Steam account safety

[elyssiian]

Is it possible for someone to get access to a steam account via a product key (If somehow they get access to a digital Product key that is old) and have the email and username of that steam account aswell? Can't they just write a support ticket that they need to recover an old account they had? And that way easily gain access to that steam account by just having a persons username or email with the product key that was registered on their steam library? For example back a couple years ago when I first made my steam account, I purchased my first game off of 3rd party websites I activated the product key on my account, so does that mean if somebody gets access to that product key while having my details, they can get a hold of my account via steam support proof of ownership type? I hope what I wrote makes sense :) Thank you for any replies

[Jerry]

Messaggio originale di elyssiian:

Is it possible for someone to get access to a steam account via a product key (If somehow they get access to a digital Product key that is old)

That is why Steam only accepts physical product keys as evidence.

[Wolf Knight]

an activation key is only 1 piece of proof of ownership. and steam asks for multiple different pieces of proof. for an activation key, they generally ask for the first one activated on the account.

easiest way to gain access to a steam account is thru social engineering and getting the account owner to hand over the log in information without them realizing it till after bad stuff starts to happen.

[elyssiian]

Messaggio originale di Jerry:

Messaggio originale di elyssiian:

Is it possible for someone to get access to a steam account via a product key (If somehow they get access to a digital Product key that is old)

That is why Steam only accepts physical product keys as evidence.

https://ibb.co/7ng0RHt
It says here that they do accept digital Products as proof of ownership?

[elyssiian]

Messaggio originale di Wolf Knight:

an activation key is only 1 piece of proof of ownership. and steam asks for multiple different pieces of proof. for an activation key, they generally ask for the first one activated on the account.

easiest way to gain access to a steam account is thru social engineering and getting the account owner to hand over the log in information without them realizing it till after bad stuff starts to happen.

So let's just say a person somehow gets access to my first ever activated digital product key on my steam account via a data breach on a 3rd party game seller website. So do I say bye bye to my steam account? I'm trying to figure out how would that work.

[Wolf Knight]

Messaggio originale di elyssiian:

Messaggio originale di Wolf Knight:

an activation key is only 1 piece of proof of ownership. and steam asks for multiple different pieces of proof. for an activation key, they generally ask for the first one activated on the account.

easiest way to gain access to a steam account is thru social engineering and getting the account owner to hand over the log in information without them realizing it till after bad stuff starts to happen.

So let's just say a person somehow gets access to my first ever activated digital product key on my steam account via a data breach on a 3rd party game seller website. So do I say bye bye to my steam account? I'm trying to figure out how would that work.

read what I posted again. activation key is only 1 piece, steam does not accept only 1 piece. they want other pieces as well that only you should know. did you ever check out some of the information on your account and wonder why its partially filtered? that kind of information is stuff steam may need from you as proof of ownership.

[Wolf Knight]

I dont accept random friend requests, if you have questions, post them. I prefer to keep discussions public, not private

[elyssiian]

Messaggio originale di Wolf Knight:

Messaggio originale di elyssiian:

So let's just say a person somehow gets access to my first ever activated digital product key on my steam account via a data breach on a 3rd party game seller website. So do I say bye bye to my steam account? I'm trying to figure out how would that work.

read what I posted again. activation key is only 1 piece, steam does not accept only 1 piece. they want other pieces as well that only you should know. did you ever check out some of the information on your account and wonder why its partially filtered? that kind of information is stuff steam may need from you as proof of ownership.

Like what else? Let's just say for instance I've never added anything to my account more than the product key itself from the 3rd party website and the email that was attached to it, nothing more nothing less. What else could they ask me to prove my ownership of my account? I only got the Email and the Product Key, Just like the person who's trying to for this example enter my account via Steam support, how am I supposed to have any leverage over the person who's trying to steal my account? Unless the other credible information steam might ask would be the login username? Right?

