The claim
Read any FiveM anticheat feature list and you will find HWID bans, usually near the top, usually phrased as though the product reads something burned into the machine. It is one of the most effective things a vendor can advertise, because it answers the question every server owner actually has: will they just come back?
We went looking for how to implement it properly. The answer turned out to be that you cannot, and that the products advertising it are doing something else.
Why it cannot work
| Route | Status |
|---|---|
| Native code in a resource | Does not exist. FiveM resources run Lua, JavaScript or C# in a sandbox with no interface for shipping native code. |
| C# P/Invoke to a Windows API | Blocked. Verified, not assumed: the runtime does not permit the call. |
| A companion application the player installs | Against the platform terms. Players cannot be required to install third-party software to join a server, and it raises data-protection problems of its own. |
| Reading identifiers through NUI | The browser layer exposes no hardware serials. It does expose device characteristics, which is a different and weaker thing. |
| Trusting the values anyway | Firmware-level spoofers rewrite serials, disk identifiers, MAC addresses and TPM data below the level at which anything could read them. |
The last row is the one that matters even if you get past the others. Suppose a route existed. Firmware-level spoofers are a mature, commercially sold product category, and they rewrite the exact values a HWID check would read, beneath the operating system, so anything asking gets the spoofed answer with no way to tell.
Even on platforms with a kernel driver and full hardware access, hardware bans are an arms race rather than a solution. FiveM has neither the driver nor the access.
What is really being sold
Something useful, as it happens. FiveM issues each client a set of player tokens, and a server can read them. They are:
- server-specific, so they are not a cross-server tracking identifier;
- stable across the changes a returning player usually makes first: a new Discord account, a new IP, a different Steam account, a reinstalled licence;
- plural, so a partial match is still a signal.
Ban the tokens and a returning cheater has to do meaningfully more work than clearing a cookie. That is worth having. It is simply not hardware, and a vendor calling it HWID is choosing a word that sells better than the one that is true.
What does make a ban stick
The framing that survives contact with reality is not "identify the machine" but "make a fresh identity expensive". Three things do that:
An identity graph rather than a ban list
Store identifiers as nodes and shared sessions as edges. Banning marks a node; connecting checks the whole connected component. A returning player on a new account, with one identifier in common with a banned one, is not a clean slate.
Same player, same evening, a fresh account. On the left they are a stranger. On the right they arrive already attached to the component that got banned an hour ago.
Device entropy, honestly labelled
The browser layer inside the client cannot read a serial number, but it can observe a combination of device characteristics that is fairly distinctive in aggregate. That is a similarity signal with a real false-positive rate, since two identical office machines can collide, so it belongs in a score, never as the sole reason for a ban. It is also not covered by the spoofers sold for defeating HWID checks, since it is not what they were built to defeat.
A positive gate instead of a negative list
The strongest version inverts the problem. Rather than checking arrivals against a list of the banned, issue every enrolled client a server-signed certificate on first join and require it afterwards. Coming back then means obtaining a new enrolment, which is a thing you can price, with a wait, a linked account, or whatever fits your community, instead of a thing that happens for free.
What to ask a vendor
Not "do you support HWID bans". Everyone says yes. Ask what identifier the ban is actually stored against, and what happens when the player changes their Discord and their IP. A vendor who answers "player tokens, and the ban holds" is telling you the truth. A vendor who describes reading your players' hardware either misunderstands their own product or is hoping you will not check.
Our own position, for the record: SwisserAC does not advertise HWID bans, because it cannot do them and neither can anything else on this platform. Persistence is designed around an identity graph and an enrolment certificate instead.