Steam Scams: Fake Trades, Phishing Links and Fake Support

Most Steam scams try to get one of two things: your login, or your items. The common versions are fake trade offers, “vote for my team” or “free skins” links that lead to fake Steam sign-in pages, strangers pretending to be Steam support, and tricks that get you to hand over a Web API key so a scammer can hijack your trades. If something asks you to sign in, scan a QR code or confirm a trade you didn’t expect, stop and check it inside the official Steam app or website yourself.

If you’ve already been caught, you’re not careless. These scams are run by organized groups who test their messages on huge numbers of players, and they deliberately target moments when you’re excited about a trade or worried about a ban. This guide explains how they typically work, what to do right now and how to make the next attempt fail.

What a Steam scam is and why gamers are targeted

Steam accounts hold real value: game libraries, Steam Wallet funds and tradable items such as skins, cards and cases that can be sold on the Community Market or third-party sites. That makes an account worth stealing even if you’ve never spent much on it.

Scammers usually reach you through Steam friend requests and chat, Discord servers, in-game messages, trading forums or social media. Many use accounts that look established, sometimes because they were stolen from another player first. If your account has already been taken over, start with our guide on what to do if your Steam account is hacked, which covers recovery step by step. This guide focuses on recognizing and avoiding the scams themselves.

Common Steam scams

The details change constantly, but most Steam scams fall into a few patterns.

Fake trade offers and trade swaps

A trade looks fair when you agree to it, but the version you’re asked to confirm is different. Common tricks include an account that copies a friend’s name and avatar, an item that has the same name but a lower-value variant, and a “middleman” who offers to hold items for both sides. Some scammers ask you to send your items first “to check they’re real” or to “verify your inventory”. Legitimate trades happen in one trade window, with both sides visible, and you confirm them yourself.

“Vote for my team” and “free skins” phishing links

A friend (or an account pretending to be one) asks you to vote for their esports team, check out a tournament, claim a giveaway or look at a trading site. The link opens a page with a Steam sign-in box that looks real. When you type your details and Steam Guard code, the scammer uses them at the same moment to take over your account. Some versions show a QR code to scan with the Steam Mobile app instead; on a fake site, scanning approves the scammer’s login.

Fake Steam support and “I accidentally reported you”

A stranger says they reported you by mistake and your account will be banned unless you contact a “Steam admin”, often on Discord. The fake admin then asks for your login, your Steam Guard code, a payment to “restore” the account, or for you to send items to a “verification” account. Steam support works through its official Help site, not through friend requests or Discord messages, and staff don’t need your password.

Web API key scams

Steam lets people create a Web API key for developer tools. Scammers get victims to register a key, usually through a fake sign-in or a fake trading site that asks for “access”. With a key tied to your account, a scammer may be able to watch your trade offers and, in the versions reported by players, cancel a genuine offer and quickly send a lookalike one that goes to the scammer instead. The Steam account hacked guide explains how to check for and revoke a key. The warning sign is simple: you didn’t ask for an API key, so you don’t need one.

Wallet, gift card and “overpay” scams

Some scammers ask for Steam gift cards as payment for something outside Steam, such as a fake item sale, a fake prize or a threat. Others pretend to overpay you on a third-party site and ask for the difference back. Gift cards used this way are very hard to recover, which is why they’re popular with scammers. Our guide to gift card scams covers the wider pattern.

Warning signs of a Steam scam

• Anyone asks for your password, Steam Guard code or a QR scan outside the official Steam login you opened yourself.
• A link to sign in sent by a friend, especially one who suddenly writes in a different style or language.
• Urgency about a ban, a report or a “suspended” account, with instructions to contact someone off Steam.
• A trade that changes between agreement and confirmation, or a trade partner whose profile, level or history doesn’t match the friend you know.
• Requests to send items first, to a “middleman”, or to prove something.
• Deals that are too good: rare items for far less than market value, or free skins for doing almost nothing.
• Anything to do with API keys that you didn’t set up yourself for a tool you actually use.

What to do right now if you think you’ve been scammed

1. Stop contact. Don’t reply, don’t argue and don’t send anything to “fix” the problem. Save screenshots of the chat, the profile URL, the trade offer and any links first.
2. Secure your email account. Your Steam account is only as safe as the email behind it. Change that password and turn on two-step verification.
3. Change your Steam password from the official app or by typing Steam’s address yourself, and make sure the Steam Guard Mobile Authenticator is on.
4. Sign out other devices and check for API keys. Steam’s account settings let you deauthorize other devices. If a key exists that you didn’t create, revoke it.
5. Look at your trade history and pending offers. Cancel anything you don’t recognize.
6. If you paid with a card or PayPal, contact your bank or PayPal using the number on your card or inside the official app and explain it was fraud.

If you reused your Steam password elsewhere, change it on those accounts too. Our guide on what to do when an account is hacked has the steps for other services.

