How to Spoof

What is "spoofing"?

When talking about spoofing, we are talking about changing our HWID (identification of your physical hardware in your PC) and combining that with using different accounts to bypass a ban in FiveM. We can spoof the 2 possible bans you can get in Fivem:

CFX.re Ban

You have been banned by automated system from CFX.re. This is a global FiveM ban preventing you from joining any server on FiveM. CFX bans are often issued when the game notices some pattern/attempt to tamper with FiveM's memory. This can happen when the cheat you're using is poorly written.

• CFX bans are issued with a 2 week delay and in waves - this means that after the system flagged you, you will be banned after 2 weeks and the system will ban multiple previously flagged people at once.
• CFX bans are often easier to spoof than server bans, as they rely only on your HWID and Rockstar License, meanwhile some server bans can rely on multiple different identifiers. CFX bans are VERY rare and you will most likely not encounter one, unless you for example attempt to hook a random.dll straight into the game process.

Server ban

• Server bans are issued by a resource on a specific server. When you receive a server ban, your ban will be valid only on that specific server - this does not apply if the system that banned you is using a global banlist system that's shared across multiple servers.

If you want more in-depth explanation about this whole process, check out our previous guide.

How to spoof?

Now that you understand how does spoofing actually work, you can go ahead and spoof your FiveM ban.

Prerequisites

• CPU Virtualization enabled in BIOS/UEFI
• Hyper-V Disabled
• A fresh Rockstar account
• FiveM unlinked from Discord (User Settings → Authorized Apps → FiveM → Deauthorize)
• (optional) New Steam account (new or fully private accounts might trigger some suspicion filters).
• (optional) Xbox Services uninstalled
• (optional) Solid, preferably residential VPN
• (optional) New Discord account (preferably aged at least a few weeks to avoid triggering suspicion filters)

Before Spoofing

Hyper-V Disabled in Windows

You can do this through the Windows Control Panel, or use this CMD command as Admin:

Optionally, you can also use this command if the first one fails:

Make sure to restart your computer after running the command.

Delete certain FiveM folders that contain cached data

FiveM leaves folders on your computer that contain data about your account and might be readable by various AntiCheats. You need to delete these folders before spoofing yourself. Specifically, we're talking about the following folders:

• %localappdata%\DigitalEntitlements Contains information about your Rockstar account
• %appdata%\Roaming\CitizenFX Various configuration files for FiveM and GTA V
• %localappdata%\FiveM\FiveM.app\citizen FiveM configuration data, LUA rutines, etc.
• %localappdata%\FiveM\FiveM.app\data Delete everything except game-storage (unless you want to re-download FiveM builds)
• %appdata%\CitizenFX GTA V settings, Custom FiveM keybinds, Rockstar Account info

This folder also contains one or two important folders: kvs/ and kvs_cl2/. These folders include Key-Value Pair data that can be read by any resource using the natives such as GetResourceKvpString() . Some AntiCheats use these folders to cache your player data locally, if you don't delete these folders, even after spoofing, these AntiCheats can still re-ban you.

Clear your Recycle Bin

This step is considered pretty useless, but it's always better to do this.

Acquire a new Rockstar Account

This step is cruical! You need a fresh Rockstar account to continue. Susano offers a bundle of Rockstar accounts for extremely cheap prices, you can get them here.
These Rockstar accounts are freshly generated, so you can be sure that they haven't been used before and aren't linked to any server bans.

When you first launch FiveM, you will be asked to link your Rockstar account. FiveM then verifies that the account owns GTA V and proceeds with linking your accounts. After then, your FiveM and Rockstar accounts are linked and your account now has the license: identifier.

Traces of your Rockstar account are left on your system in multiple places, check the folders above to clean them up.

Quit all launchers, AntiCheats and AntiViruses from your system tray

Click the up arrow symbol located right on your taskbar and quit all game launchers (like Epic Games, Riot Client, Face IT ...), AntiCheats (like Vanguard, ...) or AntiViruses (Bitdefender, Kaspersky, disabled Windows Defender, ...).

(optional) Uninstall Xbox Services

This step is optional, you can skip this step by creating and logging into a new Xbox (Microsoft) account. You can either use Revo Uninstaller or run the following commands in your elevated Powershell prompt (Run as Admin):

After running these commands, go to Settings → Apps > Installed Apps and make sure there are no Xbox related apps.

(optional) New Steam Account

This step is optional, it's only needed for servers that require you to have a steam: identifier present (Steam running in background). Log out of your current steam account and login into a new one that you know wasn't banned before.

(optional) A Solid VPN

This step is optional, though highly recommended, as most AntiCheats are saving your IP address too. If you can, get a residential VPN to avoid your IP getting flagged by VPN/Proxy detection services, for example Mysterium VPN. VPN is also needed when you need to avoid a Discord server ban, as Discord issues IP Bans when you get banned from a server.

(optional) A new Discord Account

This step is optional, it's only needed for servers that require you to have a discord: identifier present (Desktop version of Discord running and your account linked to FiveM). Log out of your current Discord account and login into a new one. If you can, get an account that's at least few weeks old to avoid triggering suspicion filters.

Main Spoofing Process

1. Open your Susano loader and select Privacy Protector. Spoof.
2. Open FiveM and join a server you were banned on before!

That's it!