Riot Games and the Anti-Boost Machine: 296,416 Accounts, Four Penalty Tiers, and the Loopholes Left Unpatched

Last March, while reviewing data on the game-account market across the Asia-Pacific region, I came across a figure in a Riot Games document: 296,416. That is the number of accounts the company's Anti-Boost system flagged for rank manipulation across both VALORANT and League of Legends. I paused for a while over that number, not because of its size, but because of how it was placed into the story.

Across 23 years of watching the industry, I have drawn one non-negotiable rule: a number with no denominator, no comparison period and no third-party verification always tells you more about who published it than about the issue being published. Anti-Boost is a system worth dissecting. But the data layer around it suffers from exactly the disease I once had.

Context: a system that operates on a different layer

Anti-Boost must be placed in its proper operating context. Riot Games runs its two biggest titles — VALORANT, a first-person tactical shooter, and League of Legends, a multiplayer online battle arena — on a single philosophy: the company owns the entire chain, from production and publishing to server operation and the professional competitive system. Unlike many publishers that separate these stages or hand them to third parties, Riot controls end to end.

Because of that end-to-end control, Riot can deploy a system like Anti-Boost at the account and behavioural layer, not merely at the game-balance layer. This is the first core point: Anti-Boost does not touch champion or weapon strength, does not adjust maps or cooldown speeds. It operates on another layer — the ranked ladder, where millions of amateur players climb every day.

And on that layer, the system must face a grey economy running in parallel with the game. Boosting is the term for a high-skill player logging into someone else's account to play ranked matches on their behalf, helping the owner climb. It is a purely commercial transaction: the buyer pays money, the seller supplies skill. Beside it sits a sub-ecosystem of account buying, selling and transferring, intentional deranking to face easier matches, and smurf-assisted climbing. Together these form what Riot calls rank manipulation.

I once tracked a similar case in another title a few years ago. I tried to reconstruct the path of a suspected boosting account using public data: match history, win rate by time slot, speed of climbing. My model correctly predicted the account owner but wrongly predicted the timing of enforcement. I realised that in closed moderation systems, public data only shows the visible part. That mistake taught me that data never lies, only the reading of it is wrong.

The Anti-Boost machine: four penalty tiers and a joint-liability model

What caught my attention in Anti-Boost was not the number but the structure of punishment. Riot built a four-tier ladder, and each tier reflects a different level of intent.

The first tier applies to accounts found manipulating rank: ranked points and rewards earned from cheating are cancelled, the account is returned to its pre-manipulation rank, and a temporary suspension follows. This is a rollback mechanism rather than pure punishment. In design terms, it concedes a reality: detection is not instant, so there is always a lag between manipulation and enforcement.

The second tier applies to repeat offenders. Ban duration increases with each violation. This detail matters more than it appears. An escalation rule only exists when a recidivism rate large enough to matter exists. If every violation were a one-off, a publisher would not need an escalating ladder. Riot including it in the report is an indirect signal of repeated behaviour in the community.

The third tier is the heaviest: buying, selling or transferring accounts, and intentional deranking, can lead to a permanent ban. This is the line Riot draws between an offence that can be corrected and one that destroys the market. Boosting ruins the experience of other players in individual matches. But account trading ruins the economic foundation of the ladder itself, because it turns rank from a measure of skill into a tradable commodity.

The fourth tier is the most controversial in system design. Riot extends enforcement beyond the manipulated account: the booster's main account, and even teammates who frequently queue with them, may also be actioned. This is a joint-liability model. Logically, it targets organised boosting groups where one high-skill player carries a set of accounts. Operationally, it creates a new risk zone that I will dissect later.

The hidden boundary: what is NOT actioned

One of the most overlooked details in coverage of Anti-Boost is the safe harbour Riot deliberately carves out. The company states clearly that self-created and self-operated alt accounts are normal activity. Anti-Boost targets the intent to manipulate rank, not the existence of alt accounts per se.

This is an intent-based standard, very different from bright-line rules of the banned-or-not type. It is more nuanced and fairer to honest players, but also harder to enforce transparently. A bright-line rule can be explained in one sentence. An intent-based standard needs a great deal of behavioural evidence to convince the community that a ruling is correct.

I have seen this kind of dispute in an entirely different field. The cancelled Seoul derby of 2026 was a test for every prediction algorithm, and it was also a lesson in how automated systems ruling on indirect signals can go wrong. When input data is disturbed by an anomalous event — a cancelled match, an interrupted season — the model still runs, still produces output, but that output no longer reflects reality. Anti-boost systems face the same risk: they rule on behavioural patterns, and behavioural patterns can be disturbed by entirely legitimate reasons.

The data problem: a total, not a trend

Back to 296,416. The report presents it as a cumulative total of accounts actioned across VALORANT and League of Legends. To be clear: this is a total, not a trend. The two differ fundamentally in statistical nature.

A trend requires at least two data points measured over comparable periods. If Riot announced it actioned more this year than last, that would be a trend. If it announces a total with no comparison period, then the claim that enforcement is tightening is an inference by the writer, not a statement by the data.

This is the exact error I made at 30, writing about the 2026 World Cup qualifiers. I used expected goals and progressive passes to argue South Korea should play possession instead of counter-attacking. I read the data correctly within a narrow window and concluded wrongly within a broader context. The lesson was not that the metric was wrong. The lesson was that I never asked what my denominator was.

