Steam's no returning stolen goods policy: potentially illegal in Europe

[programainutil]

Recently, my Steam account (specifically, this one) got hacked, including an assigned email change. Whilst, thankfully, I have been able to recover this account, the hacker returned a game bundle I had purchased, and Steam's policy means they would not undo the operation (and I cannot repurchase the game as it was bought on a Christmas discount)

Now, here is where it gets interesting. Directive 2015/2366, regarding payment services (which the Steam platform operates as, as stated in Annex I of said directive), Article 73 states that "In the case of an unauthorised payment transaction, the payer’s payment service provider refunds the payer the amount of the unauthorised payment transaction immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction". A return is a payment transaction so, by this article, they should return the good

Whilst the following article describes that I may be subject to a maximum liability of 50 euros, said article is not applicable if the transaction was not detectable to me prior to being commited and I was not acting fraudulently. Of additional note, I was operating under email-based 2factor, which means this was done under Steam's security systems.

Any notes, comments, or opinions?

[Qbert ⭐]

First of all... learn to secure your accounts in the future, that part of the equation is your responsability.

Can't say anything about the EU laws since I am not a EU citizen.

Not sure if steam's EULA (which you fully agree with since you are posting here) has something to say about this issue in particular.

I suggest to read it, it's avaliable in spanish here

[ReBoot]

Originally posted by programainutil:

Now, here is where it gets interesting. Directive 2015/2366, regarding payment services (which the Steam platform operates as, as stated in Annex I of said directive), Article 73 states that "In the case of an unauthorised payment transaction, the payer’s payment service provider refunds the payer the amount of the unauthorised payment transaction immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction". A return is a payment transaction so, by this article, they should return the good

Pro tip: read what's there, not what you'd like to be there. What you just quoted, states that refunds happen automatically in case of an "unauthorized payment transaction". That's not what happened in your case though! In your case, the payment transaction itself was fine. It was the subsequent refund transaction which you dispute. Not the same thing, my dude.

[Wolfpig]

You have read what you posted, did you?
Valve/Steam is not a payment provider.

Paypal, your Bank, the other services which you use to Pay stuff are payment providers which can be held reliable if someone (proofen) missused your payment details.

And no, returning a product would not fall under that rule in any way either.....so just wait for the next sale of it to repurchase it.

[Start_Running]

Ot's also worth noting that Valve cannot entirely be sure that your goods were stolen. Because it's not like someone busts out you window, turns on your pc and starts trading item. From their system and as far as anyone else looking at it, it's one user trading, or transfering items to another in a mutually agreed upon trade.

[Nx Machina]

Accounts on Steam are PHISHED not hacked because the end user giving away all their account details.

The account name, the password and the KEY to the door, the Steam Guard Mobile code, or scanning the QR code or authorising via fingerprint giving them access to the account.

How? by either logging into a known scam site or sites, tailored malware on your PC, the vote for my team scam, you have a pending ban scam on Discord, free knife click the link, signing in through a fake login window etc.

How does Steam (a program) know it is not you when all the account details are correct? It doesn't, therefore any action taken on your account is seen as you doing said actions.

The alternative is not plausible:

1) Someone would have to "GUESS" your account name from "millions of possible combinations".

2) Next they would have to "GUESS" your password from "millions of possible combinations" and then match it to your account name with "millions of possible combinations".

3) And finally they would have to "GUESS" the Steam Guard Mobile code "which changes every 30 seconds" to match both your account name and password to then have access your account.

The weakest link is the end user, not the security offered.


Secondly you are member of certain Skin Trading groups so it is easy to see how you gave away all your account details.

[BJWyler]

No goods were stolen from you bud. The bundle was returned, and you were credited the price paid. Just your bad luck, self made as it was, that you bought the bundle on sale and now have to wait for it to go on sale again if you want to purchase it cheap.

Self-made because it was you who provided the scammers access to your account. You did so via scam sites, as the scam trading groups you are a member of plainly point out. Your account will continue to be compromised until you follow the steps to secure it, and remove yourself from those groups, and never use those third party sites again.

Since you now have been warned and informed of the situation, the law will no longer apply when the scammers attack your account again and do even more damage.