Where to report a Steam scam

• Steam itself. Report the scammer’s profile from their Steam Community page, and contact Steam Support through the official Help site for account problems.
• Discord or the platform where it started, if the fake admin or link came from there. Our guide to Discord scams covers that side.
• The FTC at ReportFraud.ftc.gov, and the FBI’s Internet Crime Complaint Center at ic3.gov if you lost money or valuable items.
• IdentityTheft.gov if the scammer got personal information such as ID documents or card details.

For a full list of routes, including options outside the US, see how to report a scammer.

Can you get items or money back?

Be realistic here. Steam’s support pages explain that items you traded away yourself generally can’t be restored, so treat a completed trade as final. If your account was hijacked rather than you trading willingly, Steam Support may be able to help with the account, but outcomes vary and depend on Steam’s own review.

Money is a different question. Card payments can often be disputed through your card issuer, and PayPal has its own dispute process. Steam gift cards, crypto and payments on unofficial trading sites are often hard or impossible to reverse. Be aware that disputing a Steam purchase itself can affect your Steam account, so ask Steam Support first where the charge was made through Steam.

After a scam, you may get messages offering to “recover” your items or account for a fee. Only Steam Support can restore a Steam account, and anyone charging to do it is almost always running a second scam. Our guide to recovery scams explains the pattern.

A worked example

This is an illustrative scenario, not a real person. A 16-year-old gets a message from a friend on his Steam list: “Can you vote for my team? We’re one vote off the finals.” The link opens a page that looks like a tournament site with a Steam sign-in button. He signs in and types his Steam Guard code.

A few minutes later he notices he’s been signed out. He tells his mom, who helps him act in order:

1. They secure his email account and change its password.
2. They use Steam’s official account recovery to change his Steam password, then sign out all other devices.
3. They check for an API key and find one he didn’t create, so they revoke it, then cancel two trade offers he didn’t send.
4. They message the real friend through another app, who confirms his own account was taken over and has been sending the link to everyone.
5. They report the phishing site and the account to Steam, and file a report with the FTC.

Because they moved quickly, the pending trades never completed.

For parents: keeping kids safe on Steam

Many Steam players are teenagers, and scammers know it. A few conversations help more than any setting.

• Agree on a rule: never sign in through a link someone sends, and never share a code, even with a friend.
• Use Steam’s family features to manage what younger children can access, including store purchases and community features. Check Steam’s Help site for the current options.
• Make it safe to tell you. Kids often hide a scam because they fear losing the account or getting in trouble. Tell them the fastest fix is telling you straight away.
• Watch for grooming and sextortion. Some predators use gaming chat to build trust and then ask for photos or move the conversation to other apps. If anyone asks your child for images or threatens them, don’t pay and don’t delete the account. Report it to the NCMEC CyberTipline, use NCMEC’s Take It Down service to help stop images spreading, and read our sextortion help guide. Don’t screenshot or save any sexual image of a minor; report the account and the link instead.

For emotional support and more reporting routes, our help resources page lists organizations that can help.

How to protect yourself from Steam scams

• Keep the Steam Guard Mobile Authenticator on and confirm trades only in the official app.
• Sign in only on Steam’s own app or site, reached by typing the address or using a bookmark.
• Use a unique password for Steam and a different one for your email.
• Be careful with third-party trading and gambling sites. Anything that asks you to log in with Steam or register an API key deserves extra suspicion.
• Verify friends outside Steam before acting on an unusual request.
• Check your account settings now and then for unknown devices or API keys.

If scammers are using your name, photos or gamer tag to fool other players, report the impersonating account and warn your friends. If it’s spilling into search results about you, our personal reputation management team can look at what’s showing up. If you decide to leave the platform, see how to delete a Steam account.

Common mistakes

• Arguing with the scammer or trying to trade them back. It only gives them more chances.
• Paying a fake admin to “unban” you. Steam doesn’t charge to resolve account issues.
• Changing only the Steam password. If the email is compromised, the scammer can take the account back.
• Posting accusations with a name or photo. The account may belong to another victim whose account was stolen. Report it instead.

Frequently asked questions

Will Steam support ever message me on Steam chat or Discord?

Treat any unsolicited message from “Steam support” on chat, Discord or social media as a scam. Contact Steam Support yourself through the official Help site or the Steam app, where your real support tickets appear.

Can Steam give me back items I lost in a scam trade?

Steam’s support pages explain that items traded away generally can’t be restored, so treat completed trades as final. If your account was hijacked, contact Steam Support through its official Help site and explain what happened.

What is a Steam API key scam?

It’s when a scammer gets you to register a Web API key, often through a fake sign-in page. With it, they may be able to monitor and interfere with your trade offers. If you find a key you didn’t create, revoke it and change your password.

Is it safe to scan a Steam QR code on a website?

Only on Steam’s own login page that you opened yourself. Scanning a QR code on a fake site approves the scammer’s login to your account.