Banned? Account Hijacked? Got it back. Need Advice. Im New.

[AloePlays]

New to Steam. First ever video game I played: Lethal Company. YES. FIRST EVER.

A user "accidentally reported me instead on someone else for some illegal stuff". Said I'd be banned and to contact a Valve Mod to lift Ban.

This Mod sent me video hovering over my profile with ban request, ban account, etc. Told me to call him on Discord. Halfway through, I thought this was not worth the hassle anymore. Went back to my steam, could not access it anymore. I went through my bank to check for any fraudulent charges. None. Late, contacted Steam Support and got this account back. I reported the profile of those two users on Steam.

What do I do next? Do I block them on both Steam and Discord? It was 100% a scam right?

Y'all must be frustrated. I'm sorry. I know I'm dumb.

[Cathulhu]

100% scam that even Valve has put up a warning for years ago:
https://help.steampowered.com/en/faqs/view/3195-9FFB-BA06-F25B


Do not trade until your account is secured.

Take the following steps to secure your account:

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Steam does not return inventory items or wallet funds: https://help.steampowered.com/faqs/view/3B6E-B322-2400-8D24

If you no longer have access to your account, read this:
https://steamcommunity.com/sharedfiles/filedetails/?id=1126288560

[Zarineth]

Yes, it was a scam. Glad to hear you recovered your account. If you reported them, blockd them and forget about them.

You are a wiser user now.

Also do steps from Cathulhu's post.

[Jerry]

İlk olarak AloePlays tarafından gönderildi:

Y'all must be frustrated.

The frustrating and saddening part is, how often we get to read stories like yours here. Every time those criminals succeed, it encourages more of them to get into it or keep going with their schemes. At least your account did not have a whole lot to steal from yet, as it sounds. Sometimes there is quite a damage done.
These methods would not exist in the form of prewritten scripts and graphics, if they had never worked out on others before you.

Anyhow, lesson learned the hard way. Steam will never contact you through friends list, ingame chats or external websites. All official stuff goes through the ticket system, and if there's really something going on at your account, you will notice it right away through a banner on top of your client and browser window.
Oh, and also reports are always checked manually and based on evidence within the system, so you could be "reported by accident" hundreds of times, and would not even get to know about it, because it gets discarded.

Btw., Best to save you the steps and guide link listed by Cathullu into some text document for the future. Of course you would not hope, that something goes wrong like that ever again, but in cases it does, you got that right at hand.

[Callahan420]

Be sure you report them on discord as well.

[AloePlays]

İlk olarak Cathulhu tarafından gönderildi:

6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

I don’t know what API Key is, but when I clicked it, it said
Register Steam Web API Key
Register for a new steam Web Api key.

Does that mean I don’t have any key? It’s good?

[Callahan420]

İlk olarak AloePlays tarafından gönderildi:

İlk olarak Cathulhu tarafından gönderildi:

6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

I don’t know what API Key is, but when I clicked it, it said
Register Steam Web API Key
Register for a new steam Web Api key.

Does that mean I don’t have any key? It’s good?

That is good.

[Jerry]

İlk olarak AloePlays tarafından gönderildi:

I don’t know what API Key is

An API key is a code, that makes it possible to link your account to web scripts. That can be done for a lot of useful reasons, if you are technologically versed and know what you are doing. However, it can also be misused badly, if somebody else sneaks in one. And as most users never have a reason to set up one themselves, malicious hijackings are by far the most common form, we get to see those keys used for.

[lightwo]

FYI, API key has recently become much more difficult for a malicious actor to generate anew, since it requires a Steam Guard confirmation. Not sure if the same can be said about reading existing keys though.

[Dr.Shadowds 🐉]

İlk olarak lightwo tarafından gönderildi:

FYI, API key has recently become much more difficult for a malicious actor to generate anew, since it requires a Steam Guard confirmation. Not sure if the same can be said about reading existing keys though.

Recent changes is only for adding new keys, so adding redirect trades by scammer is more harder now since it's extra steps. Exisiting keys will still work. But issue still remains if user logins to scam sites, or going out of their own way to adding keys they don't understand.

[Haruspex]

That saddens me that your very first gaming experience ever ended with you getting scammed. My first gaming experience was playing Duck Hunt on the NES, and putting that orange gun right against the screen so the ducks were easier to hit. The sound that gun made. *ping*

We're not frustrated. There are times where we are frustrated by someone who gets scammed. This is usually when the scam victim denies all fault even when presented with proof otherwise and is adamant that their instance is special and unique, and that they are the victim of a sophisticated hack. Not that they were merely tricked into giving away the keys to the castle and let the invaders in themselves.

At least you have an excuse. You've never done this before, and you didn't have the experience necessary to know what to look out for. Those scammers are absolute dirtbags for preying on you like that.

Don't let this experience put you off of gaming though. Follow the steps Cathulhu posted and you should be good. Then in the future, some tips on what to be on the look out for:

• Trust nobody. Common tactics to be aware of are offers for free Steam gift cards ("Catch $50" is commonly cited.), offers for free items on Steam, and people asking you to vote for their team in some tournament, among others.
  
  
• Be wary who you add to your friends list, and even if you think you know someone on your friends list personally, still be cautious because your friend could be hijacked, like in "The Thing".
  
  
• Any site that's not the Steam client itself that asks you to log in through Steam should be regarded with suspicion. There are legitimate sites that let you do this though. I recommend instead of logging in though the site, log in through store.steampowered.com only before returning to that site. If it still asks you to log in, it's probably trying to phish for your password. If you aren't absolutely 100% sure that a site is safe, it's best to just don't.
  
  
• If you haven't already, install the Steam app on your phone and set up 2FA, and associate your account with your phone number. Just make sure this is your actual phone number, not some burner phone or a VOIP thing. It probably won't work anyway if you tried.
  
  
• If you get into item trading, the only safe place to trade on Steam is on Steam. There are many third party trading/gambling sites out there that claim to give you free stuff and let you do things like cash out Steam items for real money. These are all varying degrees of scam. Even the best of them only do some degree of legitimate trades to cover for the scamming their doing off the top.