Account item traded off

[Techy]

I used to play a lot of csgo and got into getting skins and did some trading but eventually took a break and decided that mobile authenticator was annoying so I turned it off. Steam says that in order to trade and use the market you have to turn on Mobile Authenticator and it was tedious and I no longer used either feature. It has been a few years and now I came back to CS:GO to find my inventory vanished and steam says I traded everything a few months ago. I did not trade anything and I use steam and have the steam app with NOTIFICATIONS ON, on mobile. I did not get any notification that I was doing a trade and do not know how a trade happened on MY ♥♥♥♥♥♥♥ ACCOUNT and steam does not let me know.

[Wizardhermit]

Your account was hijacked. Somewhere you were phished by entering all your account information into a scam website. These are usually 3rd party trading sites. This is in no way Steams fault, the blame is 100% on you.

What happens is that scammers create a fake Steam login page, and then lures people to the page.
When the user then enters their username/password, the scammer simply uses them to login themselves.

What every steam user needs to learn is to NEVER use their account to login anywhere other that the actual steam client (or web site).

Typical methods for luring you to a fake steam login:

* Setup a website, and offer users free stuff. User logs in and loses their account.

* A "friend" sends a message asking you to vote for their team in some tournament, usually CSGO, DOTA2 or other popular games, via a link. User logs in and loses their account.

* Someone leaves a comment on your profile, saying how you should join their CSGO team by following a link. User logs in and loses account.


Follow all of these steps.

Scan for malware. https://www.malwarebytes.com/

Deauthorize all devices https://store.steampowered.com/twofactor/manage

Change your password on a secure device.

Generate new back up codes. https://store.steampowered.com/twofactor/manage

Revoke the api key https://steamcommunity.com/dev/apikey

Also, read up on the API scam...

https://www.reddit.com/r/GlobalOffensiveTrade/comments/a5t6kc/psa_huge_csgo_youtuber_fell_for_the_fake_site/

https://forums.steamrep.com/pages/hijacking/

[Techy]

I get that but the fact that I didn't login to any site besides maybe 2 major csgo gambling sites years ago I wouldn't know how they got access. They also shouldnt have been able to trade when it clearly states you need to have mobile authenticator activated or it alerts you. Which it most definitely did not considering I was on steam during the times when it traded the items off my account

[Jerry]

Did they trade the items or did they sell them on the market?
Items can be sold for up to 1 US-Dollar without confirmation, as long as it is not too far from the average pricing. Buying needs no confirmation at all. This way they steal and move money to their accounts.

This is a pretty new trick to the API scam, after they realised, that they can't fool email users with trade hold into giving their items into a false storage account.

P.S.: Would also explain, why it took so long until it hit you. They simply ignored you until now and are catching up.


P.P.S.: If you have not done it yet, defnitely follow the steps listed up there.

Also an important advice for the future: Do Steam logins only on the main page of Steam (store.steampowered - best would be, you bookmark it, so you can't fall for similar spellings).
Any website, that requires a Steam login, will notice, if you are logged into it this way already. If it keeps asking for your name and password still instead of letting you confirm your account, it is not really Steam.

[Techy]

All items were traded off of my account over the course of a day or two.

[Jerry]

Again, for clarity and to make, sure, this is not another new scheme:

Were the items traded or sold?

[Techy]

They were traded like I said in the last reply

[Techy]

A bot and a now trade banned account traded all my skins for some other steam item and then traded the steam item back for nothing.

[Jerry]

In this case, we are entering unknown areas. Completely unconfirmed trades are something, that should not be possible as far as it is known.
One guess would be, that not only your account has been taken over, but your email as well, so that they deleted the confirmation mails.
Also can you somehow tell for sure, if there was or wasn't a 15 days trade hold?


[Edit:] Another two thoughts:

- Could you please check, if there is a phone number registered on your account? You say, there should be none from your side.

- That weird back-and-forth structure of the trades bugs me. Might be part of whatever they figured out. Possibly they found a way to extend the exception, that trades, where nothing is given away by an email protected account, do not go on hold...?