Steam Account Hacked? How to Recover It and Protect Your Items

If your Steam account was hacked, secure the email address on the account first, then go to Steam Support at help.steampowered.com, typed in yourself, and use its option for a hacked or stolen account to reset your password and recover access. Once you’re back in, turn on the Steam Guard mobile authenticator, deauthorize all other devices, revoke any Web API key you didn’t create, and check your trade history, market listings, wallet and friends list for anything the hacker did.

Steam accounts are targeted because they hold things with resale value: games, wallet funds and tradeable items. Most takeovers start with a fake login page or a scam message from a “friend”. This guide covers recovery, the cleanup, and the trade scams that keep catching people.

Signs your Steam account was hacked

• Emails from Steam about a password, email or Steam Guard change you didn’t make, or login codes you didn’t request.
• Items missing from your inventory, or trades and market listings you didn’t make.
• Wallet funds spent or purchases and gifts you didn’t buy.
• Friends asking about messages you didn’t send, often links to “vote for my team”, free skins or a trade site.
• Your profile name, avatar or privacy settings changed.
• A game ban or community ban for activity you don’t recognize.

Step 1: Secure your email

Steam sends password resets and Steam Guard email codes to the address on your account. If the hacker controls that inbox, they can undo your recovery.

1. Change your email password and turn on two-step verification.
2. Sign out of other sessions and remove any forwarding rules or filters you didn’t create, especially ones that delete or hide mail from Steam.
3. If the email itself was taken over, recover it first. Our guide for when an email account is hacked explains how.

Step 2: Recover the account through Steam Support

If you can still sign in

1. Change your password to a long one you’ve never used anywhere else.
2. Check the email and phone number on the account, and restore your own if they were changed.
3. Turn on the Steam Guard mobile authenticator in the Steam Mobile app. It’s stronger than email codes and lets you confirm trades and market listings on your phone.
4. Use the option in your Steam Guard settings to deauthorize all other devices. This signs out every session, including the hacker’s.

If you’re locked out

Go to Steam Support and choose the help option for a hacked or stolen account. Steam will try to send a reset code to your email or phone. If the hacker changed those, Steam Support lets you submit a request with proof of ownership. Useful evidence includes the original email address, the country you usually play from, and details of a card purchase on the account, which you can find on your bank statement. Recovery through Steam Support is free.

Submit one request and wait for a reply through the support ticket, rather than opening several. Keep the ticket number and reply only within that ticket.

Step 3: Check what the hacker did

Area	What to look for	What to do
Web API key	A key registered on your account that you didn’t create	Revoke it straight away (see below)
Trade history and offers	Trades you didn’t make, pending offers you don’t recognize	Cancel pending offers; note trade details for your ticket
Community Market	Listings or sales you didn’t make	Cancel active listings; note sales for Steam Support
Wallet and purchases	Spent funds, gifts or games bought for other accounts	Report through Steam Support
Authorized devices and Family	Unknown devices, Family members or sharing you didn’t set up	Deauthorize devices; remove unknown members
Friends and chat	Scam links sent to friends; new friends you don’t know	Warn friends; remove unknown contacts

Why the Web API key matters

One common trick is to register a Web API key on a hacked account. That key can let a scammer see and interfere with your trade offers, for example by cancelling a real trade and sending a lookalike one from an account that copies your trade partner’s name and avatar. Even after you change your password, a key left in place can keep that scam running. Check the API key page on Steam’s site, reached from your account, and revoke any key you didn’t create.

Step 4: Missing items, bans and payments

• Items and wallet funds: include the details in your Steam Support ticket. Steam’s policies on restoring traded or sold items are limited and can change, so don’t assume items will come back. Check Steam Support’s own pages for what currently applies.
• Bans: if the account picked up a game or community ban while the hacker had it, raise it with Steam Support after recovery, but be aware some bans can’t be reversed. If you’d rather close the account once it’s back, our guide on how to delete a Steam account explains what you’d lose.
• Card charges: if a linked card was used, contact Steam Support first, then your card issuer. A chargeback on a Steam purchase can lead Steam to restrict the account, so ask Steam Support how to handle unauthorized charges before disputing them.
• Warn your friends through another channel. Your account may have sent them the same phishing link that caught you.

