You need to:

• Have a rank that is equal or higher than Gold Nova I (7/18) in 5v5 competitive
  
• Have 150 or more competitive wins (5v5)
  
• Have at least 200 or 300 hours in CS:GO (this varies for some reason)
  
• Have your game running in VAC-secured mode (not outside of Steam or not with "-insecure" launch parameter)

Otherwise you won't have the Overwatch tab in the main menu. That's all.

So this is the list of possible options while submitting a verdict:

• Aim Assistance
  
• Vision Assistance
  
• Other External Assistance
  
• Griefing

First three are marked with "Major Disruption" and the last one is "Minor Disruption". Although the last one is minor, if the suspect is getting banned for this, he is going to get his game ban displayed on his profile. looks like not anymore. And the second minor disruption ban is permanent. And looks like only the permanent minor ban is displayed.

Let's clear things up with all these now.


Aimlock
Most easily detectable one. Suspect's crosshair is constantly snapping on enemies' heads.

Aimbot
Less detectable, especially when configured properly. Suspect's crosshair is moving towards enemies. Note that in most cases it moves in a linear manner. It's not like you moving your mouse towards your enemy, leading to a curve-like movement — aimbots usually do this in a straight line. Speed of camera movement, is, however, not linear.

Recoil Control System — RCS
The Suspect seems to have no recoil, or his camera is shaking a bit while spraying. Hardly detectable. The easiest way to detect it is when the suspect is perfectly spraying at someone from A site on dust2 straight into pit, from long distances in other words.

KillDelay
When there are at least two players in front of the suspect, he may stop aiming for a little while (~200ms, configurable) before shooting at another one. Hardly visible but you will feel it. Although I have seen very little cases of people using this thing since it's useless... And looks weird.

Ragebot/Silent Aimbot
The Suspect's crosshair quickly snaps on the enemies' heads and then quickly returns back to its initial spot. EASILY detectable.

PSilent/Perfect Silent Aimbot
Usually looks like ragebot if poorly configured/coded, but may be hardly detectable if actually good. If good, suspect may lag for a little while after shooting, and simultaneously lands a "lucky" headshot on someone. Not to be confused with server lag on round end, last kill of the round almost always looks laggy on demos.

Vision Assistance

Nothing interesting here. Look for illogical suspect's solutions, try to build up the game situation in your head, look at the radar (Ctrl/Q (lastinv) to see the whole map). If the suspected player is doing something weird, like waiting for a guy he's got no information about, that's wallhack. It all comes down to logic and experience, and how smart The Suspect is. Most cheaters can't model out what would they have been doing if they didn't know where all enemies are in their head, so, again, you should just look for The Suspect doing something that doesn't have a solid reason from a non-cheating player standpoint yet yielding positive results, like rushing a bombsite and then seeing through walls how all 3 CTs are already there and, without hearing them or seeing them, rotating and pushing the other, empty bombsite instead.


Bunnyhop
Typical seen other hacking subject. The Suspect is moving faster than usual running speed with the knife out, jumping without speed drops (almost never less than 295 units per second) throughout the map.

Autostrafe
Typically used in combination with antiaim, ragebot and bunnyhop. You know that strafing mechanic that allows you to build up speed from nothing in the air, that people practice for years on KV servers (I think)? This type of cheat almost instantly brings you up to 295~299 speed by doing ultrafast microstrafes in the direction you are holding, like you should just hold Space and W and it will accelerate you as fast as you can go in this game.

Antiaim/Spinbot
Used for cheaters to disturb enemies' aimbots to hit. Basically just looking down in the ground and spinning. A good sign that the game is being played on non-prime. :D

Airstuck
The Suspect is getting stuck in the air. Lol.
The cheater cannot move neither their body, nor their camera while in Airstuck state.

Fakelag
If The Suspect is playing good, but lagging a lot (like 4 fps or something) and has a normal ping (normal in those cases are pings less than 300 and stable) that's probably fakelag. You shouldn't be good at aiming with less than 60 fps because you will be getting a massive inputlag. Keep that in mind.
This type of cheat is configurable.

Fakeping
If The Suspect is playing good, but has a very high ping but yet very stable and not visually lagging, and teleporting everyone back by killing them, he is probably cheating. And probably wallhacking as well, since with fakeping you can see the present, but can only do something in the past… if they see an enemy running away to cover to reload (outside of hearing range), they will peek and kill them by shooting literally air! At least this is how it will look like on your screen.

Backtracking
If The Suspect has a low ping and is not visually lagging, but teleports people back by killing/hitting them, that's backtracking.

