Stolen Steam account: what to do immediately

Step 0: use a secure device

If there is even the slightest suspicion that there is malware on your computer, do everything else from your phone or another computer. There is no point in changing passwords from an infected machine - the new password will leak in the same way as the old one.

Suspicion is justified if you recently launched a sent file, installed cheats, downloaded a “program for checking skins” or accessed a link from personal messages.

Step 1: secure your email

Mail is more important than Steam itself. Access is restored through it, and if it is under the control of a stranger, it will not be possible to return the account in principle.

Change your email password. Check your settings: whether emails are being forwarded to an unfamiliar address, or whether the backup address or recovery number has changed. This is the most common thing that is missed - access is returned, and a day later it is lost again.

End all active sessions in mail, if such a function exists.

Step 2: recover Steam access

Open help.steampowered.com - enter the address manually. Select your account and the item about loss of access. The recovery wizard will guide you step by step even if your email and phone number have already been replaced.

What will help confirm ownership: receipts and payment data, keys for activated games, old email addresses, phone number, date of account creation. The more evidence you collect in advance, the faster the trial will go.

Having regained access: change the password Steam, end all active sessions in the security settings, check the linked phone and mobile authenticator, revoke the Web API key at steamcommunity.com/dev/apikey.

What can and cannot be recovered

The account itself is returned in most cases - if you can prove ownership, the chances are high.

It's worse with objects. Valve points out that exchanged items are not guaranteed to be restored, and in practice they are almost never returned. Especially if the exchange was confirmed by your own authenticator - formally this is your action.

Therefore, the main task in the first hours is not to return skins, but to stop further damage: close access, cancel what is still hanging, and prevent the linked payment data from being stolen.

After recovering the account

Connect the Steam Guard mobile authenticator if you don’t have one, and save the recovery code offline. Without him, history will repeat itself.

Scan your computer with an antivirus, even if you are sure. Change passwords on services where they matched Steam.

Look at the history of exchanges and purchases over the past weeks - you can see exactly what went and when. This information will be useful if you contact support again.