Either the GUID (generated from the CD key[3]) or parts of the computer's hardware are banned from PunkBuster-enabled servers.

Even Balance uses a 128-bit private one-way hash so that no serial number information for individual computers can be obtained from a hardware GUID.

[5] Even Balance has not disclosed what hardware PunkBuster looks for when issuing a ban, but close examination of the software has indicated that the GUID may be based on the serial numbers of scanned hard-drives.

During the period of October 30 to November 6, 2013, Punkbuster was falsely banning Battlefield 4 users with the error "(Gamehack #89265)".

[7] On March 23, 2008, hackers published and implemented a proof of concept exploit of PunkBuster's indiscriminate memory scanning.

Because PunkBuster scans all of a machine's virtual memory, malicious users were able to cause mass false positives by transmitting text fragments from known cheat programs onto a high population IRC channel.