Hacker got access of my account even though I have 2FA enabled and scammed me of trade items

[Samsara]

The hacker denied a trade request sent to me by my friend and then created an account with a similar name and resent the trade offer.

Furthermore, if I try to report this account, I am denied reporting the account as I have "reported it before". This means he had access to my account and reported himself for something inconsequential so that I wouldn't be able to report his account directly for the scam.

The puzzling thing about this entire ordeal is that the day when the access happened, I did not authorise any computer or any new location via steam guard nor did I receive, approve or share any email saying that my account has been accessed from a new location.

Aside from that, my computer is malware and virus free and has a legitimate windows key that is updated. I used both Microsoft's windows defender and nod32 to scan my computer to double check for any vulnerabilities and I scanned through my email to make sure it wasn't compromised in any manner. I also do not use any sort of cracked or pirated software/games.

I do not understand how a malicious entity gained access to my steam account without me approving 2FA or having an email sent to me. Surely if in the scenario, the hacker got access to my email address, it would have shown up in the location access history on my email account right?

I have really tried to safe guard and protect myself using all of steam's recommended policies and haven't been a victim to scams before.
I really hope that someone can provide me with some sort of information that can give me insight into how this entire thing happened. Is there a vulnerability or exploit with steam that the hacker managed to use to avoid sending me the new computer notification?

Valve customer service gave me the entire run around with the "trading policy" jazz but didn't ban the account from trading nor did they even provide me with information on how the hack happened. I provided them with endless amounts of evidence and screenshots of login activity on my emails. They just closed the thread with just referring to trade policy and saying they have no new information for me. I haven't been phished, nor do I have the email used for steam flagged on 'have i been pwned' or used the same password for multiple places.

I feel really helpless and frustrated. I really tried to keep myself safe and haven't ever fallen victim to a scam before. These items to me were really expensive and this blindsided me. I understand that I am at fault for not triple checking the username and seeing a small mark of discrepancy but isn't valve also to share some of the blame for their 2FA system not working as intended? Aside form the obvious, what could have I possibly done better here?

PS: The account I am posting from is not the account that got pwned.

[Crazy Tiger]

Phishing is the usual vector. People often get compromised months before the hijackers take action, so looking into the recent logins doesn't show that.

Relevant info:

Originally posted by Crazy Tiger:

Phishing is the most likely cause, OP. When people get phished, they give out the account name, password and then active guard code. A bot quickly enters it and hijackers have access then. Ultimately 2FA is "just another code" that can be given away when getting phished. It's not a magical defense layer.

Have you secured your account? If not:
- Scan for malware. https://www.malwarebytes.com/
- Deauthorize all devices https://store.steampowered.com/twofactor/manage
- Change your password on a secure device.
- Generate new back up codes. https://store.steampowered.com/twofactor/manage
- Revoke the api key https://steamcommunity.com/dev/apikey

Find out how you leaked your credentials. Phishing and malware are the two ways it happens, phishing is the most likely one. Either way, find out how you leaked your credentials.

Items are gone, they do not get returned nor will you get money back for them. The item restoration policy: https://support.steampowered.com/kb_article.php?ref=9958-MJDG-3003

Not all items require confirmation. https://steamcommunity.com/groups/community_market/announcements/detail/1705067494681435160

[Samsara]

Originally posted by Crazy Tiger:

Phishing is the usual vector. People often get compromised months before the hijackers take action, so looking into the recent logins doesn't show that.

Relevant info:

Originally posted by Crazy Tiger:

Phishing is the most likely cause, OP. When people get phished, they give out the account name, password and then active guard code. A bot quickly enters it and hijackers have access then. Ultimately 2FA is "just another code" that can be given away when getting phished. It's not a magical defense layer.

Have you secured your account? If not:
- Scan for malware. https://www.malwarebytes.com/
- Deauthorize all devices https://store.steampowered.com/twofactor/manage
- Change your password on a secure device.
- Generate new back up codes. https://store.steampowered.com/twofactor/manage
- Revoke the api key https://steamcommunity.com/dev/apikey

Find out how you leaked your credentials. Phishing and malware are the two ways it happens, phishing is the most likely one. Either way, find out how you leaked your credentials.

Items are gone, they do not get returned nor will you get money back for them. The item restoration policy: https://support.steampowered.com/kb_article.php?ref=9958-MJDG-3003

Not all items require confirmation. https://steamcommunity.com/groups/community_market/announcements/detail/1705067494681435160

I just haven't ever put in my steam credentials anywhere except the desktop steam software. The time when I contacted steam support was likely the first time I used steam credentials on a browser in over a decade. Even if I got phished, don't I still get an email saying that my account has been accessed from a new location/computer? The date my steam was accessed from Russia, I have no emails at all from steam nor does hyper searching any of search terms of access (country, city, continent) through gmail show any foreign access. The email I use for steam is exclusive and I don't touch it so scanning through all the emails. showed only a couple of access to steam OTP codes which I had legitimately used over the years.

[JackstrerII]

the same thing happened to me, but I kicked him out fast, before he could lock me out, sadly he was able to steal 300 dollars worth of items, and all the items are still in his account
and will still be there until the tenth they even did the same trick by reporting themselves with my account.

They were able to Phis me by using my friend's account that got compromised, somehow compromising my Steam authenticator, never even saw it coming.

they cite that the main reason they don't retrieve items is that they get traded and can't be retrieved after that so they make new copies. I don't really get why they blocked all forms of item recovery as I can still see all my items in his inventory.

[Samsara]

Originally posted by JackstrerII:

the same thing happened to me, but I kicked him out fast, before he could lock me out, sadly he was able to steal 300 dollars worth of items, and all the items are still in his account
and will still be there until the tenth they even did the same trick by reporting themselves with my account.

