Steam API Fraud/Scam

[Adele💕]

I wanted to ask on how far for someone with API key info to bypass any info and took control most of your profile? Personally I've been "hijacked" or if you can call that that is and been scammed from a very convincing enough to the point they sent email which also looks super legit. I really wanted to know how many access or stages and levels of security they can manipulate with just API key?

[Supafly]

They can manipulate trades.

Do all the below to secure the account.

Scan for Malware/virus https://www.malwarebytes.com/mwb-download/
Deauthorize all devices https://store.steampowered.com/twofactor/manage
Change your Account password on a secure device, mobile phone for example.
Generate new back up codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey

[Adele💕]

Originally posted by Supafly:

They can manipulate trades.

Do all the below to secure the account.

Scan for Malware/virus https://www.malwarebytes.com/mwb-download/
Deauthorize all devices https://store.steampowered.com/twofactor/manage
Change your Account password on a secure device, mobile phone for example.
Generate new back up codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey

okay how about the fact that they also know that i attempted to change my profile detail and also blocked my entire friend list, then know that i seen their chat from a profile as if they are live with the database. How did they get the access and changed it somehow

[Satoru]

Originally posted by Jenna💕:

Originally posted by Supafly:

They can manipulate trades.

Do all the below to secure the account.

Scan for Malware/virus https://www.malwarebytes.com/mwb-download/
Deauthorize all devices https://store.steampowered.com/twofactor/manage
Change your Account password on a secure device, mobile phone for example.
Generate new back up codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey

okay how about the fact that they also know that i attempted to change my profile detail and also blocked my entire friend list, then know that i seen their chat from a profile as if they are live with the database. How did they get the access and changed it somehow

You were phished

[Supafly]

Originally posted by Jenna💕:

Originally posted by Supafly:

They can manipulate trades.

Do all the below to secure the account.

Scan for Malware/virus https://www.malwarebytes.com/mwb-download/
Deauthorize all devices https://store.steampowered.com/twofactor/manage
Change your Account password on a secure device, mobile phone for example.
Generate new back up codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey

okay how about the fact that they also know that i attempted to change my profile detail and also blocked my entire friend list, then know that i seen their chat from a profile as if they are live with the database. How did they get the access and changed it somehow

Because all that has nothing to do with the Api key. They can't generate an API without having access to the account. They are already inside your account hence why I said to do 4 other things besides revoking the API key.

[Adele💕]

Originally posted by Supafly:

Originally posted by Jenna💕:

okay how about the fact that they also know that i attempted to change my profile detail and also blocked my entire friend list, then know that i seen their chat from a profile as if they are live with the database. How did they get the access and changed it somehow

Because all that has nothing to do with the Api key. They can't generate an API without having access to the account. They are already inside your account hence why I said to do 4 other things besides revoking the API key.

Damn thats crazy. I also didn't even get any steam guard alert on my phone

[Supafly]

Originally posted by Jenna💕:

Originally posted by Supafly:

Because all that has nothing to do with the Api key. They can't generate an API without having access to the account. They are already inside your account hence why I said to do 4 other things besides revoking the API key.

Damn thats crazy. I also didn't even get any steam guard alert on my phone

Why would you?

[ReBoot]

Originally posted by Jenna💕:

Originally posted by Supafly:

Because all that has nothing to do with the Api key. They can't generate an API without having access to the account. They are already inside your account hence why I said to do 4 other things besides revoking the API key.

Damn thats crazy. I also didn't even get any steam guard alert on my phone

That's because you've given them access earlier.

[Jerry]

(If this text is too long for you, please read at least the final paragraph; it's important)

Originally posted by Jenna💕:

Damn thats crazy. I also didn't even get any steam guard alert on my phone

They need access through your code exactly once. As soon as they got the API key installed, they can work remotely. Lately I've been suggesting, that there should be an external confirmation through mail or phone required when setting up an API, but I got my doubt, that this is the kind of thing, Steam would do.

Originally posted by Jenna💕:

I really wanted to know how many access or stages and levels of security they can manipulate with just API key?

From what we have witnessed here so far over the years, there's a bunch of things.