There is a second, more systemic data problem. The 296,416 figure pools two titles with significantly different economies. VALORANT is a shooter where rank carries high symbolic value and the community is smaller with denser skill. League of Legends is a battle arena where boosting demand is tied to seasonal ladder pressure and the grassroots competitive system. Pooling both into a single number works well for communications, but hides the distinct boosting dynamics of each title.

The contrarian angle: joint liability can manufacture offenders from innocents

This is where I want to spend the most time, because it is the biggest blind spot in Anti-Boost's design.

The joint-liability model looks sensible on paper. If a booster carries a group of accounts up the ladder, actioning the whole group removes the incentive to organise. But that model assumes everyone queuing with a boosting account knows they are queuing with a boosting account. That assumption does not hold in every case.

Picture an ordinary amateur player who plays a few matches a week with the same group of friends. If one member of that group quietly pays for a boosting service, or logs in on an account someone else plays, the other friends can fall into the enforcement net without knowing. The report describes no specific pairing threshold — how many matches together counts as frequent, over what period, at what rank bracket. It also describes no independent appeals mechanism for those wrongly penalised.

In essence, this is a trade-off between coverage and precision. To catch organised boosting groups, the system must widen its scope; widening scope raises the risk of false positives. The question is not whether false positives exist, but at what rate the community can tolerate them. The report provides no such figure.

There is a deeper problem in the intent standard itself. When a system rules on behavioural patterns rather than direct proof of account ownership, false-positive risk is not a minor possibility but a structural property. A skilled player climbing fast, playing many hours with a high win rate, can look statistically like a boosted account. In some cases, the only difference between an excellent player and a boosted account lies in information only the publisher can see. That places the entire burden of trust on the party that detects, adjudicates and publishes results.

Riot controls not only detection but adjudication. The report mentions no independent appeals body. Governance authority is concentrated entirely in the publisher's hands. To some, this proves effectiveness. To me, it is a design feature that should be named accurately, because the legitimacy of a ruling system depends on the ability to check it from outside.

The grey economy: where the real front line lies

Strip away the communications layer and look straight at the mechanism, and Anti-Boost's real front line lies in the grey economy around the ladder.

Boosting is a market. Skill providers sell their time. Buyers pay for a rank they cannot climb to on their own. In between sits a chain of account transactions — buying, selling, transferring — and sometimes profit flows adjacent to betting markets. The story here is the gap between the published value of a rank and its real competitive value. A Diamond account on paper may be worth a few dozen dollars in trade. Its true value as a skill signal can be zero.

Riot applying permanent bans to account trading and intentional deranking directly attacks the supply side of the transaction chain. In theory, hitting supply raises the expected cost for both buyer and seller, pulling demand down. But the report offers no figures on recidivism, market size, or decline after enforcement waves. Without numbers, any conclusion on economic effect is speculation.

There is one notable signal the report indirectly concedes. Riot says it will keep scaling Anti-Boost and is developing match-level detection of boosting signs. A publisher admitting it is improving detection methods is an indirect confession that current methods are not good enough. In an arms race between detection and boosters, adaptation speed usually favours the offender, who only needs to find one gap, while the system must close every gap.

Buyers and sellers: two tiers of unequal responsibility

One thing I always watch in penalty systems is how responsibility is distributed. In boosting there are two sides: the seller of skill and the buyer of rank. Morally, both take part in the same transaction. In enforcement, Riot appears to focus more on the act of manipulation than on the commercial relationship.

This has design meaning. Manipulation leaves clear technical traces: login addresses, devices, in-match behaviour patterns. The commercial relationship happens outside the system and is harder to prove. In that situation, the system tends to act on what it sees rather than what it infers. That is a reasonable operational choice, but not necessarily an optimal deterrent. If only the seller side carries high risk, demand remains intact, and demand will always find new supply.

I have worked with brokers in the sports industry, and I learned a structural lesson. The transfer market is not wrong; it simply reflects a truth you have not yet seen. The same applies to the boosting market: it exists because a real gap exists between rank and player satisfaction. Punishing the seller without understanding that gap treats the symptom, not the cause.

The biggest risk is not boosting

If I had to rank the risks in this ecosystem, I would put detection-evasion asymmetry first. But the most dangerous risk is trust risk.

A ruling system with no independent appeal, an intent standard that is hard to make transparent, the ability to penalise those who queue with offenders, and self-reported data with no independent audit — that is a combination that can lose trust very quickly. One high-profile false positive could flip the entire crackdown narrative into a wrongful-punishment story. In industry media, such a story carries far more destructive power than a successful enforcement report.

The issue is not whether Riot acts. It acts, and at scale. The issue is that the way the data is presented does not allow outside readers to verify success. A total with no denominator, a trend with no comparison period, an adjudicating system with no independent check. Together these create a transparency gap that both the publisher and the community must live with.

If my model is right, this risk will become clearer over the next one or two reporting cycles. What to watch is not the new number, but the appearance of an appeals mechanism, a published pairing threshold, or a high-profile false-positive case. Any of those three would transform the story from a technical report into a governance dispute.

Takeaway: signal for the next cycle

Anti-Boost shows Riot investing in an asset few bother to count: the legitimacy of the ladder. Rank is not just a number on a player profile. It is an input to amateur scouting, to grassroots competition, and to the belief that skill is measured correctly. A ladder inflated by money corrupts that signal at the root.

What I wait for in the next reporting cycle is not a bigger number. I wait for a denominator. I wait for a published threshold. I wait for an appeals mechanism. And if those do not appear, their absence is itself data — data on how much the publisher believes in centralised authority, and on the limits of the trust it expects back from the player community.