Minecraft anticheat guide

Ban Evasion and Alt Accounts on Minecraft Servers

How to spot Minecraft ban evasion and alt accounts, which signals are weak, and how to avoid punishing players who share a home network or connection.

What counts as ban evasion?

Ban evasion is a banned player returning on another account or connection to keep playing. An alt account is any second account a player owns, and it is not always evasion. Handle the two separately. A second account is a rule question. Using it to avoid a ban is an enforcement question, and it needs stronger evidence.

Which signals help, and how weak are they?

No single signal proves that two accounts belong to the same person. Use the table to decide how much weight each one can carry in a case.

Common alt signals and their limits
SignalWhat it may suggestLimit
Same IP address at loginSame device or home networkSchools, mobile carriers, VPNs, and shared networks put many people on one address
Account created shortly after a banA replacement accountNew players join all the time, so timing alone is not evidence
Same play pattern or schedulePossibly the same personSubjective, easy to imitate, and needs a trained reviewer
Shared friends or similar namesA social linkWeak on its own, common in small communities
Linked Bedrock and Java identityPossibly one person across editionsDepends on how your proxy and linking tools present identities

How do you review a suspected alt?

Use one case note for every review, and write down each signal before you decide anything. Work through the steps in order.

Placeholder case note
Case: <CASE ID>
Accounts: <BANNED NAME> (<UUID>), <SUSPECT NAME> (<UUID>)
Signals: <ONE PER LINE, WITH THE DATE SEEN>
Discounted signals: <WHICH ONES, AND WHY>
Decision: <ACTION>, reviewed by <STAFF NAME>

How should you treat players who share a connection?

Households, schools, and mobile carriers often share an address. A player whose sibling was banned should not lose access on the address alone. Require account-level evidence before a punishment that is based on a shared address, and record why you chose the action you did.

Should you use IP bans?

An IP ban blocks an address, not a person, so it can also block innocent players. If you use IP bans, give them an expiry date, and check the list whenever a player appeals. Keep the number of IP bans small enough that staff can review each one.

How do you explain an alt decision to the player?

Tell the player which account was punished, which category of rule applied, and what the next step is. Do not list every signal in the case note, because that exposes your methods and can point a player at a shared address that belongs to someone else.

If the decision rests on account-level evidence, say that it does. If the case was closed because the signals did not hold, say that too. A short, specific answer is easier to accept than a vague one, and it gives staff a fixed reply to reuse.

When should you stop looking for alts?

Set a limit for each case. Once you have checked the banned account's evidence, the signals, and any independent activity, decide and close the case. Open-ended searches for a player's other accounts take staff time and spread suspicion across players who did nothing wrong.

Reopen a case only when new evidence arrives, such as a verified report with a specific account and timestamp. Note the reopening reason in the case file, so the history stays readable for the next reviewer.

What should a staff ban note contain?

A useful note records what was seen, when, and by whom, and it separates observations from conclusions. Write 'two accounts logged in from the same address on these dates' rather than 'alt confirmed'. The second form cannot be checked by the next reviewer, and it is the first thing a player will dispute.

What have we not verified?

This article does not describe how any specific plugin, proxy, or linking tool records identities or addresses. Check those details in your own setup and logs. A match between two accounts is a lead for review, not proof.

FAQ

Is a matching IP address enough for a ban?

Usually not. Treat the match as a lead, then look for account-level evidence before a permanent action.

How should we handle a Bedrock account that may belong to a banned Java player?

Floodgate identifies Bedrock players, according to its wiki. Check how your setup shows those identities in logs before you compare them with Java accounts, and treat any match as a lead that needs review.

What should we tell an appellant who says a sibling uses the same network?

Explain the decision in terms of evidence on the account, not the shared address. Ask for specific information about the appellant's play, and say what the review will check.

Should we publish the names of alt-account bans?

No. Publish the rule and the outcome category instead. Names invite harassment, and a public name makes an appeal harder to handle fairly.

Related sources and official pages

Browse all anticheat guides