Please help me. My inventory has been looted!

[青空下de猫]

Today, after I returned home from work, I found that my email had been flooded. I realized that without my knowledge, the items in my inventory had been uploaded to the community market by someone unknown. A total of 869 items were sold, and all the items I had obtained over the years were looted! So can my items still be retrieved? But even though I have set up Steam Guard, why would such a thing still happen?

[FFL2and3rocks]

All market transactions are final, your items are gone. You got phished when you logged into a fake website with all of the login information they needed to get into your account.

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey
Stop using shady third party trade sites or clicking suspicious links.

[Supafly]

Steam Guard is just another key. If you give your username, password and a LIVE Steam guard code to a stranger they have access. It's no different to if you give your address and house keys to a stranger.

You either used a dodgy phishing website or used a compromised device

[Dan5000]

It is 100% that someone else is on your account, can't happen otherwise.

Follow all these instructions, otherwise you can't be sure that no one is still on your account:

1. Scan for malware https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
4. Change passwords from a trusted/clean device.
5. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
6. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

There are only 3 ways for others to get into your account:

1. You either got infected and had malware steal your active session, which means steam thinks it is your own doing. (Or you logged in on another infected machine)

2. You entered your login + Steam Guard code somewhere you were not supposed to. (Scanning the QR code to login does the same)

3. Someone else has/had physical access to your devices. (Or you forgot to logout after being in an internet café etc.)

You can't deny all 3 of these, it's impossible to get into your account otherwise.


Stolen wallet or items that way will not be refunded, as it is the users responsibility to make sure their accounts are safe.

[青空下de猫]

Originally posted by FFL2and3rocks:

All market transactions are final, your items are gone. You got phished when you logged into a fake website with all of the login information they needed to get into your account.

Scan for malware https://www.malwarebytes.com/
Deauthorize all other devices https://store.steampowered.com/twofactor/manage
Change passwords from a clean computer
Generate new backup codes https://store.steampowered.com/twofactor/manage
Revoke the API key https://steamcommunity.com/dev/apikey
Stop using shady third party trade sites or clicking suspicious links.

This is too depressing

[Nx Machina]

Accounts are PHISHED because the end user gave away all their account details.

The account name, the password and the KEY to the door, the Steam Guard Mobile code, or scanning the QR code or authorising via fingerprint giving them access to the account.

How? by either logging into a known scam site or sites, tailored malware on your PC, the vote for my team scam, you have a pending ban scam on Discord, free knife click the link, signing in through a fake login window etc.

How does Steam (a program) know it is not you when all the account details are correct? It doesn't, therefore any action taken on your account is seen as you doing said actions.

The alternative is not plausible:

1) Someone would have to "GUESS" your account name from "millions of possible combinations".

2) Next they would have to "GUESS" your password from "millions of possible combinations" and then match it to your account name with "millions of possible combinations".

3) And finally they would have to "GUESS" the Steam Guard Mobile code "which changes every 30 seconds" to match both your account name and password to then have access your account.


The weakest link is the end user, not the security offered.

[REAPER]

Originally posted by 青空下de猫:

Today, after I returned home from work, I found that my email had been flooded. I realized that without my knowledge, the items in my inventory had been uploaded to the community market by someone unknown. A total of 869 items were sold, and all the items I had obtained over the years were looted! So can my items still be retrieved? But even though I have set up Steam Guard, why would such a thing still happen?