how can i find out if someone has hacked my account

[Gloooomiiinnnd]

well the situation is that my younger brother has been messing about with my steam account without my permission and he apparently ♥♥♥♥ed it all and i just want to know if someone knows something about i never been in this situation before can someone help me with it, is it a fraud or something along those lines :) if this message is under the wrong section then can steam support moved to the right one thanks Steam ...

[JPMcMillen]

If you think there may be a problem, best to assume there is:

How to secure your account if your account credentials have been compromised:

Scan for malware https://www.malwarebytes.com/

Deauthorize all other devices https://store.steampowered.com/twofactor/manage

Change passwords from a clean computer

Revoke the API key https://steamcommunity.com/dev/apikey

Generate new backup codes

[Snapjak]

And don't stay logged in when you're not at the PC.

[Gloooomiiinnnd]

i am new to this apikey how do i use it ?

[󠀡󠀡󠀡⁧⁧the.jester]

Originally posted by pri:

i am new to this apikey how do i use it ?

You don't use it, it should be blank, hence why anything in there should be revoked.

[Zekiran]

Originally posted by pri:

i am new to this apikey how do i use it ?

If this is the first you've come back to do any of this, count on your games getting bans, if anyone else has had control over your account in the 2+ weeks since this was first posted. No items will be returned to you if they were sold or traded away.

[RedLightning]

Shouldn't this API key ♥♥♥♥♥♥♥♥ be only accessible by developers.. why does everyone have the ability. This should be locked up for the general user no?

What a security hole.

I know I've never had to use it .. so why does it exist outside of the developer realm?

[The Giving One]

Originally posted by RedLightning:

What a security hole.

The "security hole" is people using their Steam login information on shady third party sites, freely enterning it and getting it phished in the process, and also entering the auth. codes and then the API key is compromised and it's their fault, not the fault of Valve and not the fault of Steam.

The "security hole" is where it always has been......between keyboard and chair.

Here is one example of how it works :

API Key Scam Explained

https://blog.opskins.com/protect-your-steam-account-from-the-steam-api-key-scam/

EDIT...The link is dead now, so here is an explanation :

https://steamcommunity.com/discussions/forum/1/1744480967002394150/?tscn=1545720735#c1744480967003395945

[Zekiran]

Originally posted by RedLightning:

Shouldn't this API key ♥♥♥♥♥♥♥♥ be only accessible by developers.. why does everyone have the ability. This should be locked up for the general user no?

What a security hole.

I know I've never had to use it .. so why does it exist outside of the developer realm?

"So many people are in car accidents and die! What a security hole! No one should be able to drive outside taxi drivers!"

It's a tool. It has its uses and it is abused by skanky people with scummy values.

But the people getting scammed don't know they're being scammed until it's too late. They are still the security hole, as pointed out above.

[RedLightning]

Originally posted by Zekiran:

Originally posted by RedLightning:

Shouldn't this API key ♥♥♥♥♥♥♥♥ be only accessible by developers.. why does everyone have the ability. This should be locked up for the general user no?

What a security hole.

I know I've never had to use it .. so why does it exist outside of the developer realm?

"So many people are in car accidents and die! What a security hole! No one should be able to drive outside taxi drivers!"

It's a tool. It has its uses and it is abused by skanky people with scummy values.

But the people getting scammed don't know they're being scammed until it's too late. They are still the security hole, as pointed out above.

And if the API key was only OPEN for developers.. and not EVERYONE.. well that would greatly reduce this bull.. no?

[Zekiran]

And how does one seal it off?

Since you don't know how this process could possibly affect individual users, I'd suggest: people need to learn not to enter their creds places.

If the car was locked for everyone except... seriously, it's still the same response. It in itself is not in any way to blame for this.

[RedLightning]

How the hell is an API key like a car? Seriously.

It has already been asked. 'what is it needed for' and the response was that you dont need it.

It says DEVELOPER ..

SO why does the general user have access to this portion?

It should be granted to 'DEVELOPERS' that require it.

[The Giving One]

Originally posted by RedLightning:

It has already been asked. 'what is it needed for' and the response was that you dont need it.

https://partner.steamgames.com/doc/webapi_overview

If you don't need a key, then you don't need to have an API key entered.

[RedLightning]

Originally posted by The Giving One:

Originally posted by RedLightning:

It has already been asked. 'what is it needed for' and the response was that you dont need it.

https://partner.steamgames.com/doc/webapi_overview

If you don't need a key, then you don't need to have an API key entered.

Yes.. but obviously its open for scammers to jilt people with.

Hey.. if I've never needed it.. and hackers use it.. and its only for developers.. why in the hell is it accessable by hackers when someone clicks a link..

really..

No real defense to this one.

Have a nice day.

[The Giving One]

Originally posted by RedLightning:

Hey.. if I've never needed it.. and hackers use it.. and its only for developers.. why in the hell is it accessable by hackers when someone clicks a link..

That's not the main way the API key scam works. The user does not have to click on a link.

They are freely going to shady third party websites, and freely entering their Steam login information on those sites. Not a problem because they have the mobile authenticator, right ?

Wrong. Because they are also entering the auth. codes and that's when the magic happens. A shell (fake) account is then copied to look almost exactly like the one they intend to trade with at that time or the next time they do a trade.

Since the API key is compromised, this gives the ability for the avatar, profile name, and other appearances of the profile of the one intended to trade with to be copied to look very much like each other. There are warnings and red flags that Steam also tells the user, but often people are not paying attention and just click to confirm the trade anyway, and then the items are sent to the fake account instead of the one they intended to trade with.

Keep in mind that this is 100% on the user for freely giving away their Steam login information and codes.

Now, according to this OP above, we can't be sure that is exactly what happened, but it could be, and doing the normal steps we post will do no harm if there is no foul, but if there is an API key that was generated when they compromised their own account, then that needs to be revoked.

So that's why the key needs to be empty with nothing there, unless you are a developer, for example, and you intend for one to be there, and if you do, then you know what that key is and what it does and what it is for. There are other posts in the forums here that explain it pretty well, at least one version of it.

There is also the fake "VAC ban threat" version of this scam, and I can send you dozens of links to cases that show those, or you can just visit the VAC discussion forum at any time, and they get posted there daily.

https://steamcommunity.com/discussions/forum/1/2572002906850009113/#c2572002906850084112
https://steamcommunity.com/discussions/forum/1/1744480967002394150/?tscn=1545720735#c1744480967003395945 <--------------- This one has the steps to take and a good explanation.
https://steamcommunity.com/discussions/forum/1/1729828401679969268/#c1729828401679990405
https://steamcommunity.com/discussions/forum/1/3315110799617311088/#c3315110799617315290