Unknown email from Steam Support

[Vine]

Hello, I wrote to Steam (minutes ago) about that situation, but maybe the community knows something about this.

My older sister got an email (the email was sent 1/10/2023, but she saw it today 09/10/2023) about logging into an unknown account in the Ukraine. The problem is that she has never used Steam, her email has never been used for platforms like Steam (Well, she doesn't even know what Steam is). We both live in Poland, We have nothing to do with Ukraine to somehow make its e-mail available to them.
(Years ago I have an account on steam to play one game, I didn't have my own email, so I guess my sister lent me her email to make it. BUT I forget username, email which was used and password. So for me, it's like this account disappear. Could this be an attempt to hack the account?)

Email is about Guard code, you know how it looks. email content:

" *account name*,
it looks like you are trying to log in from new device. Here is the Steam Guard code you need to access your account:

Request made from
Ukraine
*guard code* "

I hope it can be understood, because I can't hide the fact that I was scared.

[Cathulhu]

Are you sure it is a legitimate email? There are some phishing mails going around.
Anyway, remove the account name. If real, it has no place in a public user forum.

Does the account name ring a bell for anyone?

[Vine]

What do you mean by remove account name? That in post, in " ?

And second, how to check if this is legit Steam email?

[Vine]

Maybe you mean which email the message was sent from. So: [e-mail]

Sister gives me access to hesr email and in 5/10/2023 she got same email. Same country: Ukraine.

Edit1: 6/10/2023 same email

Edit2: 3/10/2023 same email

[Wolf Knight]

check the full headers of the email, it is easy to spoof the FROM part

and never post any of the account log in information on a forum, that is account security 101.



If you have access to the account

Steps to take NOW to secure the account:
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)


Account Recovery
Make sure you are completely logged out of Steam before you start the recovery process

https://help.steampowered.com/en/wizard/HelpWithAccountStolen
https://support.steampowered.com/kb_article.php?ref=2347-qdfn-4366

Here is a guide that another Steam user was kind enough to make. It will help you navigate your way thru the recovery process if you are having any problems.
https://steamcommunity.com/sharedfiles/filedetails/?id=1126288560

[Vine]

Okay, so this is my old account. Inactive since 2012 with only game called "Zombie Driver" from 2009. And I lost my memo with data to this account. And with that, I was too young at the time to think how to regain access. Over time, I also forgot about it. I had box and CD from that game, but I throw box to trash and CD use on wall. everything is correct.

So. I don't want to jump to the wrong conclusion but maybe it's an attempt to hack a non-active account? Or those phishing mails? Idk. But thanks guys for this short, but helpful... well, help.

[JPMcMillen]

Originally posted by Jajoneg:

Okay, so this is my old account. Inactive since 2012 with only game called "Zombie Driver" from 2009. And I lost my memo with data to this account. With that, I was too young to think how to
everything is correct. And with that, I was too young at the time to think how to regain access. Over time, I also forgot about it. I had box and CD from that game, but I throw box to trash and CD use on wall.

So. I don't want to jump to the wrong conclusion but maybe it's an attempt to hack a non-active account? Or those phishing mails? Idk. But thanks guys for this short, but helpful... well, help.

If the old account is linked to an email you have access to (i.e. your sisters email), just try to log into it and do a password reset. The login name would be in the emails you received. Those emails are probably just the Steam Guard 2FA emails since that account isn't linked to the Steam app. Odds are someone got the username and password from somewhere and is trying to get in, but is being foiled by the 2FA emails.

[Cathulhu]

Well, it means someone knows the account name and the password of that account.

[JPMcMillen]

Originally posted by Cathulhu:

Well, it means someone knows the account name and the password of that account.

Without the code from the 2FA emails it's going to be very hard for someone else to get past that. Especially if they don't have any other account details. But with the login name and email address, that should allow for a password reset which would change the password and keep the other person from getting as far as they currently can.

[Muppet among Puppets]

Originally posted by Jajoneg:

it looks like you are trying to log in from new device. Here is the Steam Guard code you need to access your email:

It said email?

[Vine]

Originally posted by Muppet among Puppets:

It said email?

Oh, no, no, no. It was written "account", I misspelled because I was scared of what it was about. Good thing you noticed my mistake there

[Vine]

Btw, that account is old, by any chance, were there any account data leaks from Steam during the 11 years? Who knows, maybe it went to this account.
And yes, I secured this account step by step from Wolf Knight's response.

[Cathulhu]

Even if there were, Steam can not leak your password, as Steam does not know it.
Steam only stores a SALTed HASH of your password.

Kinda like a fingerprint. You can use a fingerprint to identify a person, without knowing how the person looks like or what their name is.

Same with a HASH. You can verify a password, without ever knowing what the password actually is.