[ShelLuser]

OP, you're comparing apples and oranges. Living in the EU myself I figured I'd look up this directive[eur-lex.europa.eu] and well... none of your arguments stick.

If you had bothered to read that directive's opening ("Article I, Subject matter") you'd have seen this for yourself:

1. This Directive establishes the rules in accordance with which Member States shall distinguish between the following categories of payment service provider:

• credit institutions as defined in point (1)
  
• electronic money institutions within the meaning of point (1) of Article 2
  
• post office giro institutions which are entitled under national law to provide payment services
  
• payment institutions
  
• the ECB and national central banks when not acting in their capacity as monetary authority or other public authorities
  
• Member States or their regional or local authorities when not acting in their capacity as public authorities

In case you hadn't realized: Steam is an electronic gamestore, not a service payment provider. Steam doesn't even come close since they also don't provide "cash withdrawal" (for example: if any credits find their way into your Steam wallet then the only way to clean that out is to use said funds in another purchase).

If you're quoting directives then you need to learn that you can't just cherry pick any statements which you happen to like but without even bothering to check if the directive as a whole is actually applicable.

(edit)

I glossed over your "Annex I" comment. Ok, let's check annex I:

1. Services enabling cash to be placed on a payment account as well as all the operations required for operating a payment account.
   
2. Services enabling cash withdrawals from a payment account as well as all the operations required for operating a payment account.
   
3. Execution of payment transactions, including transfers of funds on a payment account with the user’s payment service provider or with another payment service provider:

I'm stopping after 3 points because surely anyone would realize that this has nothing in common with Steam? They don't provide cash withdrawals from an account, they don't provide transfer of funds, they don't provide you any credit lines. They also don't provide "all the operations required for operating a payment account".

Once again: you need to check all of the directives, not merely the items that happen to fit your narrative. For example, what is a payment institution? (article 4, item 4) => "‘payment institution’ means a legal person that has been granted authorisation in accordance with Article 11 to provide and execute payment services throughout the Union;".

Steam doesn't provide payment services "throughout the Union", all they do is provide a way to get store credits through means of their Steam wallet.

This simply doesn't fit in any way, shape or form.

[Chika Ogiue]

Originally posted by programainutil:

A return is a payment transaction so, by this article, they should return the good

That's not what that paragraph says. Someone else forcefully refunding you is not considered an unauthorized payment as described in that paragraph. Further more, Valve are not a payment service provider, they are a store in this matter. The paragraph you quote, specifically focuses on someone using your money without authorization to spend it on goods or services. Refunding -- returning -- your money is not the same thing.

[Thermal Lance]

Gotta love forum lawyers.

[Mad Scientist]

EU Laws wont protect individuals from self-inflicted scenarios where they gave away the keys/keys to the backdoor and the expected happened. Remember, account security is in your hands primarily, and choosing to compromise that with promises of "free stuff", "gambling", "vote for my team/workshop item/etc" or anything asking for your Steam Login should be avoided for maximum security.

The eu cannot by any means restore what was given to someone else, they are not a god-like entity and have no authority on this subject.

[Crazy Tiger]

Originally posted by programainutil:

Any notes, comments, or opinions?

Yes, that it's not illegal and the directive you mention doesn't cover this. Cherrypicking a little part to fit your post doesn't change that.

You should take better care of your account security, that's where it starts and where the responsibility lies (yes, also in the EU).

People really are desperate to create some kind of fiction instead of accepting they did an oopsie.

[Stormer]

why are you putting it here instead of filing a complaint with your government then

[Trollhammer]

https://steamcommunity.com/id/oislal/groups/

There's a lot of very "interesting" groups on your account...
Of course you'll blame Steam

[C²C^Guyver |NZB|]

You do realize that they stopped returning scammed items in 2015, right?

Two years after your account was created.

So the ENTIRE community should have their items devalued because you can't secure your account?


Steam Support does not restore lost items. Items often exchange hands multiple times before a restoration request and this means they cannot be restored without duplicating them or removing them from another innocent user’s inventory. Duplicating items has a negative impact on everyone who trades or uses the Market by lowering the value of items.

https://help.steampowered.com/en/faqs/view/3B6E-B322-2400-8D24

Your account was HIJACKED because YOU gave away the login info.

[hahaisfunny]

why they hack you, not others?