Did i get hack and can i get my money back?

[Lulatch_2]

I just came back home and 6,09 euros got spend buying some stupid item in dota2 (wich i have never played) and i cant refund it. I already changed my password but i have no idea because i didn´t even get a notification so i can´t imagine how they got into my account the only other person that has accest to my account is my friend but he swears he didn´t do it and i do belive him because he isn´t doing this kind of stupid pranks, any help?

[Ettanin]

You exposed your login credentials to a site that faked a Steam login and made a bot log into your account using the save password feature while injecting a Steam API access into it.

1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)
6. Change your trade link: Profile > your inventory > trade offer > Who can send me trade offer > scroll down and make a new trade link.

Be aware that Steam Support will not restore stolen items nor stolen wallet funds.
In accordance with Section 1 C of the Steam Subscriber Agreement, you are responsible for all actions on your account, no matter who used the account.

[nullable]

Publicado originalmente por Lulatch_2:

I just came back home and 6,09 euros got spend buying some stupid item in dota2 (wich i have never played) and i cant refund it. I already changed my password but i have no idea because i didn´t even get a notification so i can´t imagine how they got into my account the only other person that has accest to my account is my friend but he swears he didn´t do it and i do belive him because he isn´t doing this kind of stupid pranks, any help?

Well sharing account credentials is a huge risk, and as a professional programmer who has to think about these things, not to mention the endless horror stories I've seen, I would strongly caution you to stop doing that. At least use Family Sharing if you're determined to share accounts and ignore good advice relating to that.

Since it's clear you don't take security serious (IE account sharing), I'm not inclined to believe you're supremely careful and cautious in all other aspects and that it's impossible for you to have leaked your credentials. And lots of people fall for phishing techniques and scams.

Although if you swear on your life there's no way you could have possibly leaked your credentials, well there's a whole other fallible human being who you admit has access to your account.... hence the problem with account sharing.