Install Steam
login
|
language
简体中文 (Simplified Chinese)
繁體中文 (Traditional Chinese)
日本語 (Japanese)
한국어 (Korean)
ไทย (Thai)
Български (Bulgarian)
Čeština (Czech)
Dansk (Danish)
Deutsch (German)
Español - España (Spanish - Spain)
Español - Latinoamérica (Spanish - Latin America)
Ελληνικά (Greek)
Français (French)
Italiano (Italian)
Bahasa Indonesia (Indonesian)
Magyar (Hungarian)
Nederlands (Dutch)
Norsk (Norwegian)
Polski (Polish)
Português (Portuguese - Portugal)
Português - Brasil (Portuguese - Brazil)
Română (Romanian)
Русский (Russian)
Suomi (Finnish)
Svenska (Swedish)
Türkçe (Turkish)
Tiếng Việt (Vietnamese)
Українська (Ukrainian)
Report a translation problem
Discussions Rules and Guidelines
Report this post
make sure to do all of these
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a trusted/clean computer.
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)
that is awesome, but be careful. that can be phished as well.
Here tips, and examples to help you give an ideal of types of scams, and phishing attacks.
We inform people of these things only after they encounter such issue.
@OP, do you have any tips on how it helps expose you to these things (and inform you properly on how to recognize it and how to avoid getting hacked), before it happens? (not after)
Also do you know why people don't seem to be aware? It would help for future cases. Hopefully you won't get targetted a second time (through a new method maybe, or not)
Don't think it makes you account immune from compromise from phishing sites. It won't
If you got phished without it you can just as easily get phished with it. The phishing site will ask you for the code if it gets asked for it and it will only get asked for it if you have it active. It's just another key if you give it away like everything else you let them in.
Read post #6 thoroughly then stop using dodgy sites.
If you insist on using third party sites do it the safe way
1. Open Web browser
2. Login on Steams Official page
3. Visit Third party site
4. Look for and use the one click login button
5. If 4 doesn't work and you're asked for you username, password and Guard code your on a phishing site. LEAVE and DO NOT use again
Can also use sites like scamadviser.com to check how trustworthy a site is before using it. Works for any site not just Steam related. Use it whenever entering login credentials or banking data
Thx for the comprehensive information!
While I can say that i am well aware of cyber security risks regarding phishing attempts and tricks and I am usually very mindful of these things, I must have still slipped up somewhere along the way. Could be that I did not pay close attention on the URL, did not look for signs to confirm the legitimity of a third party site or whatever. It does suck doe. After all we all have stressful days, when the cyber security only plays a secondary role and we simply dont have enough energy or time to be paying close attention to these things.
I got lucky this time, that no great harm was done and i am glad i was made aware of how lax i have become in this regard. Will start being more mindful again for sure.
I am not an expert on the subject so it would be arrogant of me to "inform" other people and risk potential misinformation and thus causing harm to others. I posted this because I experienced this particular way of how the phisher operated in regard to steam account, refunded games and unanthorised marketplace transactions in the hope that this post can be help to others with this particular problem, since i could not find a specific related post on the fly when I tried to look this up.
I myself am aware of the risks of phishing in general and educate myself on the trending phishing tactics regularyly as well. I am sure that my e-mail has been phished first due to me being lazy i.e. using same password on multible sites and services which are linked to the same e-mail. Back in the days it was easy to use different passwords cos i had like 4 accounts (e-mail, steam, wow and skype).
With how many accounts i have nowadays it would be impossible for me to keep track of all my passwords if I did not use the same passwords with slight variations. While i do update some of them like once every months, there are just too many accounts that i forget to manage the majority.
Because there are plenty of warnings and Basic internet safety practices going back LONG before Steam existed. Phishing has also been done via Email and SMS.
Problem is people that fall for them often haven't bothered to read the warnings or learn about online safety....least not until AFTER they get phished. I'm guessing that's partly because
it's a boring topic to most
they can't be ****
Naive and/or Arrogant and think it won't happen to them.
It's an inconvenience
Takes more time to d o things a safe way
Built my Nephew a PC for Xmas and set him up a Steam account, Added a £10 Wallet card aswell, little money for sales plus it could be used for account recovery. Set him up with a password manager and Steam with a complex 490nf#f/3@rf8sjk=/ [password. I created a script that put the password for his password manager into the clipboard ready to paste. Not exactly the best of moves but it was better than none. Also gave them an old phone with the Authenticator on for Steam Guard. They had the phone and the Pin for it.
I also gave them all a warning about some of the scam methods and not to login on any none Steam site. I bookmarked the ONLY site they should be logging in to and that was already logged in anyway.
3 months later I get a call about my nephews account getting hacked. Clearly they ignored all the warnings. I later found at they removed the pin on the simless phone when they gave it to my nephew who is 13 with cognitive issues. They also changed his Steam password and the password to his password manager because it was too complex. Too complex to remember and type in? All they had to do was double click the script on his desktop. He didn't needed to know the password or login every time.
They couldn't follow the guide that many of us link to and I refused to talk them through it since they did it to themselves by ignoring all the safety advice in favour of easy and quick. They just created a new account for my Nephew. Only £50ish spent on games in 3 months wasted.
That's how stupid some people are.
Another thing is I suggest check bottom video, there trick using fake browser within the broswer, this is where trick some people as they only look at the URL, but wouldn't think about checking what going on the page itself until it too late. So if someone randomly message you out of the blue asking you do things that ask you to login, a simple check can save you a trip of this drama.
Problem is that even though a lot of scams, and phishing attacks are almost same methods, the issue is them reskining it everytime.
Example phone call scams.
- I'm your long lost relative blah blah blah scam.
- You won Blah blah blah scam.
- You own us, or we take action scam.
- You're wanted for illegal activity scam.
- Do you want to buy scam.
- Your family at the ER send money now scam.
You get the point, they try to use fear & greed as a way to scam people.
Now repeat it with email, now repeat it with random chats that happens online. Now you're starting see the picture of the problem. They keep changing story, the method, but it's the same steps each time, over, and over.
Now might ask how do we solve it, problem is unless we put camera on every electronic device as well software that basically backdoor that records everything, that always connected online, always watching, monitoring what you do & say, which you can already see how really unrealistic, and unreasonable that is such as privacy, and more. So it's nearly impossible to just solve it off the bat, and best Steam can do is react to reports, and if they slap on a bot that auto bans, there people that dumb enough to try plan pranks only to get hit with it for sure, but can't really complain, but there always off chance bot make a mistake as well as bots are not perfect, so only so much can be done, and they have get an AI to always keep learning scams new story lines, and AI are far from being perfect, so it's not simple to just solve that either without it causing problems, and think maybe it just make a few, this is going up agsaints millions of people, so it could hit way more than they can handle if things went hit the fan as well.
So best advice is learn about tactics scammers use, and ways they try to scam you, since they're pretty much similar or same repeating methods, and tactics used a lot, so not hard to catch on them.
No. No no no no no. I work in IT and i need several logins for each application that i have to look after, i have HUNDREDS of passwords.
Get a password manager!!
it happens. i got drunk and bought a game i would never have gone near had i been sober.