Understanding the Steam API Scam: Protect Your Inventory
The API Scam is a common and clever fraud on Steam designed to steal your valuable in-game items. While it uses technical terms, the scam relies on tricking you, the user.
Remember this fundamental rule: An API key alone cannot complete a trade. Every trade still requires a final confirmation via your Steam Guard Mobile Authenticator.
Step 1: How the Scam Is Set Up
The scam begins when a user is lured to a fake website (e.g., a "free skins" site, a fake trading platform, or a gambling site). This is a phishing attack.
To use the site, you are asked to "Sign in through Steam." The login page looks identical to the real Steam, but it is fake. When you enter your username, password, and Steam Guard code, the scammers steal this information.
Scammers immediately use a script to access your real account and generate a unique Steam Web API Key. This key allows them to monitor your account’s trade offers.
What the scammers see and do:
(Image 1: The 'Register Steam Web API Key' page. Scammers use this page to create the key they will use to track your trades.)
Step 2: The Trap Is Sprung (Trade Interception)
Once the scammers have the key, they wait. The moment you initiate a trade with a real partner (like a friend or a trusted market bot), the scammer’s script detects it. In milliseconds, it performs a bait-and-switch:
It cancels your original, legitimate trade offer.
It creates a fake trade offer that looks identical. This fake offer comes from a scraper account that copies the avatar and name of your original trading partner.
You check your phone to confirm the trade. You see the familiar avatar and name. You click 'Confirm.'
The damage is done.
What your trade history looks like:
(Image 2: Post-scam trade history. The real offer is canceled (red 'X'), and the fake offer is accepted (green checkmark). Both happen simultaneously.)
Step 3: How to Spot the Fake and Protect Yourself
The critical moment is the final verification on your phone. Do not rush. A fake account cannot copy everything perfectly.
Before you confirm, verify these details of the account sending the offer:
Steam Level: Real partners (friends, big markets) have high levels (e.g., 50+). Scammer bots are almost always level 0 or 1.
Account Creation Date: This cannot be changed. If you are trading with an "old friend," but the account was created yesterday, it is a scam.
Name History: Click their name. Scammers often have many rapid name changes or no history.
What to check on your Mobile Authenticator:
(Image 3: Mobile confirmation screen. Verify User Level, Account Creation Date, and Name History. These are the three critical check points.)
Step 4: Emergency Action Plan (If Compromised)
If you suspect you have an API Key that scammers created, you must act in this specific order to secure your account:
Revoke the Key: Go to the Steam API Key page and click "Revoke my Steam Web API key." The field must be empty.
Deauthorize Devices: Go to your Steam Guard settings and click "Deauthorize all other devices." This kicks the scammers out of your session.
Change Your Password: Change your Steam password and your email password.
Step 1: Revoke the API Key:
(Image 4: The final confirmation step. Clicking "Yes, Revoke Key" in English is essential to stop the scammers' tracking tool.)
Step 2: Deauthorize Other Devices:
(Image 5: Steam Guard Management. Use the English "Deauthorize all other devices" button to force a logout of your account from every computer and phone, removing the scammers' access.)