Nearly 300,000 Accounts Locked: The Fine Print in Riot's Policy Is the Real Story

In Riot Games' announcement about actioning nearly 300,000 League of Legends and VALORANT accounts, most readers stop at the headline. Deep in the policy description sits a clause that had not appeared in any prior document from the publisher: a player using their own account, clicking their own mouse, climbing under their own steam, can still have ranked points revoked if the person queuing alongside them happens to be sitting on a boosted account. Riot calls this group "hitchhikers."

I read that clause four times. The first time, I thought it was a sensible anti-circumvention rule. The second time, I thought of two roommates queuing together at two in the morning. The third time, I thought of scouting departments using the ladder as their entry filter. The fourth time, I understood that 300,000 locked accounts are only the visible layer.

People say I object just to be noticed; I simply see one step ahead.

The ranked ladder is an admissions cycle with no invigilator

Ask an academy scout where they find talent and the most common answer is solo/duo queue at Challenger and Grandmaster. The ladder is not a tournament. It has no referees, no competition rules, no registration list, no one checking documents. Yet it is the first filter for the entire professional development system — in Korea, in Vietnam, in Europe, in North America.

Boosting breaks that filter at its most sensitive point. A Challenger account does not necessarily belong to the person behind the keyboard. A buyer purchases a rank, and that rank becomes a line on a scouting file. While working with ranked data in Seoul, I examined profiles with a 68% win rate at Grandmaster whose per-minute impact metrics sat at Platinum average. Those profiles usually did not belong to bad players. They belonged to shared accounts.

Riot calls this "ranked manipulation." The definition covers boosting, intentional deranking, and behaviour that distorts the ladder's accuracy. This is the first time the publisher has disclosed an enforcement figure of this scale across both titles at once.

The timeline matters: Vanguard, the kernel-level anti-cheat that previously ran only for VALORANT, was integrated into the League of Legends client in September 2026. That means the near-300,000 figure is not the product of years. It is a cumulative tally of roughly one quarter, possibly less. When I scrutinise a policy boundary, I usually find a mistake laid years earlier — but this time the laying was faster than the reading.

Three anchors and a denominator with no source

Anchor one is the roughly 300,000 accounts actioned. Anchor two is September 2026. Anchor three is the 0.2% ratio, derived by dividing 300,000 by an estimated 140 million monthly players — about 120 million for League of Legends and about 20 million for VALORANT.

Two of those three anchors have no independent source.

The 120 million and 20 million estimates are attributed to no organisation. They appear as "estimates show" and "said to be." When a ratio is built on a denominator with no source, the ratio is not evidence. It is a division.

The second problem is geographic scope. League of Legends and VALORANT in mainland China run inside Tencent's ecosystem, with separate anti-cheat and account-verification infrastructure. Whether the 300,000 includes Chinese servers is not stated. If the numerator excludes China while the denominator includes it, the 0.2% is artificially depressed. If the reverse, it is inflated. Neither possibility has been tested.

The remaining anchor — 300,000 — comes from the enforcing party itself. There is no independent audit, no third-party cross-check, no breakdown by title, no breakdown by server, no trend line against a prior period. In this industry I have learned one rule: when the rule-maker also publishes the compliance data, that data has directional value, not audit value.

That is the raw-data layer. The next layer is where the argument lives.

Riot has drawn itself a blurred smurf boundary

In the same announcement, Riot states clearly that smurfing — playing on a secondary account below one's true skill level — is not automatically cheating. The publisher enumerates legitimate use cases, including a player wanting to protect their highest achievement on their main account. Riot Games spokesperson Phillip "mirageofpenguins" Koskinas is directly quoted on the smurfing question.

This is the most skimmed detail, and the most important detail in the entire policy design.

If smurfing is not automatically cheating, the line between a legitimate player and a violator does not sit at account count. It sits at intent and behaviour. In other words, Riot has taken on the job of adjudicating something inherently ambiguous: the same action, on the same secondary account, can be legitimate or a violation depending on purpose. In legal enforcement, that is the hardest type of rule to apply consistently, because it demands evidence of intent rather than evidence of conduct.

The gap between community expectation and policy reality sits exactly here. A large share of ranked players expect a blanket crackdown on secondary accounts. Riot publicly protects a set of secondary-account cases. In the short term, that decision is operationally sound. In the medium term, it creates a grey zone that both players and customer support will fight over.

Hardware attestation and the internet-café problem

The most structurally significant part of the announcement is not the ban count. It is the forward-looking preparation: multi-factor authentication, TPM 2.0 requirements, hardware-level verification, and the possibility of rank-differentiated requirements. The stated goal is to make "one-time" accounts harder to create.

That is a change at the level of philosophy, not features.

The entire history of online gaming runs on the assumption that account identity is cheap and reproducible. You get banned, you make a new one in three minutes. The only investment lost is climbing time. When an account is bound to a security chip on a motherboard, the cost of reproduction stops being three minutes. It becomes hardware cost. That is a measurable barrier.

But every barrier has two sides, and the second side is being ignored in the entire discussion.

In Korea, a substantial share of League of Legends playtime happens inside PC bangs. In Vietnam, the equivalent share belongs to internet cafés. Players there do not own the machine. They sit down at a shared terminal, log in, play, and leave. When account identity is bound to hardware, this group faces a problem it did not create: the computer belongs to someone else, and the hardware was not their choice.

One question nobody has asked: if hardware verification applies at high ranks, how does an internet-café player climb to those ranks? Riot's announcement offers no answer. In Seoul I have followed school-level and club-level tournaments held entirely inside PC bangs. Those events feed part of the region's young talent pool. A hardware-verification policy designed carelessly could close that path for people who cannot afford a personal machine.

