Common Steam and CS2 Scams, and How to Spot Them

Most stolen Steam accounts are not hacked. Their owners typed their login into the wrong page or accepted the wrong trade. These are the scams CS2 players run into most, and the habits that stop all of them.

Fake Steam sign-in pages

A link to "vote for my team", a giveaway or a cheap skin leads to a page that asks you to sign in with Steam. The sign-in window looks real, but it is part of the page and sends your login to the scammer.

Real Steam sign-in happens on steamcommunity.com or store.steampowered.com. Read the address bar, not the window.
A real sign-in opens in its own browser window or tab. A fake one cannot be dragged outside the page.
When in doubt, close the link and open Steam yourself.

The API key trade scam

After a fake sign-in, scammers can register a Steam Web API key on your account. With it they watch your trades, cancel the real one and send a copy from an account that looks just like your trade partner. You confirm, and the items go to them.

Check steamcommunity.com/dev/apikey. If there is a key you did not create, revoke it, then change your password.

"I accidentally reported you"

Someone, often a friend whose account was taken over, says your account will be banned because of a report, unless you contact a "Steam admin". The admin then wants your login, a Steam Guard code, or a "verification" payment. Nobody can undo a report for you, one report does not ban an account, and Steam staff do not message you on Discord.

Trade tricks

Swapped items: the offer you confirm is not the one you agreed on. Always check the items and the other account in the Steam mobile app confirmation.
Fake middlemen: a "trusted" third person who holds the items. They are usually the scammer's second account.
Pay first: a deal where you send money or items before anything comes back.

Before a trade, look at the other account: age, level, bans and community reports. See how to check a Steam trader.

Habits that stop all of these

Turn on the Steam Guard Mobile Authenticator and confirm every trade in the app.
Never share your password or a Steam Guard code, with anyone, for any reason.
Use a password you do not use anywhere else.
Be wary of links from friends too; their account may be the one that got taken.

If it already happened

Change your Steam password and the password of the email linked to it.
In Steam Guard settings, choose Deauthorize all other devices.
Revoke any API key you did not create.
Contact Steam Support through help.steampowered.com. If the account was used to cheat, know that bans stay with the account: see can a VAC ban be removed.

Check who you are trading with before you confirm. Open the Steam trade checker