They were able to Phis me by using my friend's account that got compromised, somehow compromising my Steam authenticator, never even saw it coming.

they cite that the main reason they don't retrieve items is that they get traded and can't be retrieved after that so they make new copies. I don't really get why they blocked all forms of item recovery as I can still see all my items in his inventory.

I can make peace with the fact I won't get my items again. But I'd atleast like for the account to get trade banned so that my items are useless to him. Steam support are unwilling to even investigate that.

[Chompman]

Originally posted by iMpactFuze:

Originally posted by JackstrerII:

the same thing happened to me, but I kicked him out fast, before he could lock me out, sadly he was able to steal 300 dollars worth of items, and all the items are still in his account
and will still be there until the tenth they even did the same trick by reporting themselves with my account.

They were able to Phis me by using my friend's account that got compromised, somehow compromising my Steam authenticator, never even saw it coming.

they cite that the main reason they don't retrieve items is that they get traded and can't be retrieved after that so they make new copies. I don't really get why they blocked all forms of item recovery as I can still see all my items in his inventory.

I can make peace with the fact I won't get my items again. But I'd atleast like for the account to get trade banned so that my items are useless to him. Steam support are unwilling to even investigate that.

The problem is trade banning random accounts like that doesn't work as steam does not know if they broke the rules just because your account was compromised and often times they get traded away multiple times so steam is not going to do that for every account.

[JackstrerII]

Originally posted by iMpactFuze:

Originally posted by JackstrerII:

the same thing happened to me, but I kicked him out fast, before he could lock me out, sadly he was able to steal 300 dollars worth of items, and all the items are still in his account
and will still be there until the tenth they even did the same trick by reporting themselves with my account.

They were able to Phis me by using my friend's account that got compromised, somehow compromising my Steam authenticator, never even saw it coming.

they cite that the main reason they don't retrieve items is that they get traded and can't be retrieved after that so they make new copies. I don't really get why they blocked all forms of item recovery as I can still see all my items in his inventory.

I can make peace with the fact I won't get my items again. But I'd atleast like for the account to get trade banned so that my items are useless to him. Steam support are unwilling to even investigate that.

I feel like steam just wants less and less people working on user support. It doesn't seem to me like they justified why they stoped looking into it at least

[JackstrerII]

Originally posted by Chompman:

Originally posted by iMpactFuze:

I can make peace with the fact I won't get my items again. But I'd atleast like for the account to get trade banned so that my items are useless to him. Steam support are unwilling to even investigate that.

The problem is trade banning random accounts like that doesn't work as steam does not know if they broke the rules just because your account was compromised and often times they get traded away multiple times so steam is not going to do that for every account.

could you elaborate? they are circumventing the only way we have to report this, by reporting themselves with something inconsequential instead.

[Samsara]

Originally posted by nullable:

Everyone really tries to be safe, but lots of people unknowingly compromise their accounts. The problem is since they did it unknowingly when the compromise becomes visible, it's pretty easy for lots of people to assume "I didn't cause this, it must be a flaw in the security".

And while it's not impossible, if there was a flaw that let an attacker loot your account through no fault of your own, well, your account would hardly be the only one. And the attackers would be looting as many accounts as they could as fast as possible because the second that flaw becomes known it'll get patched and the opportunity would be lost. As a result thousands, maybe millions of users would be affected and it would be front page gaming news everywhere.

So is that happening? Is a Steam security exploit the front page on gaming news sites? Or is it maybe plausible that, like lots of other users, you possibly could have made a mistake somewhere that compromised your account?

This makes no sense. They'd do the opposite. In order to keep under the radar they'd keep the pace as slow as possible for the exploit not to get patched. If a mass trade of items happened, valve would auto flag it really fast. In this way they already know what the customer service agent in regards to trade policy and what they can likely do to get the Items across.

I am really particular about my security habits. As said above, I haven't added my steam credentials on a web browser ever nor do I install random software or used cracked games. But of course this is a pointless argument as it is impossible for me to prove this and the current situation is stacked against me.

[JackstrerII]

they should have incorporated trade item limits long ago, why would anyone trade 435 items for nothing

[omeX]

My account was hijacked like 16 hours ago. The hijacker managed to pass 2FA. Manage to make only 1 trade with all my cases and items (about ~300 deal worth in total). Trying steam support help, but I don't expect anything. Truly don't know how this happened, currently using AVG Ultimate edition (no malware found), I didn't give anyone me backup codes etc. Here is the steam, please if you can report him. Also if you check his inventory you will find all my items, even my awp with my girlfriend name on it :/.

[Bee🐝]

Originally posted by omeX:

My account was hijacked like 16 hours ago. The hijacker managed to pass 2FA. Manage to make only 1 trade with all my cases and items (about ~300 deal worth in total). Trying steam support help, but I don't expect anything. Truly don't know how this happened, currently using AVG Ultimate edition (no malware found), I didn't give anyone me backup codes etc. Here is the steam, please if you can report him. Also if you check his inventory you will find all my items, even my awp with my girlfriend name on it :/.

All the info you need is in post #1.

Also, remove the profile name from your post. Naming and Shaming isn't allowed. Hijackers do not use their own accounts, they use hijacked accounts - like yours - to scam others.

[davidb11]

Yeah, hijacking is delayed by months normally to stop people from realizing where it came from.

[Muppet among Puppets]

Originally posted by iMpactFuze:

I just haven't ever put in my steam credentials anywhere except the desktop steam software. The time when I contacted steam support was likely the first time I used steam credentials on a browser in over a decade.

Since the hijackers needed a 2fa code too, if you did not leak all 3 details, a device you used would have "needed" to do it.