How to Build a Heist/Robbery Script for a GTA Roleplay Server With AI

A heist is the high point of a crime server: it needs a reason to be hard, a way to be caught, and a payout that's worth the risk without breaking the economy. The best robbery scripts gate the activity behind a minimum police count, require items and skill (drills, thermite, hacking minigames), alert dispatch, and reward dirty money on a cooldown so the same crew can't farm it. The pattern scales from a corner-store till to a multi-stage Pacific bank vault.

This guide breaks a heist into its real building blocks entry conditions, minigames, loot, alerts, and anti-exploit cooldowns for ESX and QBCore. PlayDeck teaches you to build these with AI: you describe the location, the steps, the required items, and the payout, then steer the AI as it writes the minigame triggers, the server-side loot grant, and the cooldown and you verify it can't be exploited before selling it on Tebex.

Set entry conditions: police, items, and cooldown

A heist should not be startable at any time by anyone. On the server, check three things before allowing it to begin: a minimum number of on-duty police online (count players whose job is police/sheriff), the required items in the player's inventory (a drill, a thermal charge, a USB), and that the location is off cooldown. All three checks live on the server the client only requests to start.

The police requirement creates the core risk/reward loop: no cops, no robbery. The item requirement turns crime into a supply chain (someone has to craft or sell drills). The cooldown stored server-side with the location and a timestamp stops a crew from looping the same bank. When you steer an AI, state the exact minimum cops, required item names, and cooldown duration; the AI wires the checks, and you confirm every condition is verified on the server, never the client.

Build the heist steps and minigames

Heists are a sequence of skill checks. Common steps: hack a keypad (a circuit/typing minigame), drill a vault door (a progress + skill-bar minigame), thermite a lock, or crack a safe. Libraries like ps-ui, ox_lib's skill checks, or a hacking minigame resource give you ready-made challenges; you trigger them in order and require each to succeed before the next. Use ox_target or a marker to start each step at the right prop.

Tie the physical world in: open the vault door via qb-doorlock or your doorlock of choice only after the drill succeeds, play the drilling animation and prop, and add a duration so it isn't instant. Each step's success is reported to the server, which advances the heist state never let the client declare 'I finished the vault' and skip to loot. Describe the step order and which minigame each uses to your AI; it chains them, and you ensure the server tracks the state machine.

Grant loot and alert the police

When the final step succeeds, the server grants the reward and it must be the server, reading the heist state to confirm every prior step completed, then adding dirty money or marked items to the player's inventory. Pay dirty/black money (see the banking guide) so the proceeds need laundering; cash-on-hand from crime that's instantly spendable wrecks the economy. Randomize the payout within a configured range so it isn't perfectly predictable.

The moment a heist starts, fire a police alert: a dispatch notification with the location and a blip, using your dispatch resource (ps-dispatch, cd_dispatch, or your framework's alert). This is what makes the police requirement meaningful cops get a chance to respond. Log the heist with the participants and payout for admin review. The key instruction to your AI: the loot grant is server-authoritative and gated on the full completed state, and the alert fires server-side at start.

Lock down exploits and balance the payout

Robbery scripts are a top exploit target. Defend against: clients claiming steps are done out of order (track the state machine server-side), replaying the loot event (consume the heist state after payout), bypassing the police check (validate server-side every time), and ignoring the cooldown (store it server-side, not in the client). Validate the player is physically at the location during each step using server-side distance checks.

Balance is the other half. The payout should sit below what an equivalent time spent on legal work plus the risk of arrest justifies otherwise crime becomes the only rational play. Account for the laundering cut and the chance of getting caught. Test it end to end: start with too few cops (should fail), complete it cleanly, then try to replay the reward (should fail). This adversarial testing mindset is exactly what PlayDeck trains, because a heist that pays out twice is worse than no heist at all.