Protecting a teammate who cheats tells everyone else the rules only apply to strangers.

Covering for someone inside your own group never stays a private favour. It broadcasts something outward: the rules are for people we do not know. Everyone watching files that away, and the next time you ask for a fair call you will be asking from much weaker ground. The protection you offered is paid for by every honest person on your side.

Loyalty and cover are different things, and you can usually keep the first without the second. Tell the person privately first and give them room to fix it themselves. If that goes nowhere, say the true thing when asked rather than building a story around it.