安装 Steam
登录
|
语言
繁體中文（繁体中文）
日本語（日语）
한국어（韩语）
ไทย（泰语）
български（保加利亚语）
Čeština（捷克语）
Dansk（丹麦语）
Deutsch（德语）
English（英语）
Español-España（西班牙语 - 西班牙）
Español - Latinoamérica（西班牙语 - 拉丁美洲）
Ελληνικά（希腊语）
Français（法语）
Italiano（意大利语）
Bahasa Indonesia（印度尼西亚语）
Magyar（匈牙利语）
Nederlands（荷兰语）
Norsk（挪威语）
Polski（波兰语）
Português（葡萄牙语 - 葡萄牙）
Português-Brasil（葡萄牙语 - 巴西）
Română（罗马尼亚语）
Русский（俄语）
Suomi（芬兰语）
Svenska（瑞典语）
Türkçe（土耳其语）
Tiếng Việt（越南语）
Українська（乌克兰语）
报告翻译问题
此主题已被锁定 
讨论规则及指引
举报此帖
I just got scammed today i sold my doppler for 330euros went outside to the shop for literlly 10 mins came back to look to buy a new game with the money i had and it was all gone... no notifications no nothing so i lost all 312 euros... im acc so pissed
first thing to do is see if it was a hiccup, seeing as how it ahppened so fast
restart steam, and see if that does anything
if not, do what the first post
suggests and make sure that you account is clean
Yes, you leaked your information somewhere. There's no other way for hijackers to access your account.
And no, Support will not give you back any money spent on the market, and they will not restore any items that were stolen.
You can close that ticket, you are wasting Supports time and the time of everyone who actually has need of Support.
It just took 14 PHP but that still means that my account is no longer safe :C
So i didnt lose anything, ofc i did everything suggested here already. Also yes, i used third party marketplaces before and gave them my api key, namely ♥♥♥♥♥♥♥ and buff163. I always logged in through steam though, never entered my info anywhere other than steam.
So can someone explain again please how these people logged into my account without needing to authenticate through steam guard (which still works btw)? Even if i try to login on a new device using correct credentials i have to confirm the login with steam guard.
Also i never entered my password anywhere other than steam, and logging in through steam should be safe regardless of the site, since you never share your login info with them directly.
Btw im a web developer so i know generally how this stuff works, even though unfortunately nobody is immune to being hacked/phished.
I would really want to find out how this happened and where my credentials got leaked, if they did. Unfortunately it seems i cant check who logged into my steam account during the time the purchase was made, seems like a feature that should be available. Or is it and im just missing it?
Steam accounts hijacked not hacked and clearly you did login on one of those sites. You might not usually but you did at least once.
Steam Guard is just another key. If you give a stranger the keys they have access just like if you gave a stranger you house keys
Once you login to a phishing site they don't log out
Can't check who logged in at the time???
1. They could have been in for hours, days or weeks
2. As far as Steam is concerned they are YOU as only you and Steam should know and have access to the account security credentials
So how exactly is Steam supposed to know someone else has access to an account?
Yes, if you read carefully what i wrote, i said that i use third party trading websites regularly.
I understand what you are saying, but i know the difference between a phishing site that asks for username, password and authenticator code and a "login through steam" button where you provide none of that.
If anyone wants to see an example of a phishing site and how it works, this video explains it very well: https://www.youtube.com/watch?v=EElGnqNZdBc&t=50s The timestamp shows what that would look like.
Cant see myself falling for that.
"Can't check who logged in at the time???"
Sorry, i meant to say "who WAS logged in at the time".
You know, a List of all logged in devices for example.
"So how exactly is Steam supposed to know someone else has access to an account?"
Well if someone is logged in simultaneously from multiple locations for long periods of time, you could have systems in place that recognise that this account has possibly been compromised and warn the user, plus require them to reauthenticate through steam guard, that would essentially solve that problem. This is just off of the top of my head, im sure there are more sophisticated solutions.
https://steamcommunity.com/discussions/forum/10/3821910883984792587/
I know the difference but it only takes a innocent mistake, tired, stressed, distracted or any other reason. Thus why I said you must have at some point
As for the who/what Logged in the best you can do is
Help > support >Data related to account > Login history
https://help.steampowered.com/en/accountdata/SteamLoginHistory
Multiple devices logged in not really a deciding factor you have remote play, mobile apps, home could be downloading while logged in at a friends and so on
As for confirmation for purchases Hell NO!
Shouldn't need the bloody authenticator and confirmation for trading and selling. More than enough security. I'm sick of having to jump through all the added hoops
And this take "shouldnt need authenticator and confirmation for trading", thats ridiculous. We are not talking about a couple cases here, many people have inventories and items literally worth six figures. 2FA is absolutely necessary for trading, because like steam said, all transactions are final.
BTW i just found out im just stupid, but at least i didnt get phished. It was an old buy order from months ago that i completely forgot about and that was still in place, so nevermind lol
IMG of login history: https://imgur.com/a/Y3f3tTn
As you can see i log off and when i logged in i didnt had the items, not even 1 notificacion, nothing. They don't need access to your account. I think it's a problem with Steam Security
To my surprise, it turned out that someone had sold 120 items on the Steam marketplace on June 2 and bought items that normally cost $0.04 to things like $8.
To my surprise (Many surprises) none of the 120 items have been authorized by my mobile Steam app. Which makes me wonder. Is it safe or does it help to have Steamguard?
In my Login history there are none on June 2, nor are there any that are not from my computer.
I have not received any notification to my Email, mobile phone or Steam Guard app.
None of the sales or purchases have been notified to my mobile application (Yes to my email, but only notifications, in no case has it been a purchase confirmation.
He never accessed any 3rd party page that asked me to log in with Steam and/or gave my API key to anyone or anything like that (I don't even have one).
With all this evidence on my account (And if anyone needs a screenshot I'm happy to provide) I've decided against it. Steam Guard is not secure. What's more, it might be even safer to have it disabled and have market transactions require if or if they stay frozen on the account for 15 days instead of being accepted instantly without needing SteamGuard.
And now the question comes: What is the solution that Steam gives me?
Response i had so far: None. Steam is not responsible for market transactions and since my account has not been "Breached" because there is no login attempt on June 2 nor is there any suspicious activity (Except for the fact that I have done 120 market trades with my account closed, no notification anywhere between 2am and 6am) there is nothing that can be done and no compensation for the items I have lost.
TL;DR: The Steam Guard app and 2-Step Verification is useless. In fact it is safer to have it disabled. There is no use not logging into 3rd party accounts. Good luck everyone because it seems that there is a backdoor or day 0 error that Steam does not know about and I hope it does not happen to you!.
IMG of the transactions: https://imgur.com/a/9lzSviw
IMG of login history: https://imgur.com/a/Y3f3tTn
I scanned my PC, no malware found.
i NEVER login in to 3rd party sites, because i never needed it.
I checked my login history till 2021 (The login history ends there) and no one login in to my account other than me.
This is not a "Account compromised". Is a real security breach on steam side.
I even checked on my Gmail for confirmation or notifications from Steam. Nothing.
Changed my password, checked everything, but that doesnt mean this will not happen again, nobody is actually safe.
On the login form is a checkbox, that tells steam to remember your login on this computer.
Just like you can do that, so can the hijacker.
So you need to check your login history longer back in time.
About how someone managed to login:
Did someone message you, asking you to "Vote for my team" or similar, with a link to "Steam"?
Or did someone invite you to a tournament, with a link to "steam"?
If it asked for your username/password/steamguard code you would think you logged into steam, while in reality it was a fake designed to steal your account.