There is another layer the announcement omits: TPM 2.0 is not a universal standard. Motherboards manufactured before a certain point often lack the chip, or have it disabled at the firmware level. Binding identity to a hardware standard that is absent from a portion of machines currently running the game means shifting part of the anti-cheat cost onto legitimate low-spec players.

That is a design choice. It may be the right one. But it should be stated, not discovered.

One publisher holding all four roles

Historically, every sports governance model has tried to separate four functions: the rule-maker, the enforcer, the data provider, and the beneficiary of enforcement. Traditional sport separates them for an obvious reason: if one body holds all four, no cross-check remains except public opinion.

In esports broadly, and at Riot specifically, all four sit in the same department.

Riot writes the terms of service, ships the kernel-level anti-cheat, publishes the data on that anti-cheat's effectiveness, and benefits directly when churn caused by cheating falls. There is no independent arbitration body. There is no external appeals mechanism. When you are classified as a hitchhiker and lose ranked points, the body receiving your appeal is the body that classified you.

I am not arguing motive. I am describing structure, and structure decides outcomes over time. In a system without independent audit, the false-positive rate will never be published, because no one is responsible for measuring it. That holds for any organisation, not just a game company.

In traditional sport, when an athlete is found to have violated anti-doping rules, they can take the case to the Court of Arbitration for Sport. That mechanism exists precisely because federations cannot adjudicate cases they themselves bring. Esports has no equivalent. The 300,000-account enforcement action is a good moment to note that the gap is still there.

The economics of boosting: prohibition raises prices, not demand

There is an analytical layer the publisher's announcement cannot reach, because it is economic rather than technical.

Demand for boosting comes from rank badges, end-of-season rewards, streaming credibility, and ego. None of those four disappear when an account is locked. They move to the next account.

Where does the supply come from? From highly skilled players with low incomes. In esports development systems, that is the tier-two and tier-three population — people who passed through academies, competed in lower divisions, and currently hold no contract that pays a living. For this group, boosting is not a game. It is a revenue line. The same individual can be both a victim of the low-wage structure below and a supplier to the grey market above.

When a regulator raises the risk cost of an activity, it does not eliminate the activity. It makes it more expensive. In grey markets, the standard outcome of tightening supply is higher prices, higher margins for remaining operators, and demand shifting toward lower-enforcement venues. I have tracked this pattern in the East Asian account and item markets for years, and it repeats fairly reliably.

Notably, Riot frames hardware-level verification as an anti-recidivism measure. Technically, it is the strongest item on the list. Economically, it is also the only measure capable of touching the boosting market's cost structure.

But it does not touch the demand structure. And it does not touch the reason supply exists.

The scouting pipeline and server-level divergence risk

If this enforcement round genuinely cleans the top of the ladder, the most important consequence is not the casual player experience. It is the quality of the scouting signal.

The ladder is the input to every talent filter. If a share of Challenger accounts do not belong to the players behind them, every scouting list built on that data is wrong by an unknown margin. This enforcement round could raise the reliability of a tool the whole industry uses for free and trusts by default.

But that benefit is unevenly distributed.

Differing enforcement intensity across servers creates what I call integrity arbitrage. If one region verifies more loosely, boosting supply migrates there. The result is divergence in scouting-signal quality between regions, and academies in lower-enforcement regions pay for it with their own data.

This is why I think scouting departments should start reducing the weight of raw rank and increasing the weight of controlled competitive evidence — scrims, youth tournaments, regional leagues. That is an expensive change. It is cheaper than signing an account.

Where I could be wrong

Three points could break my argument.

First, if Riot does operate an appeals process with published evidentiary standards and discloses its false-positive rate, the procedural risk I describe is far lower than my assessment. My concern would then be a communications issue, not a structural one. I have no evidence the process does not exist. I have evidence it was not described.

Second, if boosted accounts cluster extremely heavily at high ranks, the 0.2%-of-all-players ratio understates real impact. Three hundred thousand accounts out of 140 million is a small share. Three hundred thousand accounts out of a few hundred thousand global Challenger and Grandmaster players is an entirely different share. I have no rank-distribution data to test this hypothesis, and this is precisely the point I would like to be proven wrong about.

Third, if boosting prices rise over the next six months, I may have misread the signal. I treat rising prices as evidence the market has not disappeared. There is another reading: rising prices are evidence that risk cost has risen, and if prices rise high enough, some demand withdraws. Both readings survive contact with the same data.

The final item on my list of possible errors is geographic scope. If the 300,000 figure is global and includes the Chinese ecosystem, real coverage is higher than my estimate. If it excludes China, coverage is lower. The announcement gives me no way to separate the two.

What to watch

If you want to know what this enforcement round truly changed, stop watching the ban count. It is a cumulative number and means nothing without a comparison trend line.

Watch three other things. One: the cadence of Riot's enforcement-data disclosure — once is a press release, periodically is a standard. Two: the actual deployment date of MFA and TPM 2.0, and whether carve-outs exist for shared devices. Three: the existence of any document describing the appeals process and the evidentiary standard for classifying a hitchhiker.

If all three appear within six to twelve months, my argument weakens considerably. If none appear, the 300,000-account enforcement round will be remembered as a press release, not a reform.

The smallest detail in a terms-of-service page usually says the largest thing. This time, the smallest detail is a noun: hitchhiker. Riot wrote it into policy. The rest of the industry should read it before it gets written into other titles.