The biggest story is enforcement design. First, the 'hitchhiker' doctrine extends liability to third parties: a player using a valid account, violating no software rule, can still lose LP merely for queuing with a flagged account. Riot discloses no false-positive rate, no appeal process, and no independent verification of 300,000. In a governance model where Riot is rule-maker, police, data publisher and commercial beneficiary of retention, this transparency gap is the real risk. Second, hardware authentication and rank-tiered requirements create a two-tier player model. Players with modern personal computers, TPM 2.0 and managed accounts will face fewer obstacles; players using internet cafés, shared machines or weak devices may be left behind. This fairness question is unanswered. Third, the boosting market will not disappear. It will simply reprice. When supply is squeezed, service prices rise, and buyers still pay because demand for high rank, rewards and prestige does not change. In other words, enforcement targets supply but ignores demand. Riot's smurfing policy may also disappoint players who expected a blanket ban. Riot deliberately leaves a safe zone for alt accounts, so the gap between community narrative and policy text will continue to grow. For professional and semi-professional players, the boundary is even more fragile. Practice accounts are protected, but if such an account once queued with a flagged account, risk remains. Clubs should standardize account declaration and duo-queue hygiene to avoid reputational risk. What needs tracking is not the 300,000 number, but the next publication cadence. If Riot releases data periodically with trend lines and title-level breakdowns, esports will gain a new integrity-reporting standard. If not, this is only a single release. Today's shock may be just one data point in a long spreadsheet. Read it as an opening, not a conclusion. A shock is only data that history has not yet learned to name.