Someone stole money from my wallet (Security breach)

[Son Gokuu]

I would like to alert you to a breach in Steam security.
Recently € 19.64 has been stolen from my wallet (I don't know how).
All I know is that someone must have sneaked into my account and bypassing the Steam Guard service forced me to buy a Dota2 helmet (a game I've never played).
It could be an isolated case and an error on my part as the customer service has suggested to me, but I have shown them that it is not like that, by being able to locate it on Reddit (https://www.reddit.com/r/DotA2/comments/qdqc43/dota_2_items_stolensold_on_steam_market_someone/) to two other victims by THE SAME USER. The culprit has nickname: Non (https://i.imgur.com/OLp4Kwm.jpg), stealing from us on the same day and with the same item that he has "forced us to acquire" to steal with money from our Steam Wallets.
What's more, apart from not knowing each other, we are not even from the same area. I am from Spain, another is from Brazil and the third from Singapore.
But the facts are identical (with the exception that he has also made them sell steam trading cards to have money in their wallet and be able to buy the helmet with that money.).

Which brings us to two questions:
1.- Steam Guard does not ask for confirmation for some sales (of little value) or for purchases. (https://i.imgur.com/HZmtBry.jpg)
2.- I would like to get back my € 19.64 please.

Attached in images are the evidence of the helmets acquired by the three victims:
Mine: https://i.imgur.com/PtlUVxS.png
The other two: https://i.imgur.com/RmxE4xT.png
https://i.imgur.com/WPNAVn9.png

I have reported the user, without getting a response from the reporting system. That is why I come to you to inform you and again beg you for a solution to this problem.

[Nx Machina]

You gave them your account name, password and the key to the door, the Steam Guard code, either by logging into a known scam site, voting for a team link or falling for the "fake" Steam admin on discord.

Do all the following NOW as your account is compromised (phishing NOT hacked).

1. Scan for malware https://www.malwarebytes.com/

2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage

3. Change passwords from a clean computer

4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage

5. Revoke the API key at https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

[Son Gokuu]

That's not the problem. I NEVER click on suspicious sites, and I ALWAYS check the sender and do not give my details to anyone.
I have passed Malwarebytes and Antivirus and I am clean.
But thanks for the help (I changed the password the other day and deauthorized the other devices)

[FFL2and3rocks]

That's impossible. Nobody can magically steal money or items from your account unless you were tricked into letting them in.

[Son Gokuu]

I don't feel secure anymore because although I did that I don't know if they will steal again from us because we don't know how they could do this ♥♥♥♥.
I am very careful and still this has happened to me.

[Zekiran]

Originally posted by Son Gokuu:

I don't feel secure anymore because although I did that I don't know if they will steal again from us because we don't know how they could do this ♥♥♥♥.

You literally gave away your information.

That's the only way this ever happens.

If you have EVER visited a site off-steam that asked for your steam information - even if it was YEARS ago - that's a security breech.

If you've done ALL of the steps above - not just a couple of them, but every single one - your account should currently be safe. But the user is always the weakest link in the security chain. Steam's security works great, as long as you don't give away your info.

[Zekiran]

Notably there are at least two "giveaway" and "freebie" groups that you're a member of. Those are very likely the cause of this security leak.

[Son Gokuu]

I don't visit those groups since years ago. I haven't given my data to anyone.
And the guy who stole from us is running away with our money and Steam doesn't do anything with that. Whatever the start, the proven culprit should not come out unscathed. But I repeat that I have not visited those groups that you comment or clicked on suspicious sites.

[Son Gokuu]

And I can't even imagine how, even under the assumption of having my password, they can sell or buy from someone else's inventory without going through the Steam Guard. It is a 2FA. It should be the best barrier and it is not.

[Nx Machina]

We see this daily and the only way they can access your account is by YOU giving away ALL your details INCLUDING the Steam Guard code.

Do ALL the steps NOW or continue to have a compromised account.

[Zekiran]

Originally posted by Son Gokuu:

I don't visit those groups since years ago. I haven't given my data to anyone.
And the guy who stole from us is running away with our money and Steam doesn't do anything with that. Whatever the start, the proven culprit should not come out unscathed. But I repeat that I have not visited those groups that you comment or clicked on suspicious sites.

Again, it might have been years ago. But it was certainly the cause.

[Zekiran]

Originally posted by Son Gokuu:

And I can't even imagine how, even under the assumption of having my password, they can sell or buy from someone else's inventory without going through the Steam Guard. It is a 2FA. It should be the best barrier and it is not.

It certainly is!

It works great for the hundreds of millions of accounts that use it daily.

Except for the hundreds of people who then give their security information away. It's like driving up to a shady theater in an expensive porsche and handing the keys to a hobo living in the alley, and expecting them to park it for you...

[Nx Machina]

Originally posted by Son Gokuu:

And I can't even imagine how, even under the assumption of having my password, they can sell or buy from someone else's inventory without going through the Steam Guard. It is a 2FA. It should be the best barrier and it is not.

Gabe Newell gave away his account name and password on March 5th 2011. They are on the link below. He did not give away his Steam Guard code. His account remains uncompromised.

https://www.escapistmagazine.com/gabe-newell-gives-away-personal-steam-password/

[Son Gokuu]

I repeat: I have not given the Steam Guard code (or my password) to anyone. It is also a RANDOM code.
A new one is generated every few seconds.

[Nx Machina]

Originally posted by Son Gokuu:

I repeat: I have not given the Steam Guard code (or my password) to anyone. It is also a RANDOM code.
A new one is generated every few seconds.

You did otherwise they could not have accessed your account. Been here 16+ years, account never compromised.

Have you done any of the steps or do you want your account to continue to be compromised?

Your account can be used to scam others while you do nothing about securing it.

[Mr. Smiles]

If gabens account is still safe, its not some sort of new hacking of steam accounts you have been targeted with, it HAS to be user initiated. Otherwise, why would your account be the target amd not gaben's? Or someone with thousands of $$$ in games and items?