Possibly Hacked?

[Cptn_INS4N0]

Hello today i received a pm from a steam account claiming that my account was involved in fraudulent activity and i believe it was fake. All of my friends were blocked, i only had one friend unblocked and it was the person claiming to be a steam agent. i blocked that account and reset my password. im just not to sure if it was real or not. i received an email as well from "[e-mail]". So it seemed legit but fishy. i am just trying to resolve this and ensure i am not hacked or my account isn't actually hit with fraudulent activity.

[FFL2and3rocks]

Yes, it's a scam, and if they managed to block your friends then they've already hijacked your account.

[Cptn_INS4N0]

so since i reset my password i am good or no?

Opprinnelig skrevet av FFL2and3rocks:

Yes, it's a scam, and if they managed to block your friends then they've already hijacked your account.

[raystevens73]

That depends on how you are set up, I do not use a phone number as phones are in my opinion "not a secure source". So if your phone has been hacked then probably not. Use an email not tied to your phone, that way even if they get your account info they would still need your email info. Anytime any account logs in on a new/different system then Steam sends a code to put in, if you use your phone/gmail tied to the phone then they have all they need.
Your lucky they didn't change the password/email and lock you out.

[Cptn_INS4N0]

Opprinnelig skrevet av raystevens73:

That depends on how you are set up, I do not use a phone number as phones are in my opinion "not a secure source". So if your phone has been hacked then probably not. Use an email not tied to your phone, that way even if they get your account info they would still need your email info. Anytime any account logs in on a new/different system then Steam sends a code to put in, if you use your phone/gmail tied to the phone then they have all they need.
Your lucky they didn't change the password/email and lock you out.

It is just weird why they wouldn't if they had control over my account. i didn't get an email stating i was logging in on a different device and i also have steam guard on and didn't get any notification threw there.

[Dan5000]

You were phished before by having you put in your credentials, or got malware that stole an already active session from your PC. So it thinks its your own session and doesn't notifiy you.

They probably wanted you to trade your items away for whatever made up reason, but would have needed you to initiate a trade for it to work. So they couldn't do it themselves, otherwise you'd just press decline on your phone.

Anyway, just changing the password might still not be enough to be sure.
The usual steps that get copied to all threads like this are:

1. Scan for malware https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
4. Change passwords from a trusted/clean device.
5. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
6. Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

Doing all that makes sure there is no one else left logged in on your account and no way for them to get back in either.