Is this a known scam?

[Mr Noseybonk]

You get a "steam friend" messageing you with:-

"Yo"
"You got a minute?"

Then get asked to vote for "the logo I'm working on for Pixel Knights", then get a link which takes you to what looks like "Skillfull Gamer Showdown", "click on Contests" and "vote".

You then get asked to log on to Steam, ie giving your username/password, even if you're already logged in.

Which I didn't BTW.

In fact it's happened twice to me and another common steam friend over the past few months with exactly the same bot style message.

Odd thing is it's happened with a friend I've known for YEARS, and I know he'd never do anything so stupid. In fact I challenged him this time and immediately got ghosted. I know this guy would NEVER EVER do that. So he must have had his account hijacked IMO.

[Lavie]

Hi! Yes. It's a scam 110%.

For your friend:

Originally posted by Cathulhu:

Do not trade until your account is secured.

Take the following steps to secure your account:

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Steam does not return inventory items or wallet funds: https://help.steampowered.com/faqs/view/3B6E-B322-2400-8D24

If you no longer have access to your account, read this:

How to recover your account
https://steamcommunity.com/sharedfiles/filedetails/?id=1126288560

[Mr Noseybonk]

Which is what I thought....... can't give my "ex" friend that advice as he's deleted and blocked me, so...... he's got an 18 yrs service badge, 1400+ games, he's lost a LOT there........

[Lavie]

More info here:

Scam FAQ (Confidence Scams and Trade Scams)
https://help.steampowered.com/en/faqs/view/70E6-991B-233B-A37B

He should be able to recover his account without any problem (and all the games), except his inventory items or wallet funds maybe will not be there anymore.

[Dr.Shadowds 🐉]

Yes it's a common old scam.
- vote for my team.
- you have pending ban.
- I accidentally reported you.
- you won a prize.

Blah blah blah whatever the story they try to run by you, they ask for login details, or try to trick you into logging into their phishing site. Then they repeat scam to your friends list, and so on.

Originally posted by Mr Noseybonk:

Which is what I thought....... can't give my "ex" friend that advice as he's deleted and blocked me, so...... he's got an 18 yrs service badge, 1400+ games, he's lost a LOT there........

Not much can be done don't worry about it, if he wanted to be friends with you, he would've added you back, or at least unblocked you.

[-XeVoN-]

Originally posted by Mr Noseybonk:

You get a "steam friend" messageing you with:-

"Yo"
"You got a minute?"

Then get asked to vote for "the logo I'm working on for Pixel Knights", then get a link which takes you to what looks like "Skillfull Gamer Showdown", "click on Contests" and "vote".

You then get asked to log on to Steam, ie giving your username/password, even if you're already logged in.

Which I didn't BTW.

In fact it's happened twice to me and another common steam friend over the past few months with exactly the same bot style message.

Odd thing is it's happened with a friend I've known for YEARS, and I know he'd never do anything so stupid. In fact I challenged him this time and immediately got ghosted. I know this guy would NEVER EVER do that. So he must have had his account hijacked IMO.

One russian scammer did this to me yesterday and I thought that he is serious so I connected to that site BUT with another level 0 steam account.Today he wrote to me that he wasnt at his pc yesterday and a scammer might've gotten my account which he did.He did accesed it from Moscow.Now the thing is.That account has the same email as this one but it WASN'T verified,and this one is.I didn't had any type of protection on that account since I had nothing on it.
Now my question is:Is THIS account safe?Or scammers can hack the PC aswell and get multiple informations out of it?

[Dr.Shadowds 🐉]

Originally posted by -XeVoN-:

Originally posted by Mr Noseybonk:

You get a "steam friend" messageing you with:-

"Yo"
"You got a minute?"

Then get asked to vote for "the logo I'm working on for Pixel Knights", then get a link which takes you to what looks like "Skillfull Gamer Showdown", "click on Contests" and "vote".

You then get asked to log on to Steam, ie giving your username/password, even if you're already logged in.

Which I didn't BTW.

In fact it's happened twice to me and another common steam friend over the past few months with exactly the same bot style message.

Odd thing is it's happened with a friend I've known for YEARS, and I know he'd never do anything so stupid. In fact I challenged him this time and immediately got ghosted. I know this guy would NEVER EVER do that. So he must have had his account hijacked IMO.

