Is My Opponent Hacking or Cheating in MTGA?

Last updated on January 2, 2024

Awaken the Blood Avatar | Illustration by Kekai Kotaki

I was playing Standard with rogues vs  Gruul aggro on Arena the other day. I had the board controlled and my opponent had no creatures and no hand, just a Vivien, Monsters' Advocate on the battlefield. It activated its -2 ability and passed the turn, and the next turn my opponent started casting every creature from their graveyard with no explanation and I lost the match.

Was I being cheated or was it a bug? Let's find it out right now!

Hacking and Cheating: Defined

Exhilarating Elocution | Illustration by Randy Vargas

Before we do deeper on analyzing the scenario I mentioned, let's try to get a bit more context behind the question. What's the difference between hacking and cheating? Let’s use some examples to answer that question.

Scenario 1: Hacking

A while ago, a YouTuber was explaining how he lost access to his channel and how it took a lot of time and effort to get it back. He said that he was contacted by a company to test a new game and that the company would sponsor him if he did.

Before accepting, he Googled the company webpage and tried to get as much info as he could. After some slight research, he didn’t see anything wrong with the company and accepted.

He agreed to test the “new game,” so the company sent him a .exe file to download the game. After downloading it, he executed and nothing happened. The next thing he knew, he had lost access to his email, channel, and games account.

He was hacked.

Scenario 2: Cheating

Mentor's Guidance | Illustration by Brian Valeza

When I started playing Magic, one of the local store guys was giving one of the regulars a hard time, saying he always has a full hand. Every time someone played against him, they had to ask how many cards he has in hand. Why was that?

Well, the answer is simple: every time a new player came around and wasn’t aware of his behavior, he would draw cards from his library whenever they weren't paying attention. Obviously that’s not right, and that’s called cheating.

OK, What About in MTG Arena?

Now that I gave you both scenarios, we can conclude that:

• Hacking is when someone accesses data or software to take control and modify it without permission, either to do harm or gain leverage/advantage over something or someone.
• Cheating is when someone takes advantage of a flaw or something they can control that’s outside of the rules to gain an advantage.

Hacking isn’t just someone trying to take over your accounts or steal something digitally from you. It can be someone trying to exploit a vulnerability in the system to make “something.” That something could be giving themselves infinite gold or gems, all copies of all cards from the game, etc. Surprisingly, so far there haven’t been any public examples of this.

In the same manner, cheating isn’t just exploiting bugs. It could also be something as simple as using multiple accounts on the same draft queue to get better drafts, or stream-sniping a streamer to see their hand. While these are both very doable, it’s against the rules and is definitely cheating.

What’s Not Cheating?

Tenured Inkcaster | Illustration by Jake Murray

Anytime you’re doing something that doesn’t break the rules, you’re not cheating. Seems easy, but let's get into some more detailed examples:

• Using a sealed deck building tool or tracker to give you an idea of what cards are valued the most to make a competitive deck.
• Getting on a Discord call with friends to go over draft picks on regular queues (don’t do this on sanctioned tournaments though; that is cheating).
• Getting help from your friends to better understand a new set and playtest with them for upcoming tournaments.

All of these will give you an advantage over someone who doesn’t do them, but they’re legit and fair ways to get an advantage. That’s just preparation.

You may consider it cheating if your opponent just top-decks the Lightning bolt they needed to finish you off, or if they cleared your whole board with a Doomskar in a mono-white Standard mirror. Let me tell you, though, those are not by any means cheats.

One of them is called luck, and the other one is called strategy. Both are fair ways to get an advantage in a match, and the first it’s just part of the game. Don’t be discouraged if you run into these situations. One day you’ll be on the opposite side of things and will topdeck the answer you need to finish it off!

On the other hand, if you’re unlucky enough to draw seven lands in a row, that’s weird, but it can happen. It doesn’t mean your opponent is hacking you, it's just that you are very unlucky or you need to improve your deck’s mana base.

WotC’s Stance on Cheating

Archway Commons | Illustration by Piotr Dura

If you aren’t familiar with tournament rules, WotC is very strict in terms of what they don’t allow on the competitive Magic scene. Cheating is obviously not tolerated. If you’re caught cheating, you’ll be penalized according to their infraction procedure guide.

To be considered cheating, any offense must meet the following criteria:

• The player must be attempting to gain an advantage from their action.
• The player must be aware that they are doing something illegal.

Digital play has understandably exploded recently with paper Magic on hiatus, so the best rules we have to go on for this are the paper rules about cheating. But the same definitions are applicable.

WotC, Hacked?

There's not much info lying around about specifics for Arena or MTG Online, but, there was an incident on November 14, 2019 that made WotC ask everyone to reset their password for both platforms, as personal information was apparently compromised.

This was a clear and successful hacking attempt at one of their databases. Fortunately they had the most important details encrypted. Having everyone reset their password was a precaution, just in case. They even locked accounts after a while to prevent the issue from escalating.

