Steam API scams: how trade impersonation works

What actually happens

First, the attacker gains access to the account. Through a phishing login page, malware on your computer, or a stolen session - the method is not important, the fact itself is important.

Next, he registers a Web API key on your account and sets up automation that monitors your trade offers.

You start a regular trade. The automation instantly cancels your real offer and creates a visually identical one - with the same items, the same nickname and avatar, but from a fake account.

You see a familiar offer, think “it fell off, came again,” and confirm it in the mobile application. Items go the wrong way.

Key detail: Steam is not hacked. You did all the confirmation yourself, with your authenticator. This is why it is almost impossible to return items.

Why the name is misleading

Because of the word “API,” many people believe that the problem is in the key and that it is enough to delete it. This is not true, and it is a dangerous misconception.

The key is simply a convenient automation tool. Anyone who has full access to the account will do the same without it, manually. And it will create a new key a minute after you delete the old one.

The real problem is account or device compromise. Until it is eliminated, any actions with the key are meaningless.

Signs of account compromise

There is a key on the page steamcommunity.com/dev/apikey that you did not create.

An trade offer is canceled and a similar one comes immediately - especially if this is repeated.

In the security settings, active sessions from unfamiliar devices or from other cities are visible.

There are letters in the mail about logging in that you did not sign up for, or letters about changing settings.

There are transactions in the history of exchanges that you do not remember.

Steps to secure the account

Consistency is more important than speed here - if you do it out of order, everything will have to be repeated.

First: stop all current operations and leave the infected device. Then work from your phone or someone else’s clean computer.

Second: check your computer with an antivirus. If there is malware, it is useless to change passwords from it - the new password will leak in the same way as the old one.

Third: change the password of the mail to which Steam is linked. Access is restored through her, so she is the first.

Fourth: change the password Steam and end all active sessions in the security settings.

Fifth: revoke the Web API key. Only now, when access is already closed.

Sixth: check your trade history, active offers and settings to see if there are any new bindings.

Prevention

The only reliable protection is not to give away access. Visit the sites using your bookmarks, and not via links from messages. Do not enter Steam data on pages that open themselves. Do not run programs sent in a personal message, even from friends.

And a habit that catches the scheme at the last step: in mobile confirmation, always look at the partner’s permanent SteamID, and not at the nickname and avatar. If an offer is canceled and a new one comes, stop and check from scratch. It is at this moment that the scheme works.