How to secure a Steam account and respond to stolen CS2 items

Problem this solves

A sign-in or trade looks suspicious, and you need to know what to secure first.

What you can do afterward

Follow an ordered recovery process and check whether a CS2 trade is eligible for reversal.

A strong password and Steam Guard are useful protections, but an approval given to a deceptive sign-in request can still grant access. Recovering safely means checking the device, email, active sessions, and transactions together. This guide gives you an order of operations and explains what evidence to collect at each stage.

If you suspect a compromise: act in this order

1. Stop using the suspicious page or program. Do not enter a replacement password on a computer that may still be infected. Use another device you have reason to trust for the urgent recovery steps. On the affected computer, run updated malware checks and review recently installed applications and browser extensions. A clean scan alone does not prove an unfamiliar program was harmless. Valve advises securing the computer before resetting Steam credentials. [1]
2. Secure the email account associated with Steam. Change its password to a unique one and use the email provider’s security checkup. Review signed-in devices, recovery addresses and phone numbers, forwarding rules, and connected applications; remove anything you did not authorize. Enable the provider’s two-factor authentication. If you cannot access the mailbox, start its official recovery process and use Steam Support’s recovery route rather than repeatedly requesting messages to an inbox someone else controls.
3. Recover or change the Steam password. Open the Steam client or type help.steampowered.com into your browser yourself. Use the stolen-account recovery page and follow the prompts that match the access you still have. Make the new password different from your email password. A third party’s recovery service is unnecessary; do not give anyone a password, Guard code, SMS code, or recovery code.
4. Review and revoke sessions explicitly. Open Steam’s Authorized Devices. If access looks suspicious, use Sign out everywhere. Check your account’s email, phone, and authenticator settings for unauthorized changes. Do this alongside the password change; do not assume one action has dealt with every kind of access. Valve specifically recommends checking authorized devices. [2]
5. Check activity and preserve a short record. Review trade offers, trade history, Community Market activity, and account purchases. Cancel unrecognized pending offers or listings where Steam permits it. Record the approximate time, affected items, transaction or offer identifiers, and the other profile’s URL. Keep screenshots that show the transaction, without exposing passwords or codes. Check the recovery section below immediately if items have already moved.

Save a simple incident timeline: what you clicked or installed, what you entered or approved, when you noticed the problem, and what you changed. This helps you avoid repeating a compromised sign-in and gives Steam Support useful facts. Keep investigating the affected device before signing back into valuable accounts on it; if you cannot establish that it is safe, get help cleaning or reinstalling it.

Check whether CS2 trades can be reversed

CS2 trades have a specific recovery mechanism: Trade Protection. Items arrive immediately, then remain protected for seven days. During that period they cannot be transferred, consumed, or modified. This replaces trade escrow for CS2. [3]

1. Regain control of your account first. If you are unsure who still has access, contact Steam Support.
2. Open Steam’s eligible-trades page or your trade history and review the protected trades.
3. Read the reversal confirmation carefully. Reversal affects all Trade Protected trades from the last seven days, including legitimate ones.

Account recovery and item recovery are separate. Valve’s general policy is that Support does not manually restore items lost through trades, Market transactions, deletion, or gifting. Use the current CS2 reversal feature where eligible; do not assume a Market sale or an older trade qualifies. [7]

Recognize what happened

These are response cues, not a way to identify the attacker. Different incidents can produce the same symptom, so a suspicious sign-in deserves the full access review above.

Valve’s mobile app shows details of a QR sign-in attempt for you to review. Approve only a sign-in you deliberately started; a plausible location alone is insufficient. A padlock or a Steam logo does not establish who owns a page. Read the real browser address bar, and if anything is unclear, close the page and navigate to Steam yourself. [4]

What an API key does and does not do

A Steam Web API key is a credential for particular API requests. Valve documents methods that retrieve an account’s trade history and offers. It is not a Steam password, a browser session, or a mobile confirmation; possessing the key alone is not the same as having permission to sign into your account and approve item transfers. [5] [6]

Descriptions of an “API scam” often blur these different forms of access. The practical response is to check all of them. Once you have secured the account, open the official API key page. Revoke a key you did not create or no longer need. If no key exists, leave it that way unless a tool you have chosen and understood requires one. Do not create a key just to complete a supposed security check. Revoking a key does not clean malware from a computer or substitute for signing out sessions.

Verify a trade before confirming it

Build the same short check into every trade, even with a familiar name. Display names and avatars can be copied. Start with the intended person’s known profile, then inspect the actual offer and confirmation rather than relying on a chat message or a screenshot.

• Recipient: open the profile from the offer and compare its address or Steam identity with the person you intended to trade with.
• Outgoing items: verify each weapon, finish, condition, variant, and quantity. Inspect individual details when a float, pattern, or applied sticker matters.
• Incoming items: check that the items you expect are present. An empty incoming side transfers your items without receiving Steam items in that offer.
• Final confirmation: reread it on your phone. Stop if anything differs or an offer has been replaced. Do not approve while someone pressures you to hurry.

Steam’s trade window cannot enforce a promise of a later bank payment, a chat-based refund, or a middleman’s guarantee. Valve recommends keeping exchanges within supported trade mechanisms and checking the items carefully. Positive profile comments do not replace those checks. [9]

Keep access and recovery information secure

• Use different, unique passwords for Steam and email, stored in a password manager you trust.
• Enable the official Steam Guard Mobile Authenticator and email two-factor authentication.
• Keep the authenticator recovery code somewhere secure and separate from the phone. Find it in the mobile app under Steam Guard, the settings gear, then Recovery Code.
• Check that the associated email and phone still belong to you. Read unexpected security-change notifications promptly by opening the relevant service directly.
• Review authorized devices after using a shared computer and remove access you no longer need.

Follow Valve’s authenticator instructions [4] when replacing a phone. Preserve recovery information before you lose access to the old device. Avoid disabling protection simply to troubleshoot a trading restriction; first identify the restriction in the trade and Market restriction guide.

Common recovery questions

What if the attacker changed my email or authenticator?

Use the stolen-account recovery flow and select the options for contact methods you no longer control. Steam Support may need proof of ownership, such as relevant purchase information. Follow its instructions for the payment method involved and provide evidence only within the official support request. Possession of a current password is not a promise that a disputed ownership claim will be resolved in your favor. [8]

Should I transfer everything to a “safe” account first?

First regain control and review access. Sending items while the recipient or session is in doubt adds another opportunity for a mistaken approval. A stranger’s “safe account,” verification bot, or support inventory is not a recovery step.

What should I send Support?

State whether you can sign in, which contact methods you still control, what changed, and the affected transaction dates or identifiers. Keep purchase evidence available for the official ownership check. Never attach your password, active Guard codes, or authenticator recovery code to a public post or send them to someone in chat.