How to check a Steam link for phishing
The phishing page copies Steam down to the pixel; it is impossible to distinguish it by its appearance, and there is no need to try. You can tell them apart by one place: the address. Let's figure out how to read it, because there are some non-obvious mechanics here.
How to read a domain from right to left, which Steam addresses are real, how a fake login window differs from a real one, and why a browser lock does not guarantee anything.
Understanding domain names
This is the main trick that saves accounts. The real domain is the last two parts of the address before the first slash, and you need to read them from the end.
Example: steamcommunity.com.login-verify.ru/market - looks convincing because it starts with steamcommunity.com. But we read on the right: the domain here is login-verify.ru, and steamcommunity.com is just a subdomain that anyone can call anything they want.
Another technique is symbol substitution: replacing a Latin letter with a similar one from another alphabet, an extra hyphen, i instead of l, a number instead of a letter. At a quick glance it is not noticeable at all.
Real Steam domains: steamcommunity.com, store.steampowered.com, help.steampowered.com, steampowered.com. Everything else is not Steam, no matter how similar it may look.
Fake login windows
The most dangerous type: the Steam login window is drawn right inside the page. It has a header, buttons, and an address bar with a green padlock, all in an image.
The check takes a second: try dragging this window with your mouse outside the border of the browser tab. A real separate window will go off the edge of the screen, a drawn one will rest against the page border.
Second check: expand the window to full screen. The real one will open like an operating system window, the fake one will remain a piece of a web page.
- Access sites only from your bookmarks, and not via links from the chat.
- Do not open shortened links at all - they deliberately hide the address.
- If you have already logged into Steam, and the site asks for a login and password again, this is not Steam.
Why a padlock is not proof of legitimacy
The lock icon in your browser says only one thing: the connection is encrypted. It doesn't say the site is real.
Today you can get an encryption certificate for free and in a couple of minutes for any domain, including fraudulent ones. Everyone has a lock, including phishing scammers.
The same thing with the appearance: the design is copied entirely, right down to the animations. The only reliable verification is the address.
QR codes
Steam can log in using a QR code: you scan it with a mobile application and log in on your computer. Fraudsters turn this around in the opposite direction.
They show you someone else’s QR under any pretext: confirm participation, pass verification, receive a reward. You scan and log the stranger into your account.
The rule is simple: scan the QR only when you yourself have opened the login screen on your computer and see the code there. Someone else's QR is never scanned.
If you already entered your credentials
Act immediately and from a clean device. Change the password of the mail associated with Steam, then the password of Steam itself, end all active sessions in the security settings.
Check the Steam Web API key at steamcommunity.com/dev/apikey and revoke it if there is anything there. View your trade history and active offers.
Scan your computer with an antivirus - the phishing page often comes with an offer to download something.
Frequently asked questions
How can I check whether a Steam website is genuine?
Read the domain from right to left: real ones - steamcommunity.com, store.steampowered.com, help.steampowered.com. Everything that comes before them as a subdomain means nothing.
Does a browser padlock prove a website is legitimate?
No. The lock only confirms the encryption of the connection. The fraudulent site also receives the certificate for free.
How can I recognize a fake Steam login window?
Try dragging it outside the browser tab. The real window will go away, but the one drawn inside the page will not.
Is scanning a login QR code safe?
Only if you yourself opened the login screen on your computer and see the code there. Someone else's QR code logs the scammer into your account.
What should I do if I entered my password on a fake site?
From a clean device, change the mail password, then the Steam password, end all sessions, revoke the API key and scan the computer with an antivirus.
How to spot a fake marketplace trading bot
How trading bots actually work, what to check in an incoming offer and why the account level, registration date and comments do not prove anything.
Read guide
How to spot a Steam trade scam before confirming
Check recipients, login pages and mobile confirmations. Recognise fake support, copied bots, misleading trade messages and account-access scams.
Read guide