How Do Steam API Scams Work?
To understand, how Steam API Scams work, you need to know several key concepts:
Steam API is an interface that can be used by third-party websites to interact with your Steam account. It is used by developers or to establish interactions with certain web services, and common players do not need to use it.
Steam API Key is a unique identifier that is tied to the account of a particular player and allows a person or website who knows it to perform certain actions with this account.
Web API Token is another identifier that is used to gain access to the player’s account. Scammers have started to use it instead of the Steam API key, as the latter is easier to detect.
Whether scammers use a Steam API key or a Web API Token, the principle of the scam is the same:
The user is lured onto a phishing site. It may promise free skins, participation in competitions, or some other rewards.
The phishing site steals your Steam account data.
Scammers use it to generate a Steam API Key or a Web API Token for your account.
Later on, they use the access they gained to substitute your trades and steal your items.
Tips on How to Avoid Steam API Scam
Firstly, to protect yourself from a Steam API Scam, follow all basic cybersecurity rules. Do not enter your credentials on suspicious websites, check their reputation on trusted resources, and always be careful about where you log in with your Steam account. Beware of the website promising guaranteed rewards or free skins. Even if you are visiting a reputable site, always check its address, because phishing sites often use addresses with one or two different letters. Besides that, these rules will help you to avoid being API scammed:
Visit this link to check if there is a Steam API Key attached to your account. If there is one, revoke it and change your account password immediately.
Change your trade link regularly for additional security.
Change your password before every major transaction. When you do this, all tokens and access keys are revoked.
As you can see, detecting Steam API Scams is easy, as you can just check it in your account. Web API Tokens are different, as they are not displayed anywhere. Scammers can generate them through phishing websites and then renew them to keep access to your data. The only way to remove the token is to change your password. Consequently, preventative measures, such as avoiding suspicious links, become more important.
How to Verify a Trade Before Confirming
Whenever you conduct a trade, for example, if you want to exchange skins with another player, or sell them through a third-party website, follow this steps to avoid API scam or detect scam attempts and protect yourself from them:
Always have Steam Guard enabled for your account to protect it from malicious actions.
Do not confirm the trade right away after you get an offer.
Verify the info about the other person. Check the item you offer and get.
Looking at their avatar isn’t enough - visit their profile and compare all the details to what you know. Scammers can impersonate real users through copying their profile pictures. Here is an example of how to detect a fake account.
Check your account to ensure the trade hasn’t been cancelled. If someone attempts to scam you, you will see two recent trade attempts, one cancelled and one active in your trades history. You can access your trade history from your Inventory profile page.
Confirm the trade only if you are sure it is legit.
If you notice something suspicious, the best course of action will be to cancel the trade, change your account password and try again. Remember, better safe than sorry!
How to Check if I Have Been Scammed on Steam?
The most obvious way to notice the activity of the scammers is to check your Steam API Key on a corresponding page. Besides that, here are several other tips that can help to notice suspicious activity:
Stay vigilant and do not rush things when conducting trades. Carefully check the name and profile of the receiver. Just looking at the avatar isn’t enough, as malicious bots can copy them. Read a guide about selling items on Steam before conducting major trades.
Before confirming a trade, wait for a while. Check your account. If the information about a canceled trade has appeared, scammers are trying to substitute it with a fake one.
Confirm the trade only after verifying all the details. If something doesn’t seem right, it is better to cancel and change your password just to be safe.
What to Do If I Got API Scammed on Steam?
To get help if you got API Scammed on Steam, immediately contact Steam Support via its official page. Change the password of your account and try to keep as much information as possible, such as screenshots of the trades or the lost items, so the support can help you more efficiently.
But remember: Steam Support will never write you via private messages in the chat. If someone is messaging you claiming they can help to return lost items, they are most likely another scammer. Just report them and contact the support through official means instead.
This information will help you detect if you are at risk of being API scammed and, what is even more important, avoid risky situations and prevent the API scam in the first place.
Write comment