One russian scammer did this to me yesterday and I thought that he is serious so I connected to that site BUT with another level 0 steam account.Today he wrote to me that he wasnt at his pc yesterday and a scammer might've gotten my account which he did.He did accesed it from Moscow.Now the thing is.That account has the same email as this one but it WASN'T verified,and this one is.I didn't had any type of protection on that account since I had nothing on it.
Now my question is:Is THIS account safe?Or scammers can hack the PC aswell and get multiple informations out of it?

You can go recover your alt account doing recovery process if no longer have access to alt account.

If you do have access to account then do these step on it.
1. Scan for malware https://www.malwarebytes.com/

2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage

3. Change passwords from a clean computer.

4. Generate new backup codes https://store.steampowered.com/twofactor/manage

5. Revoke all API keys, there should be none.
https://steamcommunity.com/dev/apikey




Now to your question, if not using same password from your alt account for anything else, that means your main account, your email, and any other services then you're fine.

[Mr Noseybonk]

Which is why I did not enter anything at all. First time he tried this trick, I just didn't message him back. But an hour later he was pestering, "have u done it yet?". Which I said "no, it won't let me".
He just "went away" and I forgot all about it.
Until today, and it happened again, exactly the same. This time he deleted/blocked me, good riddance. The guy was obviously not my original old friend.

[Dr.Shadowds 🐉]

Originally posted by Mr Noseybonk:

Which is why I did not enter anything at all. First time he tried this trick, I just didn't message him back. But an hour later he was pestering, "have u done it yet?". Which I said "no, it won't let me".
He just "went away" and I forgot all about it.
Until today, and it happened again, exactly the same. This time he deleted/blocked me, good riddance. The guy was obviously not my original old friend.

When ever you counter it, report their profile, and that will alert support, as well alert the owner of the account.

[Mr Noseybonk]

Checked it out with Malwarebytes, gave the all clear.

[MetropoliceC14:i5]

i just saw a friend that has not talked to me in like 2-3 years talk to me weird ♥♥♥♥ like that, thanks for these steam chats i will block him rightaway

[Donald Trump]

Yes

[Erik Taurus]

What worries me with this is that the site has a Steam login, which is the same as all other site which is supposed to be safe. Even though I remember a warning, I thought that Steam validated the sites which have this log in feature. But I was wrong.
Perhaps Valve should looking the abuse of using this login feature.

Weirdly I had a Steam API key, I don't remember when or why I would've requested one or for what purpose. I removed it now.

[cSg|mc-Hotsauce]

Originally posted by Erik Taurus:

What worries me with this is that the site has a Steam login, which is the same as all other site which is supposed to be safe. Even though I remember a warning, I thought that Steam validated the sites which have this log in feature. But I was wrong.
Perhaps Valve should looking the abuse of using this login feature.

Weirdly I had a Steam API key, I don't remember when or why I would've requested one or for what purpose. I removed it now.

My copy/pasta...

1-click login is there for a reason.

Log into the official Steam page first.

Go to shady skin or FREE whatever site.

Click login.

It should let you use the 1-click login option since you are already logged into Steam on that browser. That is what the 1-click login was made for.

If no 1-click login and it asks for ALL your account info including guard codes (2x usually), phishing login. The first time it asks is when the hijacker takes it and uses it to have their own open session cookie.

You might also want to read up on the API scam that has been known for a long time now...

https://www.reddit.com/r/GlobalOffensiveTrade/comments/a5t6kc/psa_huge_csgo_youtuber_fell_for_the_fake_site/

https://forums.steamrep.com/pages/hijacking/

[Mr Noseybonk]

Originally posted by Erik Taurus:

What worries me with this is that the site has a Steam login, which is the same as all other site which is supposed to be safe. Even though I remember a warning, I thought that Steam validated the sites which have this log in feature. But I was wrong.
Perhaps Valve should looking the abuse of using this login feature.

Weirdly I had a Steam API key, I don't remember when or why I would've requested one or for what purpose. I removed it now.

So how do you check if you have any unwanted API keys?

[peppermint hollows]

Originally posted by Mr Noseybonk:

Originally posted by Erik Taurus:

What worries me with this is that the site has a Steam login, which is the same as all other site which is supposed to be safe. Even though I remember a warning, I thought that Steam validated the sites which have this log in feature. But I was wrong.
Perhaps Valve should looking the abuse of using this login feature.

Weirdly I had a Steam API key, I don't remember when or why I would've requested one or for what purpose. I removed it now.

So how do you check if you have any unwanted API keys?

Did you follow the steps of the first post here?

https://steamcommunity.com/dev/apikey

There should be nothing here. You can see if you have API keys here.