Steam Account Scams in 2026: The 8 Tricks Thieves Use and How to Stop Them

A Steam account with a few years of games on it is worth real money to a thief, and an account holding wallet funds or tradeable items is worth even more. Almost every theft uses one of a small number of tricks. Learn to recognise them and you are very hard to rob.

1. "I accidentally reported your account"

How it goes: A stranger, or a friend whose account has already been stolen, messages you in a panic. They "accidentally reported" you, your account is "about to be banned", and you need to talk to a "Steam admin" on Discord to sort it out. The "admin" then asks you to log in on a link, share your Steam Guard code, or "verify" by buying a gift card.

The truth: Valve does not handle reports this way. No Valve employee will ever contact you on Discord, and nobody can fix a ban by asking for your login. Block them and move on.

2. The API-key trade hijack

How it goes: You log in on a fake trading or giveaway site that quietly creates a Steam Web API key on your account. With that key, a bot watches your trade offers. When you get a real offer, the bot cancels it and sends an identical-looking one from an impostor account with the same name and avatar. You confirm it on your phone, and your items go to the thief.

The defence: Check steamcommunity.com/dev/apikey now. If there is a key you did not create, revoke it and change your password. Before you confirm any trade on your phone, check the receiving account's level and join date. Impostor accounts are usually brand new.

3. Fake login pages

How it goes: A link (for a "tournament vote", a "free skin", or "is this you in this screenshot?") opens a page that looks exactly like the Steam login, including a Steam Guard box. You type everything in, and the scammer's script uses it on the real Steam a second later.

The defence: Never log in to Steam from a link someone sends you. Type steamcommunity.com or store.steampowered.com yourself, or use the Steam app. Check the exact domain. Look-alikes such as "steamcommunlty" are common.

4. QR-code login theft

How it goes: A site asks you to "log in with the Steam app" by scanning a QR code. The code is real, but it belongs to the scammer's login session. Scanning it approves their login to your account.

The defence: Only scan a Steam QR code shown by the Steam client or Steam's website on your own screen, and only when you started the login yourself.

5. Fake giveaways and "free gift" messages

How it goes: "Congratulations, you won a $50 Steam gift card / a knife skin / a free game!" It leads to one of the fake login pages from #3, or asks for a small "verification fee".

The defence: Real Steam gifts arrive as a Steam notification with an Accept button. Nobody needs your password to send you anything. Our guide to how Steam gifting works shows what a real gift looks like.

6. The trade "middleman" and quick switch

How it goes: In a high-value trade, a "trusted middleman" (who works with the scammer) offers to hold the items. Or the other person swaps a valuable item for a look-alike just before the trade goes through.

The defence: Steam trades do not need a middleman. Read the final trade window, not the chat, before you confirm.

7. "Sell me your Steam Points / wallet balance"

How it goes: Offers to convert Steam Points or wallet money into PayPal or crypto.

The defence: Neither can be legitimately converted. Steam Points have no cash value, and wallet funds cannot be withdrawn. These offers exist only to get your login.

8. Fake gift card "generators" and "free wallet codes"

How it goes: A site or video promises unlimited Steam wallet codes. It wants you to complete "human verification" surveys, install an app or log in.

The defence: Code generators do not exist. Steam codes are issued by Valve and its retailers, and nobody can generate valid ones. Legitimate rewards sites pay out real codes they bought, slowly, in exchange for real activity. Our rewards-site scam checklist explains how to tell the two apart.

The 5-minute lockdown checklist

1. Turn on the Steam Guard Mobile Authenticator. It is the strongest protection you have, and it is required for instant trades anyway.
2. Check steamcommunity.com/dev/apikey and revoke any key you did not create.
3. Use a unique password that you use nowhere else, and change the password on the email account linked to Steam too.
4. Review Steam Guard's list of authorised devices and remove any you do not recognise.
5. Set your inventory to private if you are not actively trading.

If it already happened

• Use help.steampowered.com → My account was stolen straight away. Steam can recover accounts, especially if you still control the linked email.
• Tell your Steam friends, because thieves use stolen accounts to scam the victim's friends list next.
• Items traded away are not always restored. Recovering the account is the priority.

A word on rewards sites

Legitimate rewards sites never need your Steam login. They send you a code, and you redeem it yourself on Steam. That is how XPReward pays out: a Steam, PSN or Xbox code delivered to your account, which you enter on the official store. If any site, including one claiming to be us, asks for your Steam password, it is a scam. You can check how payouts work on our trust page.