Manipulations to push you into making a mistake:
- Editing profile text, avatar and name
- Removing friends
- Hiding games
- Closing Support requests (they might remove this part eventually, as we have been able to rescue users, before they were harmed, by spotting this giveaway sign)

Pulling the hook in by:
- Canceling your trades, setting up new trades immediately

Or the simple bruteforced way:
- Setting up market sells and buys to empty your inventory and wallet in exchange for a single trash item (requires no user cooperation, but has a much higher risk to lead to account suspension before being able to cash out)



Finally, my favourite piece of advice, that I leave in every such thread:
Do never enter your Steam login details on other websites again. Instead, when a website (even if it seems to be a Steam profile or trade) asks for your Steam login, leave it, go to the main page of Steam (store.steampowered) and log in there. Then go back to the other website. A legitimate website now will show your account on the login page and will allow you to confirm it. A phishing page, that wants to put an API key on your account, will keep asking for your name and password.
Follow this bit, and you will avoid all API hijackings and at least 75% of all potential frauds in general on Steam.

[Supafly]

Originally posted by Jerry:

(If this text is too long for you, please read at least the final paragraph; it's important)

Originally posted by Jenna💕:

Damn thats crazy. I also didn't even get any steam guard alert on my phone

They need access through your code exactly once. As soon as they got the API key installed, they can work remotely. Lately I've been suggesting, that there should be an external confirmation through mail or phone required when setting up an API, but I got my doubt, that this is the kind of thing, Steam would do.

My doubt would be even if Steam implemented that the phishers would just update their site to get it. Sites update could inform users to expect that confirmation, that is required to trade/gamble on the site, and users would simply provide the extra code making it worthless

[Jerry]

It would still be an additional step, and especially if the mail or phone message says, that it is to set up an API key, it might reduce the amount of victims by a lot. Regular users do set up API keys so few times, if at all, that comfort and conveniance can't be an argument against it, and compared to the other protection mechanisms, being able to silently implement one is a gaping hole without question.

[Supafly]

Not arguing against it. Just pointing out that it won't eliminate the issue. Most users have no clue what the API key is until after they get scammed and users here tell them about it. Read about people getting scammed for money by Scammers tricking them into sharing their banking one time passcode via SMS while the scammer doing something else and people still give them said code.

[ReBoot]

Originally posted by Jerry:

It would still be an additional step, and especially if the mail or phone message says, that it is to set up an API key, it might reduce the amount of victims by a lot. Regular users do set up API keys so few times, if at all, that comfort and conveniance can't be an argument against it, and compared to the other protection mechanisms, being able to silently implement one is a gaping hole without question.

Those who ignore history are doomed to repeat it. Not that long ago, before the current 2FA system got in place, we got phishing sites asking users to upload a file from their Steam folder.

That's WAAAAAAAAAAAAAAAAAAAAAAAYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY more off than confirming twice (once to log in, once to generate the key) and yet people were happily jumping onto phishers' knives!

You're putting too much faith into fools' ability to question what they're doing.

[destrxction]

Originally posted by Jerry:

(If this text is too long for you, please read at least the final paragraph; it's important)

Originally posted by Jenna💕:

Damn thats crazy. I also didn't even get any steam guard alert on my phone

They need access through your code exactly once. As soon as they got the API key installed, they can work remotely. Lately I've been suggesting, that there should be an external confirmation through mail or phone required when setting up an API, but I got my doubt, that this is the kind of thing, Steam would do.

Originally posted by Jenna💕:

I really wanted to know how many access or stages and levels of security they can manipulate with just API key?

From what we have witnessed here so far over the years, there's a bunch of things.

Manipulations to push you into making a mistake:
- Editing profile text, avatar and name
- Removing friends
- Hiding games
- Closing Support requests (they might remove this part eventually, as we have been able to rescue users, before they were harmed, by spotting this giveaway sign)

Pulling the hook in by:
- Canceling your trades, setting up new trades immediately

Or the simple bruteforced way:
- Setting up market sells and buys to empty your inventory and wallet in exchange for a single trash item (requires no user cooperation, but has a much higher risk to lead to account suspension before being able to cash out)



Finally, my favourite piece of advice, that I leave in every such thread:
Do never enter your Steam login details on other websites again. Instead, when a website (even if it seems to be a Steam profile or trade) asks for your Steam login, leave it, go to the main page of Steam (store.steampowered) and log in there. Then go back to the other website. A legitimate website now will show your account on the login page and will allow you to confirm it. A phishing page, that wants to put an API key on your account, will keep asking for your name and password.
Follow this bit, and you will avoid all API hijackings and at least 75% of all potential frauds in general on Steam.

will my guard work after revoking my steam api?

[Supafly]

Originally posted by unlimited:

will my guard work after revoking my steam api?

Not if you share a LIVE Guard code with a third party.