Totally unfair scam on my inventory. Is there anyway I can get my Items back?

[Prap]

To begin with I know of many popular scams on the internet specifically through steam, however, this is probably one of the most brilliant scam that I've been involved with. Sadly, I fell for this scam and ended up losing around $200-$300 of my inventory. Now, my problem is the fact that this scammer hacked onto my account when I have 2 FA, changed my profile to look like I have been "community banned" which forced me to "trade all my items in the next 24 hrs, or is will get deleted". Now, Me being gullible, I thought this could be real sense I have posted a few shady comments in my on my close friends profile. Anyways, I decide to keep it safe and trade all my items to one of my closest friends on steam to avoid deletion. At this point I'm looking through my confirmations on my phone and I see my friends name and profile picture, and so I confirm the trade. I ask my friend if he sees the trade offer through his phone and he denies. So then, he sends me an offer and I send him all my skins. After, he claims that none of the skins came in his inventory. I look back at my trade history and see my friends name and profile picture however this account is level 0 where my friend is level 43. At this point, I'm thinking that its just a glitch. I come back some minutes later and I see my friends profile change to some random name and at that point I figured I got scammed for the first time ever. Now my questions are, Can Steam retrieve my items back? How was this scammer allowed to hack into my account when I have 2FA? Also, How can the scammer interfere with a trade with my friend as a fake account?

TLDR: Hacker hacked into my account, changed my account to look "community banned", pretended to be my friends profile, ends up getting all my items :/

[Wolf Knight]

your account is compromised

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes for your Mobile App
Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)


Please review how you are logging into Steam, you somehow gave them your log in information. This could of been due to the computer being compromised and redirecting to a fake login, or you using a 3rd party site to login to steam.

Once you are sure you have regained control, you can start trading again. Please triple check any trades you make to be sure they are going to the correct account.


they didnt hack your account, you gave away your log in
your items are gone. stop giving out your log in

[Prap]

but how did they get through my 2FA?

[nullable]

2FA is an additional layer of security, not an impenetrable shield. If you gave up the keys to the kingdom, 2FA won't protect you. You still need to be extremely careful with your accounts at all times even with 2FA enabled.

Valve makes it very clear that regardless of how the items are traded or gifted away that they're not going to restore Inventory items. It screws up the market values and it's not fair to everyone else.

[Prap]

So should my api key always be clear?

[Krazy]

Items are gone forever

[LimminL]

You would have logged into a non steam site and provided your steam guard code. That provides them with enough time to set up an API which gives them access to your account.

Originally posted by PraisePancakes:

but how did they get through my 2FA?

They didn't get through it per se, you gave it to them.

The deadbolt to your house is only useful as long as you don't give the thieves the key and help them out with your things.
As the saying goes, live and learn.

[Prap]

Originally posted by Limminl23:

You would have logged into a non steam site and provided your steam guard code. Provides them with enough time to set up an API which gives them access to your account.

Originally posted by PraisePancakes:

but how did they get through my 2FA?

They didn't get through it per se, you gave it to them.

The deadbolt to your house is only useful as long as you don't give the thieves the key and help them out with your things.
As the saying goes, live and learn.
:isitcoffee:

ahh makes sense, thanks for the help.

[LimminL]

Originally posted by Wolf Knight:

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes for your Mobile App
Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

Just a follow up, if you haven't already, you should do as he says. If you don't, they will still have access to you account.

[Jerry]

A problem with 2FA is, that is actually removes a few Steam security layers. The most important one in this case would be the need to confirm the activation of a new device. This sort of "silent logins" would not happen to email users (unless the mail was compromised too). And of course, the scheme would blow off anyhow long before the 15 days trade hold was over.

Outside this brief rant a little hint for the future: If any website requests your Steam login, do the login on the official main page of Steam. Legitimate sites will carry it over and only ask you to confirm it is your profile. Anything, that still wants your password at this point is a trap. This goes for pages, that appear to be Steam profiles or trades too.

[Muppet among Puppets]

Scams follow this pattern:
Bait, story, steps.

They all depend on you doing the steps.