[elyssiian]

Messaggio originale di Wolf Knight:

I dont accept random friend requests, if you have questions, post them. I prefer to keep discussions public, not private

Ye I thought we could have a discussion about this haha

[Wolf Knight]

Messaggio originale di elyssiian:

Messaggio originale di Wolf Knight:

read what I posted again. activation key is only 1 piece, steam does not accept only 1 piece. they want other pieces as well that only you should know. did you ever check out some of the information on your account and wonder why its partially filtered? that kind of information is stuff steam may need from you as proof of ownership.

Like what else? Let's just say for instance I've never added anything to my account more than the product key itself from the 3rd party website and the email that was attached to it, nothing more nothing less. What else could they ask me to prove my ownership of my account? I only got the Email and the Product Key, Just like the person who's trying to for this example enter my account via Steam support, how am I supposed to have any leverage over the person who's trying to steal my account? Unless the other credible information steam might ask would be the login username? Right?

that would be between you and steam support. if they ask for something that you cant provide, you can ask them if there is anything else you can provide as proof.

[elyssiian]

The reason I ask these perhaps silly questions is to just find out how steam guard really works I've seen topics of people getting hijacked like that so I was just wondering how's that possible

[elyssiian]

Messaggio originale di Wolf Knight:

Messaggio originale di elyssiian:

Like what else? Let's just say for instance I've never added anything to my account more than the product key itself from the 3rd party website and the email that was attached to it, nothing more nothing less. What else could they ask me to prove my ownership of my account? I only got the Email and the Product Key, Just like the person who's trying to for this example enter my account via Steam support, how am I supposed to have any leverage over the person who's trying to steal my account? Unless the other credible information steam might ask would be the login username? Right?

that would be between you and steam support. if they ask for something that you cant provide, you can ask them if there is anything else you can provide as proof.

So does that mean if a person has an old 3rd party game distributor account where he had his first ever product key on that steam account is compromised and data breached. And the account original owner doesn't have the access to those Product keys anymore because his account was hijacked (the place where he had his digital product disappears) he hasn't taken the measures to save those old product keys he activated because it was a long time ago, he now doesn't have ANY leverage over the person who's trying to get access to his account? I hope it makes sense what I wrote here haha

[Wolf Knight]

Messaggio originale di elyssiian:

The reason I ask these perhaps silly questions is to just find out how steam guard really works I've seen topics of people getting hijacked like that so I was just wondering how's that possible

steam guard provides extra protection, but when the account owner does something stupid, that is when things go downhill fast for the account owner. no amount of protection will stop someone from being an idiot, no amount of warnings will stop people from mashing the ACCEPT button on a trade that is a blatant scam, etc.

you just have to use common sense and not let things like greed get the better of you. if you try to put the word free and the word skin next to each other they get filtered. there is a reason for it (user stupidity resulting from greed).

take the security of your account serious and you wont have problems. its when people dont take the security of their account serious that they have problems.

having one activation code is not going to get you an account. you need more then just that. even having multiple activation codes is not enough. like I said, they want multiple different pieces of information, not random stuff, very precise pieces of information.

[elyssiian]

Well I hope it's more strict than just having the product keys and the emails, (if you don't have any other credible information about the account)

[Satoru]

Messaggio originale di elyssiian:

Messaggio originale di Jerry:

That is why Steam only accepts physical product keys as evidence.

https://ibb.co/7ng0RHt
It says here that they do accept digital Products as proof of ownership?

There are various factors as to what steam will accept as proof of ownership. If your account is very old, then steam is much more likely to ask for very old cd key registrations than recent payment information. If your account is more new, then your recent payment methods, or recent product keys may be used. It again depends on a variety of factors.

[Bee🐝]

Just to point out, if your key came from a reputable and known site like Fanatical or Humble Bundle, that key is available on your account page on those sites, along with your purchase details and invoice. So, there are no issues there.

If the only thing connected to your account are dodgy third-party keys…well…then you better hope Support offers another method of confirmation; a physical key or a past email address.

All this can obviously be avoided by not giving away your account details and Guard code to every website that claims to be legit.

Edit: Obviously, keys are only ever a thing if you have no actual Steam purchases tied to your account by payment from an accepted source or Support not a 100% convinced by the proof of ownership.