Scammed out of 15K of items - new phishing scam using Google Sponsored Ads

[moon]

#

Hello,

I fell prey to a sophisticated phishing scam. As someone quite careful with 2FA enabled, this scam really surprised me.

I'm sharing this because I want to both alert other people, as well as hopefully, though it's a long shot, have Valve make improvements to their policy and security.

I Google'd "♥♥♥♥♥♥♥", and navigated to what seemed like "♥♥♥♥♥♥♥♥♥♥♥". Somehow, Google messed up, and the link referenced in their search results (the top sponsored ad) is not the link to ♥♥♥♥♥♥♥. (note that I and several others have reported that ad, so it might not show up anymore)

I operated on the false assumption that if Google says it's "♥♥♥♥♥♥♥♥♥♥♥", it is actually "♥♥♥♥♥♥♥♥♥♥♥". This is a fail on Google's end as far as I'm concerned.

https://preview.redd.it/2q19j0oxwiyc1.jpg?width=1029&format=pjpg&auto=webp&s=4f9b88b1a9adaf48051d2f299e7c76dc4519668a

https://preview.redd.it/sllzpevxwiyc1.jpg?width=1029&format=pjpg&auto=webp&s=754e7630bef7bfb11e999b7dcf1eefc1c53692b7

Once on their site, the URL is not ♥♥♥♥♥♥♥. However, due to a slip in attention, I missed this.

Once signed in on the site, the scammer will trade out your entire inventory after 2 days (since as part of the signing process, they have to reset the authenticator).

https://preview.redd.it/hduadkp0xiyc1.jpg?width=947&format=pjpg&auto=webp&s=c1e5b887b5af518051adf48046333c964ffbc0a2

https://preview.redd.it/4q6x9tj0xiyc1.jpg?width=947&format=pjpg&auto=webp&s=e9f4b583f4fc79687d658a2eed7684d2506eaea8

I understand I fell prey to a phishing scam and that to a large degree this is my fault. I get that.

However, I find it completely unacceptable that:

* Steam Support will not return my $15,000 worth of items, even though they have not traded hands. They're still sitting in this person's inventory if you look at the number of items ( [https://steamcommunity.com/id/zlatadegtyarev12](https://steamcommunity.com/id/zlatadegtyarev12) ). Their policy states that they won't return them because they have changed hands multiple times, but this is clearly not applicable here.

This is a hack as clear as day. They can tell someone from a different device signed in and traded everything I had away.

However, I have no way of talking on the phone to a real person from Steam. I have to open a support ticket and wait 8 hours, only for them to reference the policy and close it. This is terrible.

* Banks flag suspicious activity and lock your account. How is it not suspicious that someone from a new device that I don't play on sent away all my items worth $15,000? Why not flag it as suspicious and lock my account?
* I never intended to trade my items away since I'm not a trader. I was simply enjoying them for myself. Why can't I trade lock my items, so that if I want to trade, I need to wait 14 days to do so? It would prevent this from happening.
* Surely 2FA security can be improved? I understand I gave my confirmation code during the sign-in process on that phishing website which mirrors Steam. However, I was under the impression that I would still be asked to approve the trade if I had 2FA. The fact that this was so easy to phish for surprised me.
* As a long-time CS player (20+ years), I really wanted a Dragon Lore. I can't get a Dragon Lore unless I step out of Valve's ecosystem. I only did it because I had to.
* Even if they did trade hands, and even if I mistakenly gave my login information to someone who was able to trick Google, those should still legally be my items. If a thief steals your car because you were a fool, the police will chase,

Thank you for listening. I hope this post will help others, and I wish Valve could care more about its customers.

[🐠🍑]

Man that sucks I cant imagine spending $15000 dollars to learn not to blindly trust Google search results. Are you going to keep playing and buying skins? I'm not sure I would want to after something like that.