Dota 2 Items Stolen/Sold on Steam Market [Someone please help...]

[z1pper]

This is the first time I encountered such cyber incident, I am always very careful with my passwords on any online stuffs I used, including emails and any other stuffs on the internet.

To keep it short, someone has went into my Steam account and sold total of 54 items on the Steam Market using my account. The entire 54 items were all sold at ridiculously low price (ranging $0.50 to $1.28), which many of those items are actually worth way more on the market.

Eventually, the last transaction was the hacker/hijacker used all the credits that were accumulated by selling those items to buy a worthless Axe's head cosmetic for $50.18 on the market. In this case, it can be assumed that the seller of the $50.18 axe head cosmetic is the hijacker/hacker as he did this to bascially transfer all the steam credits to his account.

I had immediately proceeded to changed my Steam password, deauthorize all devices and I still have control of my account so I assumed it is safe meanwhile.



But the question here is, is there anything Valve/Steam can do to assist me with this? Do I have to just suck it up and count myself unlucky despite already having my account 100% secured?

It is clearly obvious that the hijacker/hacker intentionally sell my items at a super low priced to avoid detection, cos usually when you attempt to sell an item that's worth more than a certain amount on the market, it will requires Steam Guard confirmation your mobile, the 2FA security.



I understand many people would say that it is my responsibility on this and I must have somehow compromised my account in someways. I can confidently say that I have not given my Steam ID/password to anyone else, I have my Steam Guard 2FA mobile authentication on all the time and I have never clicked on any weird or sussy links that could compromised my PC or any other information, neither have I logged in my Steam account on any other PCs other than my current personal PC that only I uses it. The only time I have logged in my Steam ID on other sites is Dotabuff, nothing else.

I have done 101% effort and responsibility to always ensure to not fall into victim of cyber theft/scam as I know how scary the internet can be these days. But despite all the efforts, this actually happened infront of my eyes, what do I do moving on?

[my new friend]

Items are not returned and neither are wallet funds.

[Wolf Knight]

your account is compromised
DO NOT TRADE
If you have access to the account

Steps to take NOW:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)


Please review how you are logging into Steam, you somehow gave them your log in information. This could of been due to the computer being compromised and redirecting to a fake login, or you using a 3rd party site to login to steam.

[z1pper]

Originally posted by Wolf Knight:

your account is compromised
DO NOT TRADE
If you have access to the account

Steps to take NOW:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)


Please review how you are logging into Steam, you somehow gave them your log in information. This could of been due to the computer being compromised and redirecting to a fake login, or you using a 3rd party site to login to steam.

Have done all the mentioned. As mentioned, I only used 1 PC for my steam account, and I'm pretty sure my PC is clean as I do malware scans and stuffs from time to time to keep my PC clean of any potential threats, have always been pretty careful in terms of basic cyber security to protect myself....

Also I haven't logged into any 3rd party site except for dotabuff, which it was logged in since 1 year ago.

I really couldn't figure out how this happened.

[Teksura]

Let me ask you this. When you did step 5 and revoked the API key, did you see an API key already there?

[z1pper]

Originally posted by Teksura:

Let me ask you this. When you did step 5 and revoked the API key, did you see an API key already there?

Yes I did see an API key there, does that means by seeing an API key means my account is compromised?

[Nx Machina]

Originally posted by z1pper:

Yes I did see an API key there, does that means by seeing an API key means my account is compromised?

Yes - the hijacker enabled it.

[Teksura]

Originally posted by z1pper:

Originally posted by Teksura:

Let me ask you this. When you did step 5 and revoked the API key, did you see an API key already there?

Yes I did see an API key there, does that means by seeing an API key means my account is compromised?

Yes. That means that it doesn't matter how confidently you say that you have not given your Steam ID/password to anyone else. You did, even if you didn't realize it.

[The Giving One]

Originally posted by z1pper:

The only time I have logged in my Steam ID on other sites is [REMOVED] nothing else.

Bingo. If that is truly the only one, that's the culprit, or it was another site that looked closely like that one instead, and it was a phishing site.

[z1pper]

Originally posted by The Giving One:

Originally posted by z1pper:

The only time I have logged in my Steam ID on other sites is [REMOVED] nothing else.

Bingo. If that is truly the only one, that's the culprit, or it was another site that looked closely like that one instead, and it was a phishing site.

Dotabuff has always been there to keep track of game stats and stuffs etc., the last time I logged in was 1 year ago, nothing else. I don't get it how it happens after a year of being logged in to Dotabuff which almost all dota player uses it.

[z1pper]

Originally posted by Teksura:

Originally posted by z1pper:

Yes I did see an API key there, does that means by seeing an API key means my account is compromised?

Yes. That means that it doesn't matter how confidently you say that you have not given your Steam ID/password to anyone else. You did, even if you didn't realize it.

So there's no way to prevent or ensure that this doesnt happens again in the future right? I mean I seriously thought of re-buying all these cosmetic items back. But looking at how vulnerable a Steam account can be no matter how cautious you try to be, such things still can happen and I'm really disappointed.