I had to reach out to WotC to get my account unlocked. I wasn’t aware of this incident and hadn’t played MTGO in quite a while. If you have an account that you haven’t used in a while, you’ll most likely be asked to reset your password or ask WotC to unlock it.

Why MTGA is Actually Hard to Hack

Spiteful Squad | Illustration by Manuel Castañón

While doing some research, on Reddit, Discord, and even Youtube, I found that when most people refer to “hackers” or “cheaters,” there were a lot of overblown complaints that did not actually amount to hacking or cheating. The major exception was people abusing and exploiting known bugs to gain an advantage.

Back to the personal experience I discussed ealier, I looked for other issues related to Vivien, Monsters' Advocate and found that the card has been bugged for a while and in some very specific scenarios doesn’t behave the way it should.

I asked someone who works with IT security, and he mentioned that while these types of exploits won't harm you or your computer (because no personal data is exposed), it certainly degrades everyone's experience with the game. If you see this type of behavior, you should report it so you can get a) get the bug patched immediately and b) have players who abuse the system held accountable.

Client vs. Server Data Security

Let’s take a step back and get something clear: MTGA is a program that both runs server-side and doesn’t have a public API. When an application runs like this, it doesn’t matter what changes you make on your local computer. All of the interactions and triggers are handled on the server side.

While we do have access to the client side, when we press a button that triggers an action, the result of that action is determined by what the server sends. In other words, unless you attack the server directly, you can't hack the MTGA desktop application to hack directly into the game.

What’s funny, is that if someone took the time and effort to hack WotC servers, they problem would care a lot less about getting infinite gems than gaining access to database info to get everyone's credit card information, for example. Likewise, if MTGA had a public API available, you could imagine everyone would be using a bot to farm gems or gold, or at least to play for them.

It's worth noting that companies like WotC are certified for compliance because they hold personal data and accept payments. To do this they outsource other companies to do “penetration tests” to search for vulnerabilities to their products before release. In other words, they do their fair share of work to keep the application safe — any vulnerability discovered gets patched and deployed.

Long story short, most of the time when people say “this guy is hacking” its either because they are have a long run of very bad luck or or ran into someone abusing a bug. But way too often I see comments like: “it's impossible that my opponent top-decked 3 turns in a row exactly the card he needed” but let me tell, you, that happens. It happens in real life too. Welcome to Magic.

Recommendations and Best Practices

What we’ve learned from the 2019 account compromise incident is that there's no such thing as an infallible system that can't be hacked. There are a couple of good practices you should be aware of when you’re setting up a password for either a new Arena account or any new account for that matter:

1. Get a password manager. This will help you keep all your sensitive data in one place. More importantly, though, it’ll help you manage passwords so you don’t have to use the same password for all your accounts because you don't want to forget it.
2. Set up two-factor authentication. The objective of this technique is to add an extra layer of security to your account. Every time you want to login from a new device, it’ll ask you for a security code that can be set up to be sent to your phone.
3. When setting up passwords, make sure to make them strong enough so your account can’t be easily hacked.

In regards to cheating, keep in mind that if you suspect someone is cheating in-game or is abusing a bug during your gameplay session, reach out WotC support and explain your case. They’ll do their best to help you and they may even give you a refund if needed.

Other Cheats

For those who may not know, the above picture was mostly a joke that Brad Nelson played against his roommate Brian Braun-Duin. Brad had no way to win… except trying to get BBD to concede by going into his room, tackling him, and making him concede the game. It was mostly a joke for the stream, but this is an example of something that could have happened: taking out someone's internet connection or shutting down their computer if you can isn’t infeasible if you want to cheat in the digital era.

New ways to cheat could be as simple as having someone cut off lights from a player's house to something more complex as damaging their computer hardware or sending them a virus to keep them from playing an event.

On MTG Online, one of the ways some players cheat is queue-trading. This consists of rejecting parings until you get paired against a specific account to win-trade. This benefits some grinders as they get profit in terms of event tickets that then can be translated to actual money via PayPal. Of course, this is unfair, and if you catch anyone doing this, I encourage you to report it.

On MTGO another common cheat is spamming people with trade requests to prevent them from taking actions in game. However, you can prevent this by only allowing trade requests from buddies inside your game settings. Thankfully there is no way to do something similar in MTGA, in part due to the fairly limited friends system.

Wrap Up

Mascot Exhibition | Illustration by Randy Vargas

The digital era is a brave new world for Magic. You have to deal with data security issues all over the internet, but the architecture of programs like Arena certainly help to reduce some of the paper issues that the community has to deal with. It's pretty hard to cheat and draw extra cards on MTGA, for example.

As long as WotC keeps making efforts to prevent and address bugs in the system, we could start to potentially have greater overall tournament integrity with digital events.

That’s all for today. Thank you very much to everyone who made it here through all my rambling. If you’re looking for ways to improve your game the legal way, make sure to check our never ending stream of MTGA guides. We’ve got you covered with the most updated info related to your favorite card game.

As always, stay safe and take care!