This guide is for two kinds of readers: players who suspect someone else has been signing into their Steam account, and players who already can't get in because the password or email has been changed. Our basic article on phishing prevention (Steam Account Security) covers how to avoid trouble in the first place. This one is about what happens after something has gone wrong: how to read the warning signs, what to do in the first hour, how to get the account back through Steam Support, and how to close the hole so it doesn't happen twice.
Anyone who has been gaming since the days of boxed discs and printed CD keys remembers when a game collection lived in a desk drawer. Today it lives almost entirely inside a single online account, together with wallet funds, tradable items and years of friends. Speed matters: the sooner you act, the more you can protect.
Signs Your Account May Be Compromised
One of these on its own is not proof, but if several show up together, treat it as an emergency.
Sign-in and notification signs
- Steam Guard codes you didn't request arrive by email. Someone is trying your password, which means it has leaked.
- "Password changed" or "email changed" notifications you didn't trigger. This is the most urgent signal of all.
- Sign-in approval prompts in the Steam Mobile app that you didn't start. Never approve them.
- The Steam client logs you out unexpectedly, or your password suddenly stops working.
Account content signs
- Your profile name, avatar or summary has changed, or there are comments and chat messages you never wrote.
- Friends receive suspicious links from you, such as "vote for my team" or "cheap trading site".
- Inventory items are missing or your trade history shows trades you didn't make.
- Wallet balance has dropped, unfamiliar purchases appear, or items are listed on the Community Market without your knowledge.
- Trade offers behave strangely, for example an offer you sent is cancelled and replaced. This can indicate a hijacked Web API key, explained below.
First Steps: Take Back Control
If you can still sign in, work through these steps in order. The idea is to cut off the attacker's session first, then fix the entry point.
- Sign in from a device you trust. Avoid the computer or browser where you clicked a suspicious link.
- Change your Steam password to a new one you have never used anywhere else.
- In Steam Guard settings, choose "Deauthorize all other devices" so every existing session is signed out.
- Confirm the email address and phone number on the account are still yours. If they've changed, note the time and prepare to contact Support.
- Change the password on your email account too, and turn on two-factor authentication there. Many Steam takeovers start with a compromised mailbox.
- Visit the Web API key page (steamcommunity.com/dev/apikey). If a key exists that you didn't create, revoke it.
- Review your inventory, trade history and purchase history, and take screenshots of anything unusual for your support request.
Why the Web API key matters
Steam Web API keys are meant for developers and sites that integrate with Steam. Scammers who gain access to an account often register a key quietly. With it they can watch your trade offers, cancel a legitimate one the moment you send it, and resend it from an account that copies your trading partner's name and avatar. You think you're trading with a friend; the items go to the scammer. Most players never need an API key, so an unfamiliar key is a strong sign of compromise.
Locked Out: Filing a Recovery Request with Steam Support
If the password or email has been changed and you can't fix it yourself, you need Steam Support at help.steampowered.com. Type the address into your browser yourself rather than following any link from a message or email.
- Open help.steampowered.com and choose the option for being unable to sign in or having a stolen account.
- Enter your account name and the email or phone number originally attached. Steam may first try to verify you through those channels.
- If the attacker has replaced your contact details, choose the option saying you no longer have access, and the site will walk you through an account recovery request.
- Fill in the request in as much detail as possible and provide information that proves you own the account.
- Wait for a reply at the email address you supplied. Avoid flooding Support with duplicate requests.
Response times vary with case complexity and support volume. Check Steam's official support pages for the current process and requirements.
What ownership proof to gather
Support looks for information only the real owner would have. The more of this you can provide, the better:
- Proof of purchase: payment details used on the account, such as the last four digits of a card, transaction IDs, receipts or purchase confirmation emails.
- Product keys activated on the account, including keys from boxed games or authorized stores.
- The original email address used to create the account, plus any others attached over the years.
- Phone numbers that were linked to the account.
- Rough account creation date, usual sign-in location, and your account name (the sign-in name, not your display name).
If you top up your wallet with prepaid cards or vouchers, which is common in many regions including Taiwan, you won't have card digits to offer. Keeping those receipts and code screenshots becomes much more important. A dedicated email folder for Steam receipts is a simple habit that pays off.
Things to Watch Out For
- Steam Support will not contact you on Discord, social media or Steam chat. Anyone claiming to be Support and asking for your password or codes is a scammer. Real communication happens only inside the ticket system at help.steampowered.com.
- Avoid third-party "account recovery services." They want your personal and payment details, and some are simply a second scam.
- Never put your password in a support request. Support does not need it to verify you.
- Not every lost item or trade can be restored. Steam has its own policies on stolen items; rely on what Support tells you rather than expecting a full rollback.
- Expect temporary trade or Market restrictions after recovery. They exist to stop the account from being emptied again.
Hardening the Account Afterwards
Getting the account back is only half the job. Now close the original gap and raise your overall protection.
Turn on the Steam Guard Mobile Authenticator
Steam Guard works either through email codes or through the authenticator in the Steam Mobile app. The mobile authenticator is stronger: every sign-in needs a code generated on your phone or an approval in the app, so a leaked password alone isn't enough. It also helps you avoid some trade holds.
When you enable it, Steam gives you a revocation code. Write it down on paper or store it in a password manager. If you lose or replace your phone, that code is what lets you remove the authenticator without going back through Support.
Close every other door
- Email account: new password, two-factor authentication, and a check for forwarding rules. Attackers often add a silent forward so they keep receiving your Steam mail.
- Computer and browser: run a malware scan and remove browser extensions you don't recognize. Session-stealing malware is often disguised as game "helpers" or free skin generators.
- Third-party sites: review trading or community sites you signed into with Steam and remove access you no longer use.
- Password reuse: if your old Steam password was used elsewhere, change it on every one of those sites.
Warn your friends
If your account sent messages while it was compromised, post a note on your profile or in your groups so friends know not to click anything from that period. Account takeovers spread through friend lists, so this protects them too.
Common Mistakes
- Changing the password but not deauthorizing other devices. Existing sessions may stay valid.
- Fixing things on an infected PC. If malware caused the breach, your new password may be captured too.
- Forgetting the email account. Whoever controls the mailbox ultimately controls the Steam account.
- Not saving the revocation code, then discovering the problem when switching phones.
- Accepting help from strangers claiming to be Support. Panicked users are prime targets for a second scam; see our scam guide (Common Steam Scams Explained) for the common scripts.
FAQ
Q: Will I lose my games if my account is stolen?
Game licenses generally stay attached to the account, and an attacker usually can't move purchased games to another account. Tradable items, wallet funds and Market assets are more at risk. After recovery, your library normally remains in place, but the final outcome depends on Support.
Q: I've never paid by credit card. Can I still prove ownership?
Yes, you can offer other evidence: activated product keys, the original email address, linked phone numbers, prepaid card receipts and purchase confirmation emails. The more complete your evidence, the easier the case.
Q: I had the mobile authenticator on. How was I still compromised?
Usually the user typed their password and code into a fake site, approved a sign-in in the app that they didn't start, or scanned a QR code on a phishing page. The authenticator stops a leaked password, but not credentials you hand over yourself.
Q: Can a friend or a paid service handle recovery for me?
It's not a good idea. Recovery needs the owner's own information, and handing it to a third party exposes it again. File the request yourself at help.steampowered.com and keep all communication inside the official ticket.
Q: Can I trade right after getting my account back?
Not necessarily. After a password reset, device change or authenticator change, Steam may temporarily restrict trading or Market use to keep the account from being drained again. Check Steam's official support pages for current hold periods.