I mean if it can happen once, it might happen again right. And worst thing is I dont think Valve/Steam Support is gonna give a damn about this other than telling me it's my own responsibility and I just gotta suck it up.

[The Giving One]

Originally posted by z1pper:

Dotabuff has always been there to keep track of game stats and stuffs etc., the last time I logged in was 1 year ago, nothing else. I don't get it how it happens after a year of being logged in to Dotabuff which almost all dota player uses it.

Originally posted by The Giving One:

.....or it was another site that looked closely like that one instead, and it was a phishing site.

[z1pper]

Originally posted by The Giving One:

Originally posted by z1pper:

Dotabuff has always been there to keep track of game stats and stuffs etc., the last time I logged in was 1 year ago, nothing else. I don't get it how it happens after a year of being logged in to Dotabuff which almost all dota player uses it.

Originally posted by The Giving One:

.....or it was another site that looked closely like that one instead, and it was a phishing site.

I get your point, not being sturbborn or anything but if you're quoting Dotabuff, highly unlikely as I have not logged in my Steam credentials on any other platforms for at least 1 year. As mentioned the last time was Dotabuff which was 1 year ago. This is why I feel so ridiculous as to how vulnerable can our account security is.

[The Giving One]

Regardless of which site it was, you gave away your login. You said yourself there was an API key. That means it was compromised.

Originally posted by z1pper:

I mean if it can happen once, it might happen again right. And worst thing is I dont think Valve/Steam Support is gonna give a damn about this other than telling me it's my own responsibility and I just gotta suck it up.

They care a lot about it. That's why items that leave an account are not restored or returned.

https://help.steampowered.com/en/faqs/view/3B6E-B322-2400-8D24

Steam Support does not restore lost items. Items often exchange hands multiple times before a restoration request and this means they cannot be restored without duplicating them or removing them from another innocent user’s inventory. Duplicating items has a negative impact on everyone who trades or uses the Market by lowering the value of items.

Also, people have tried to scam Valve with methods such as faking account hijacks in the past, in order to get duplicate items.

[Crazy Tiger]

Don't stare yourself blind on the year since you last logged in on that site. It's a known that scammers can be very patient and clean out an account months after the actual phishing/hijacking.

You logged in on an external site with your Steam login, that is always risky.

Originally posted by z1pper:

So there's no way to prevent or ensure that this doesnt happens again in the future right?

There is. Don't log in on 3rd party sites with your Steam login credentials. Bookmark the direct link to Steam in your browser and only use that one. Don't find websites through Google, type the link directly in your address bar. There are many things you can do to kee the account safe and to not let it happen again.

Steam has the one-click-login for 3rd party sites. If at any time you have to actually put in your credentials on a 3rd party site, back out and don't do it.

Originally posted by z1pper:

other than telling me it's my own responsibility

And that's the truth. it *is* your responsibility to practise account security. And that is more than just activating Steam guard and thinking it's some kind of magical shield.

[z1pper]

Originally posted by Crazy Tiger:

Don't stare yourself blind on the year since you last logged in on that site. It's a known that scammers can be very patient and clean out an account months after the actual phishing/hijacking.

You logged in on an external site with your Steam login, that is always risky.

Originally posted by z1pper:

So there's no way to prevent or ensure that this doesnt happens again in the future right?

There is. Don't log in on 3rd party sites with your Steam login credentials. Bookmark the direct link to Steam in your browser and only use that one. Don't find websites through Google, type the link directly in your address bar. There are many things you can do to kee the account safe and to not let it happen again.

Steam has the one-click-login for 3rd party sites. If at any time you have to actually put in your credentials on a 3rd party site, back out and don't do it.

Originally posted by z1pper:

other than telling me it's my own responsibility

And that's the truth. it *is* your responsibility to practise account security. And that is more than just activating Steam guard and thinking it's some kind of magical shield.

Yea it is still possible even though I last logged in on that site 1 year ago, thats why I'm not being blinded by that. What I'm saying is despite being mostly cautious, fact is that in the cyber world such thing still can happen easily without you knowing.

If logging is on external sites possess such a big risk, I don't see why Steam is still allowing people to do this and exposing people to risks. It's just like a bank will never ask or let you key in your PIN number or anything related in other websites, there's nothing linked to that, which that's because security is their priority.

Yet over here these 3rd party websites enables users to look at their in-game stats, buy/trade/sell items and many more. If they are really so risky to do it, then it shouldn't allow these websites to be even have any form of link/relationship with our steam accounts.

Those many things that you mentioned to keep the account safe and not to let it happen again were all practiced on my end, except for that "3rd party site" which most Dota 2 players are using, even pro players.

And no, never have I ever trusted that Steam guard is a magical shield btw, those were my efforts to ensure my account's security.


I know I might sound really mad, which I do admit because it's so dissappointing to see such things happening and all you can do is just to be "more careful" in the future to prevent such things. Fact is if this happens again, people will just said then you have to be "more extra careful" becuase you didn't do enough the previous time.

My main point of posting this discussion here was to seek for any help regarding if Steam will be able to assist me with this incident, not to repeatedly tell me it is my responsibility when I have did whatever I can to my best of knowledge to keep my account safe, not just assuming Steam guard works like a magical shield.