Forwardtracking
Same as backtracking but teleports forwards. It's abusing the extrapolation mechanism. DO NOT MIND THIS ONE. Most of kills that look like that are just flaws of the demo.

Roll
If the camera is tilted, The Suspect is most likely cheating and is going to get banned with VAC, as there is no normal way to tilt your camera in this game (except for getting shot in the head). You can look the "roll" value by typing
in console. Roll is the third value after "ang:".
However!! This can be a bug on your side, or just a demo bug. Always try restarting the demo when you see someone's roll isn't being zero. Also interpolation causes this, you can disable interpolation for the duration of the demo: cl_interpolate 0

Knifebot
Almost undetectable one. Don't be paranoid and do not report anyone for this.


I consider everything of this to be griefing:

• Killing teammates on purpose
  
• Flashing, smoking off teammates on purpose
  
• Stealing teammates' weapons when they accidentally drop them/are exchanging with someone
  
• Buying a lot of useless guns, buying guns just to throw them all away outside of the map NOT on the last round of the half
  
• Staying AFK if it loses the round
  
• Staying in front of the bomb without defusing it at all
  
• Blocking off teammates/getting them stuck
  
• Shooting teammates at round start/during the round on purpose

You can only accuse anyone of cheating if you have got a proper evidence. Sometimes there are some cases when you feel that The Suspect is cheating, it is even pretty obvious to you, but you've got no solid proof, like only if you are sure that it is obvious not only for you, but for the majority of this game's players as well. If you are not completely sure about it, submit No Evidence verdict. The correct verdict that won't drop your Overwatch score isn't the truth, but it is what's been voted the most.

There is a theory that every investigator has their own Overwatch score to make their opinions worth more or less.

It's simple: wrong verdict = bad score, correct verdict = good score.
Correctness is based on what the majority of people who watched this demo voted.

Good score = you are actively working on new cases;
Bad score = you are getting already resolved cases until most of your verdicts will start to match the truth.


Sometimes, you can get a banned player (0 days since last ban) even with good score. But that's because you just were too slow, or got the case too late.

Again, this is an unconfirmed theory, but I once saw it "in action", when a streamer got a 5-days-old case of mine that I have already resolved (and The Suspect was banned). Possibly, he had a bad Overwatch score, since he likes to select all reasons when he sees a cheater, even if they're not present (like selecting griefing too when The Suspect is just using their cheats to win).

Since a lot of players stick to their particular game settings, video settings, etc, and they are not shown in an Overwatch case, you, as a good investigator, always need to compromise for these.

Saw suspect perfectly aiming an enemy behind a disappearing smoke? Or through a molotov? Maybe that's just post processing with nvidia freestyle or something, or different "Effects" setting. Saw a suspect not checking a corner, but still turning there because an enemy was sitting there? Maybe he's just playing on a 21:9 monitor. Always keep in mind all these things, since you can't guess video settings for every single suspect.

But the best way to help yourself here is to use your native monitor resolution and the lowest possible settings (without using external software), as supposedly most of players are playing like that.


I don't want to change my settings cuz I'm lazy

It's a basic one, but some people have lost it because of the Danger Zone update.

It was always bound to X by default, which brings us back to classic Counter-Strike when Z, X and C were used for radio commands. X was "radio2" command, so you were using it for toggling X-Ray.

But, if you had some config, your settings didn't get updated and your X still stands for "radio2" instead of "slot12".

To make the X-Ray working again, you can do
(or any other button instead of "x") OR you can do
(as what "slot12" does now is basically just toggling "spec_show_xray") or
to do both simultaneously, since there is no radio commands in Danger Zone, and there is no healthshots in competitive play.

(Basically you can just toggle "spec_show_xray" by yourself everytime without binding anything but that's nuts)

Bonus:
By typing
into console you can see how far does Suspect see chams (not boxes around players — these are rendered farther away behind walls).

For example, now suspect can see the playermodel through walls:
And now he can't:
And now he is spinning, in such cases it's pretty much useless since you can only see the floor…

This should be essential to know, but there is no way you can learn this from the game itself. Press Shift+F2 to bring up this panel while viewing:
...but for overwatch demos it looks like this:

There are some limitations for some reason. Once you have started viewing the case, you can't go back. Even if you skipped something. The only way to go back is to finish, press "Postpone judgement" in the verdict window and review evidence from the start, again.

However, you can still pause, resume, speed up and speed down (however you won't need to slow it down in most cases because all demos are only 32tps which means only 1/2 of all ticks are shown, so it's hard to judge Suspect's shooting using lower playback speed).

Set the playing speed to 1000% to finish the demo and view it again from the start if you need that.

