This guide is for anyone who uses Steam's friends list, chat, trading or Community Market, and especially for new traders and parents whose kids play on Steam. By the end you'll recognize the scam scripts that keep circulating, understand what the scammer is actually trying to get, and have a short routine to follow whenever a message feels off.
Our basic security article (Steam Account Security) covers passwords and Steam Guard. This one goes scam by scam. The details change constantly, but the goal is almost always one of three things: access to your account, your items, or your money. Keep those three in mind and most "new" tricks become easy to spot.
What Scammers Are After
- Account access: your password, Steam Guard codes, an approval in the mobile app, or a session created when you scan a QR code. With any of these, everything in the account is theirs.
- Items: tradable in-game items and cosmetics that can be sold on the Community Market are the easiest assets to cash out.
- Money: getting you to top up your wallet, buy gift cards, or pay a "deposit" or "unlock fee."
Game licenses generally can't be transferred, so your library is rarely the target. What scammers want are tradable items, wallet funds, and a trusted account they can use to scam your friends next.
The Common Scams, One by One
Fake trades and hijacked trade offers
A stranger adds you, offers an unusually good price for one of your items, and sends a link to a "trading site" or "price checker" that asks you to sign in. The page is a copy of the Steam login, and whatever you type goes straight to the scammer.
A quieter variant starts after the scammer has already gained access to your account and created a Web API key. When you send a genuine trade offer, it's cancelled automatically and recreated by an account that copies your partner's name and avatar. The confirmation in the mobile app looks normal, but the items go to a stranger.
The giveaway: real trades happen inside Steam's own trade window and never require signing in on an outside site. Before confirming, check the other account's level, creation date and profile URL, not just the name and picture.
Fake support staff and fake admins
Someone claiming to be "Steam Support," a "Valve employee" or a "community moderator" contacts you through Steam chat, Discord or another app. They say your account broke the rules and is about to be banned, so you need to "verify" it. Verification means sharing your password or codes, sending screenshots of Steam Guard, or buying gift cards as a "deposit."
The giveaway: Steam Support communicates only through tickets at help.steampowered.com. It doesn't send unsolicited chat messages and never needs your password or codes. No Valve employee will ask you to trade or pay to prove anything.
"I accidentally reported you"
A long-running script: a friendly stranger, or a "friend of a friend," says they reported your account by mistake, or that a payment went wrong using your name. Your account will be banned unless you contact a particular "admin" right away. The admin then asks you to prove your innocence, which ends with you handing over the account, items or money.
The giveaway: Steam has no process where an accidental report leads to a ban that must be settled privately with a specific person. The moment you're told to contact a named individual, you can be nearly certain it's a scam.
Fake giveaways
Messages or profile comments say "you've been selected" or "free skins for our anniversary," with a link that requires signing in with Steam to claim. Some impersonate well-known streamers or game studios.
The giveaway: real Steam promotions appear in the Steam store or client, not in a link from a stranger. Claiming a free game on Steam only requires clicking the button on the official store page. Every game on our free games page (Free Games) links to its official Steam store page.
Phishing links and fake login pages
Nearly every scam eventually leads to a fake Steam login. These pages look almost identical to the real thing, but the domain may be a near-miss spelling, have extra characters, or use an unrelated top-level domain. Some show a pop-up that looks like a Steam sign-in window but is actually drawn inside the web page, fake address bar included.
The giveaway: legitimate Steam sign-in happens only in the Steam client, the Steam Mobile app, or on steampowered.com and steamcommunity.com. If you're unsure about a pop-up, try dragging it outside the browser window. A fake window drawn by the page usually can't leave the browser.
Fake tournament votes
A friend's account messages you: "Our team is in a tournament, can you vote for us?" The voting site requires a Steam login. Because the message comes from a real friend, many people don't hesitate. In reality, that friend's account has usually been compromised and is spreading the same trap.
The giveaway: voting or registering for an event shouldn't require signing into a third-party site with Steam. Ask your friend directly through another channel, like a phone call or a different messaging app.
QR code login scams
The Steam Mobile app can sign you into Steam on a computer by scanning a QR code. A scam site requests a genuine login QR code from Steam in the background and shows it on its own page, dressed up as "scan to claim your reward" or "scan to verify." When you scan and approve, you've signed the scammer in.
The giveaway: only scan a Steam QR code when you yourself are signing into the Steam client or Steam's official website. If any outside site asks you to scan with the Steam app, close it.
A Routine for Suspicious Messages
- Pause. Don't click anything while you feel rushed. Time pressure is a scammer's favourite tool.
- Check who you're dealing with: profile URL, account level, creation date and mutual friends, not just the display name and avatar.
- Don't follow links from the message. Type Steam's address yourself or use the Steam client.
- Refuse any request for your password, codes, a QR scan or gift cards.
- If the message came from a friend, confirm through a different channel that they really sent it.
- Report the account with Steam's built-in reporting tool and block it.
- If you've already entered details or approved a sign-in, follow our recovery steps immediately (Steam Account Stolen? Warning Signs, the Recovery Process and Hardening Steam Guard).
Things to Watch Out For
- The packaging changes, the goal doesn't. New scripts borrow new games, events and holidays, but if they end with an outside login, a verification code or a payment, stop.
- Links from friends aren't automatically safe. A compromised account's friend list is the first thing a scammer uses.
- Never share screenshots of your Steam Guard screens. The information can be used to complete verification.
- Wallet funds and gift cards are for your own use. Anyone asking to be paid in gift cards is running a scam; our wallet and gift card guide (Steam Wallet and Gift Cards) explains more.
- Parents can agree on simple rules with children: don't click links from strangers, never sign in on outside sites, and ask an adult whenever a message says the account will be banned.
FAQ
Q: The person says they work at Valve and their profile has an official-looking badge. Can I trust them?
Profile names, avatars, summaries and images that look like badges can all be set or faked. Valve staff don't message players to verify accounts or request trades. Genuine support happens only at help.steampowered.com.
Q: I opened the link but didn't type anything. Am I in danger?
Simply opening a page is lower risk, but don't download files or install extensions it offers. If you're worried, change your password, deauthorize other devices and run a malware scan as a precaution.
Q: How do I make sure a trade partner is really who I think?
Open their profile from inside the trade window and compare the account level, creation date and profile URL with what you know. Scam accounts copy names and avatars easily, but can't copy an account's history.
Q: Can I get scammed items back?
Steam has its own policies on scammed or stolen items, and restoration isn't guaranteed. Prevention is far more reliable. If your account was compromised, regain control first, then explain the situation to Support; check Steam's official support pages for the current rules.
Q: Why does every scam want me to sign in on an outside website?
Because inside Steam's own interface, they can't see your password or codes. Once you're on a page they control, everything you type is recorded. That gives you the simplest rule of all: only sign in through the official Steam client, app and domains.