Inventory items were sold without my consent

[707]

Yesterday I received a bunch of emails about selling items on the community market, only cards I have obtained in-game. Thing is, all of my inventory is gone, sold, and I never put up any item to sale, so either I was hacked or someone I know used my account for this "prank". Every cent was used on Dota 2 items (a game I don't even have on my library)

Every item was listed for sale and bought on the same day even considering I have the 15 day wait requirement for market sales.

I want to know if there is a way to refund those or some tips to just sell those things? I want them gone I don't mind getting the money back as it wasn't a big amount (around 1 dollar or somehting) or maybe contact steam about this?

[Crashed]

Change your password, delete your API key, scan for malware.

[miamew3]

Your account was hijacked from you leaking your credentials somewhere.
Steam will not return your items as all sales are final.

Do the following to secure your account

1. Scan for malware https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
4. Change passwords from a trusted/clean device.
5. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
6. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

[KCARD]

🗿

[707]

So someone really did get my account, I didnt even put my info out there thanks, I will take more care from now on

[KCARD]

Noce ingles XD

[[PT] Spartan Warrior]

Same happened to me today, and no, I have no malware, and I use, steam guard, complex passwords, 1Password, YubiKey, etc. This also happened to a colleague of mine a few months ago, and this type of thing seems to be increasing.

[Aluvard]

Originally posted by viado games:

So someone really did get my account, I didnt even put my info out there thanks, I will take more care from now on

https://steamcommunity.com/sharedfiles/filedetails/?id=2569847731

[Crashed]

Originally posted by PT Spartan Warrior:

Same happened to me today, and no, I have no malware, and I use, steam guard, complex passwords, 1Password, YubiKey, etc. This also happened to a colleague of mine a few months ago, and this type of thing seems to be increasing.

YubiKey doesn't work with Steam.

[[PT] Spartan Warrior]

No it does not. But it works with my 1Password account. That in conjunction with Steam Guard is how I log in steam.

What I meant, was that I take every precaution with my accounts, weather they are from steam or not.

This type of situation, where someone hacks into your account with steam guard, and steam guard does nothing, not even the notification to authorize or not, and sells some of your stuff just to make money to buy something from their account, is increasing, and I don't see Steam doing anything about it, the minimum should be to delete the account that did this, in my case Rasulkorotkov850

[Aluvard]

Originally posted by PT Spartan Warrior:

-snip-

First and foremost - it's hijack not a hack. Your data leaked and scammer logged in next to you on your account.
Second - no they shouldn't delete such account. You have no proof that it's scammer account and not some victim who was used as a mule.
In other words - would you be as sympathetic to such an idea, if someone came forward and told us, that your account had been used to scam him?

I doubt it.

[[PT] Spartan Warrior]

Yes, since steam as logs of IPs, and while I can't say exactly the IP of the hijack, Steam does, and if the IP was from the same country as the last account, and completely different from mine, yes, I'm for it. Is it the best solution?

No, but I don't see Steam doing anything, Steam Guard is useless, and the fact that steam does not even have IP based security, that means that if the IP is from not from the same region it should send an alert to the app and email.

If I didn't use Steam Guard, and took no precautions what so ever, absolutely, the fault would most likely be mine, but I use Steam Guard and Steam Guard, did nothing, I didn't receive any notification, or request to authorize any login.

Remember that this is a platform where you can store payment info. This type of security breach is not acceptable by any standards.

[Longy999]

Originally posted by PT Spartan Warrior:

Yes, since steam as logs of IPs, and while I can't say exactly the IP of the hijack, Steam does, and if the IP was from the same country as the last account, and completely different from mine, yes, I'm for it. Is it the best solution?

No, but I don't see Steam doing anything, Steam Guard is useless, and the fact that steam does not even have IP based security, that means that if the IP is from not from the same region it should send an alert to the app and email.

If I didn't use Steam Guard, and took no precautions what so ever, absolutely, the fault would most likely be mine, but I use Steam Guard and Steam Guard, did nothing, I didn't receive any notification, or request to authorize any login.

Remember that this is a platform where you can store payment info. This type of security breach is not acceptable by any standards.

Steam stores your password as a hash, meaning even they don't know what your password is. 2FA is just an extra layer of security and is rendered useless when you give it away. IP addresses are completely irrelevant as they can be spoofed in mere seconds

No Steam account has ever been brute forced into, even Gabe Newell himself gave away his user name and password and challenged anybody to circumvent the extra security and enter his account. This was years ago and has still not been beaten

The end result is that, unknowingly, user credentials were given away to scammers. It's effectively like giving away your car keys to a thief and then complaining to the cars manufacturer when it gets stolen

[davidb11]

Yeah, no one can hack Steam.

The weakest point is on the end user.
People get Hijacked, not hacked.

Hijacking a user is like walking across your room.
Hacking Steam is like walking to Alpha Centauri. :P

Literally no one is going to dedicate the resources to hacking.

Also, it would require technology we don't even have yet. :P
A bare minimum of the Second Generation Quantum Computer would be needed.
Edward Snowden made it clear that the NSA still couldn't do it. :P
And they wanted to create a Quantum Computer in order to basically do something akin to that.