Ban evasion on Roblox: what works and what is snake oil
You catch a cheater, you ban them, and twenty minutes later the same aimbot is back on a three-day-old account with a different name. Ban evasion is the tax on every moderation decision you make, and on Roblox it is cheap: accounts are free and a determined evader can make one faster than you can review a report. Here is what actually works against it, and what is being sold that cannot work.
First, the myths: IP bans and hardware bans
Roblox server code cannot see a player's IP address. It cannot see a MAC address, a disk serial, a GPU model, or any other hardware identifier. These simply are not exposed to Luau, by design, and attempting to smuggle them out through tricks is the kind of thing that gets an experience deleted and a developer's account with it. So when a product promises "hardware bans" or "IP bans" for your Roblox game, one of two things is true: it does not do what it says, or it is doing something that violates the platform's rules and its players' privacy. Neither is a thing to build your game's moderation on. Even on platforms where fingerprinting does exist, it is an arms race: virtual machines, spoofers, and family PCs (one ban hitting three innocent siblings) make it far less decisive than the marketing suggests.
What Roblox actually gives you
More than most developers realize. The official Ban API lets you ban an account with a duration, a public reason shown to the player, and a private reason for your records, and it can propagate a ban to suspected alternate accounts using Roblox's own platform-level knowledge, signals only Roblox has, applied by Roblox, with Roblox accountable for them. That propagation is the closest thing to a device ban that legitimately exists here, and it belongs in every serious moderation pipeline.
Accounts are free; credibility is not
The deeper answer is that a fresh alt is not actually identical to an established account. It has no history, no tenure, none of the accumulated social fabric a real player builds over years, and its behavior in your game tends to give it away: evaders come back to the same game, at the same times, playing the same way that got them banned. No single one of these facts proves anything, and treating any one of them as proof is how innocent new players get hurt. Together, weighed carefully, they make a fresh account that behaves like a specific banned account stand out from the thousands of genuinely new players who joined the same day.
Suspicion is a case, not a verdict
The right output for "this new account resembles a banned one" is a reviewable case with the resemblance spelled out, not an automatic ban. Automating the punishment off a similarity score is how ban evasion systems become false-positive machines. In waves.ac, evasion cases land in a queue with the evidence attached; confirming one applies the ban through the official API with alt propagation, and rejecting one teaches the system it was wrong. The specific signals and weights stay private for the obvious reason: publishing them would be a how-to guide for the people they exist to catch.
Make evasion expensive across games, not just yours
A cheater who loses one account in one game has lost almost nothing. A cheater whose standing follows them into every protected game has lost something real. That is the idea behind WaveTrust, the cross-game reputation layer in waves.ac: play fair anywhere and it quietly helps you everywhere, cheat anywhere and every protected game gets more skeptical of you, including the fresh alt that plays exactly like you. Individual games choose how cautious to be with low-standing players, and fair players never need to think about it at all.
The honest summary
Nothing makes ban evasion impossible on a platform with free accounts, and anyone claiming otherwise is selling something. What you can do is make it expensive: ban through the official API with alt propagation, treat resemblance as a case for review rather than a verdict, and attach consequences to identity that survive a new account. That combination will not stop the most determined evader on their fifteenth alt. It stops most of them on their second.