Bring up playback panel and set the playback speed to 1000% and enjoy the view. But don't forget to look at the killfeed, whom exactly The Suspect is killing. If they killed a teammate you can review the demo again on that round to see if that was griefing or an accidental kill (how would one who's ragehacking accidentally kill his teammate?)

Sometimes something can go wrong with your, or Valve's networking, and your demo can get corrupted while downloading. In this case, you'll need to redownload your demo in order to go through it. But in-game there is no option to delete evidence file, only to download it.

So to manually do it you need to navigate to your CS:GO installation folder (Properties -> Local Files) somewhere here:
and get into "csgo" folder. Once you're there, find
file and delete it. Restart CS:GO, of course.

Make sure you have disabled your antivirus programs, or better even uninstalled as they can analyze and even edit your network traffic! (And also that's the reason of high "var", "loss", "choke" and other bad things can happen)



Note that evidence file is most likely encrypted and is a temporary file. And it IS going to be replaced with another one after downloading a new case.

Well, you can just try again later.

Alternatively, you can download any network packet parser (I recommend WireShark[www.wireshark.org] as it's free and easy to use), install it and proceed to the next steps:

1. Re-launch CS:GO, open the Overwatch tab.
2. Once you are there, tab out, choose "Ethernet" in Wireshark.

3. Tab back in, click "download evidence" button and tab out.
4. Wait for 10-15 seconds.
5. Click red "Stop" button in the top-left corner, press Ctrl+F, search for "String" instead of "Display filter" and type "bz2" in it.

6. Something like this should be highlighted:

Right-click it, then click "Show Packet in New Window".

7. Once you're here, expand "Hypertext Transfer Protocol" in the top tab, then look at the host line. This (more precisely country code like "cn" or "jp" etc) should be the reason why you can't download it. (In this case everything works fine, thanks Valve!)

I once got a Chinese demo, of course on Chinese servers and needed a VPN in order to download it. The host looked like
in that case.

So basically all you need is to find the country which the demo is downloading from and find a suitable VPN in order to download it. Or a proxy.

Note: if you have already downloaded evidence and postponed judgement, you will need to delete "myassignedcase.evidence" as described in "Corrupt demo" section.

First steps are just like in the previous section, so I'll just copy&paste them here:

1. Launch CS:GO, open the Overwatch tab.
2. Choose "Ethernet" in Wireshark.

3. Tab back in, click "download evidence" button and tab out.
4. Wait for 10-15 seconds.
5. Click red "Stop" button in the top-left corner, press Ctrl+F, search for "String" instead of "Display filter" and type "bz2" in it.

6. Something like this should be highlighted:

Right-click it, then click "Show Packet in New Window".

7. Expand "Hypertext Transfer Protocol" in the top tab and look for a blue-colored link somewhere at the bottom. Double-click it.

It will open with your default browser and download a .bz2 archive.

8. You need to unpack it with an archive manager that supports bz2 (7zip, bandizip, etc) and place that .dem file somewhere where you can access it in-game. I advice creating a folder somewhere here:
as the file browser in the game starts with "csgo" directory.

9. Tab into the game, review evidence, bring up the team panel (G by default, "drop") and look up Suspect's number.
For example, here Suspect is number 9 (there are little numbers on the left and on the right).

10. Now you can continue watching the evidence, or you can check Suspect's profile.
Bring up console and use "playdemo" command. An example:
If the full path to the .dem file is:
Command should look like this:

11. Once it's loaded, skip to the point when everyone has joined and press previously gotten number, "9" in our case. That's the suspected player from your evidence.

Now you can save their profile link to check for bans later, leave a comment, or even add and talk to them.

• Turning off X-Ray is sometimes helpful. Use it to understand the current situation better.
  
• Wingman matches are much lighter than Competitive 5v5 matches, so you can tell which match that is even before downloading it.
  
• It's better to have two accounts eligible for Overwatch because there is a wait time before next Overwatch arrives if you do them rapidly. So while you wait you can just switch on another one.
  
• Sometimes bans are delayed for Prime cheaters. Don't be feared of a Suspect not getting banned for a long time even if they were semi-rage-cheating.
  
• X-Ray border intensity around a player depends on how loud this player is at the moment. For example, you will see a running player much more clearly than a sitting still player. You can use this to determine whether Suspect heard a player or not.

All this was written just to encourage people to do more overwatch cases. So, please, do at least 15 cases a week! :D If I'm not asking too much… Since the game has become free to play, we need more effort to keep the game clean.

Two overwatches a day - keep the cheaters away!

Please do not flood the comments with inappropriate content (mutual comments, +reps, etc.) — they are being moderated.