Trade and market scams to know

Most hacked Steam accounts, and most lost items, come from a handful of repeated scams. Our guide to Steam scams covers them in more depth.

• Fake login pages. “Vote for my team”, “claim free skins” and fake gambling or trading sites show a Steam sign-in box that looks real. Only sign in on Steam’s own site or app, and check the address yourself.
• QR code logins. A site asks you to scan a QR code with the Steam Mobile app to log in. If the site is fake, scanning approves the scammer’s login.
• “I accidentally reported you”. A stranger says your account will be banned and sends you to a fake Steam admin on chat or Discord, who asks for your login or items. Steam doesn’t work that way.
• Impersonated trade partners. An account copies a friend’s name and avatar to intercept a trade. Always check the trade partner’s profile and account level before confirming.
• Items “held” for verification. Anyone who asks you to send items to prove they’re real, or to “release” your inventory, is running a scam.
• Recovery offers. Accounts that offer to recover your items or account for a fee are scams. Only Steam Support can recover a Steam account.

A worked example

This scenario is illustrative, not a real client. Mateo gets a message from a friend’s account: “Can you vote for my team in this tournament?” The link opens a page with a Steam sign-in box. He signs in and enters his Steam Guard code. Hours later, his email shows a Steam notice about a new device and his most valuable items are gone.

1. He changes his email password and turns on two-step verification.
2. He resets his Steam password through Steam Support, then deauthorizes all other devices.
3. He finds a Web API key he didn’t create and revokes it.
4. He turns on the Steam Guard mobile authenticator so trades now need confirmation on his phone.
5. He opens one Steam Support ticket with the dates, the trade details and the phishing link, and messages his friend by text to say their account is sending scam links too.

The fake login page was the entry point. Signing in only on Steam’s own site or app would have stopped it, even with the link sent from a friend’s real account.

Common mistakes

• Recovering Steam before the email. The hacker can reset it again.
• Forgetting the API key. It can keep trade scams running after a password change.
• Opening several support tickets. One clear ticket is easier to handle.
• Filing a chargeback before talking to Steam Support. It can restrict the account.
• Trusting a “Valve employee” in chat. Steam Support uses tickets, not friend requests.

How to protect your Steam account

• Keep the Steam Guard mobile authenticator on, and save your recovery code somewhere safe.
• Use a unique password in a password manager.
• Sign in only on Steam’s own site or app, and never scan a QR code from an unfamiliar site.
• Check your API key page and authorized devices every few months.
• Check whether your email appears in known breaches with Have I Been Pwned.
• If you also use Discord, which is a common source of Steam scam messages, see our guide for a Discord account hacked.

The general checklist for every platform is in our hub on what to do when your account was hacked. If your hacked account was used to post or message things that are now tied to your name or your streaming or creator brand, our social media reputation management team can help with the cleanup.

Frequently asked questions

How do I recover a hacked Steam account?

Secure your email, then go to Steam Support at help.steampowered.com and choose the option for a hacked or stolen account. If the email and phone were changed, submit proof of ownership, such as the original email and details of a card purchase on the account.

Will Steam give back my stolen items?

Don’t count on it. Steam’s policies on restoring traded or sold items are limited and change over time. Include the details in your Steam Support ticket and check Steam Support’s pages for what currently applies.

How did my Steam account get hacked with Steam Guard on?

Usually through a fake login page that captures your password and Steam Guard code together, a QR code login scam, or an API key set up during an earlier compromise. Steam Guard stops password-only attacks, but not someone you’ve handed a live code to.

Should I delete my Steam account after it was hacked?

Usually not, since deletion removes your games and purchases permanently. Recover and secure it instead. If you do decide to close it, our guide on how to delete a Steam account explains what happens.