Fake accounts aka Scam Bots

[Diddily Doo]

Dear Valve,

I'm tired of having to block & report a minimum of 6 accounts per day, it is fustrating and annoying.
These so called scambots (usually private profiles or not set up profiles or in rare cases, actual profiles with hours in game...) add me every day.. and not just 1 of them, but nearly 7-8 a day and send me one of those "my friend can't add you add them on *SCAMLINK* blah blah"...

In the past it was about 1-5 a month at max now it just started uprising like hell..
I still remember the good ol' days where steam was just your average everyday DRM..

Suggestions: put a certain requirement for people to use the community functions (i.e steam level 1 or to confirm email AND set up their profile to be able to add people)
Another thing that would be nice is to be set in privacy settings, a feature that would allow me to stop people who have not set up their profiles (or set them to private) from adding me.

But above all, do revise your account creation system... and its effect on the community.

BEAR IN MIND, these are just ideas that we as a community feel you should consider testing to improve ours and your expirience.

Kind Regards,
Just another steam user.

TL;DR
revise account creation system to prevent spambots floating the community
add requirements for adding community members on a new or not set-up account (i.e steam level 1, set up profile)
add a feature that allows me to auto decline "private profiles or not set profiles" from adding me.
or maybe just add a feature that allows me to hide my steam ID number so the ♥♥♥♥bots cant add me.

EDIT: @The Great Cthulhu: Things that seem legit to me are having a level 1 steam account (which can be accomplished by just setting up your profile this way "[unassigned]" bots can't add you, or even better the daily invite limit for a new account (less than a year old, 6 months old, 1 month old, something like that) would be optimal.
say valve develops a system that just counts friend invites per day on new/lowleved acc (emphesis on new accounts), say I make a new acc, I have 1000 friends IRL, 50 of which may be gamers on steam now say i add them all in 1 day, nothing left to add right?
now if this system monitors this kind of crap and sees that somebody at level 1 acc (brand new) added 2000 people in just 2 weeks, that'd auto ban them and -hopefully- ip ban the account creator aka the scam computer or program manager or w/e

[FFL2and3rocks]

You already need something on your account that is paid for before you can send friend invites or messages, so they can't just create new accounts and contact you right away.

Also, your profile is private, so imagine being blocked by half the people you want to talk to because they assume everyone with a private profile is up to no good. Lots of phishers don't have private profiles anyway. They often use accounts they've already stolen as bots to phish even more accounts, so a level restriction wouldn't do much.

[pupoy]

I completely understand, and it's not something I enjoy, that's for sure.

My account got stolen, hacked, etc last year and the steam community never replied to my tickets. My friend also pulled some flags and got it locked, or shut down, I'm not exactly sure because I didn't get the full story.

But I have been getting a lot of these recently, and the only way I really am dealing with it is if someone I played a game with, or has a friend in common with me I accept it, and if not I decline. If they continue to add me, I'll usually add them and see what they want, and if it's a scam I block/report the account and go with it.

And as FFL2and3rocks said, [person above] they would have to purchase a game before being able to add you, which is the really why they phish accounts around, the more you have, the more you can get, etc.

Regards, Azhoo.

[Diddily Doo]

@FFL2and3rocks
Firstly, I like your idea about having to purchase stuff, that'll stop the bots anyway but I've seen some cases that have 2000 hours on dota and 50 hours on csgo (assuming hijack'd acc)..
but either way it's a good idea.
with my idea of private profiles getting auto blocked, I meant it being an option (do not accept invites from private profiles)
I set it to friends only just yesterday after posting this as I don't plan to add people or trade with them on this account anymore, this way i discovered, if your inventory is set to private, they won't send you invites.
I'm assuming they can scan through inventories and stuff!

[Diddily Doo]

@Azhoo
Yeah the steam support is rarely helpful in matters like this, I had my username stolen on an alt acc so now I have to change my pw every week to make sure I dont get hijacked as steam didn't agree to help me with a username change.
I also auto block the obvious ones and report the ones that appear good but end up being another scambot.

[Da Killah Genius]

Its Easy to Tell If That "Profile" Is Spam or Not. Gotta Be Observant and Check for the Unusual.
1. The BIO
2. Spam Links
3. Repeated Messages + False Advertisement
4. Messages That Are Way Too Friendly
Thats How They'll Get You, Its No Surprise That Even "Steam" Has Spam Bots Hacking Accounts.....

[Diddily Doo]

@dakillahgenius
The problem isn't telling if they're spam or not, it's that steam needs to set a certain criteria to prevent this. Just like how the market requires you to have steamguard enabled for 15 days, not be logged in to a new device and have made a purchase on steam more than 30 days ago.

[Fox]

Originally posted by †his is a †rick:

@FFL2and3rocks
Firstly, I like your idea about having to purchase stuff, that'll stop the bots anyway but I've seen some cases that have 2000 hours on dota and 50 hours on csgo (assuming hijack'd acc)..
but either way it's a good idea

The catch is that this option ALREADY EXISTS. If it doesn't work, it's a bug that needs to be signaled here.

Originally posted by †his is a †rick:

Dear Valve,

I'm tired of having to block & report a minimum of 6 accounts per day, it is fustrating and annoying.
These so called scambots (usually private profiles or not set up profiles or in rare cases, actual profiles with hours in game...) add me every day.. and not just 1 of them, but nearly 7-8 a day and send me one of those "my friend can't add you add them on *SCAMLINK* blah blah"...

In the past it was about 1-5 a month at max now it just started uprising like hell..
I still remember the good ol' days where steam was just your average everyday DRM..

Suggestions: put a certain requirement for people to use the community functions (i.e steam level 1 or to confirm email AND set up their profile to be able to add people)
Another thing that would be nice is to be set in privacy settings, a feature that would allow me to stop people who have not set up their profiles (or set them to private) from adding me.

But above all, do revise your account creation system... and its effect on the community.

Kind Regards,
Just another steam user.

TL;DR
revise account creation system to prevent spambots floating the community
add requirements for adding community members on a new or not set-up account (i.e steam level 1, set up profile)
add a feature that allows me to auto decline "private profiles or not set profiles" from adding me.
or maybe just add a feature that allows me to hide my steam ID number so the ♥♥♥♥bots cant add me.

About autoblocking private profiles, I do agree with FFL2AND3ROCKS.
And furthermore, I do believe that endorsing discrimination of any kind (even as an "option") is NOT something that should be implemented.
There are plenty of people that go private for a valid reason, and singling them out isn't going to help them.

[Diddily Doo]

@Fox
I get what you're saying, but I mean imagine facebook where you can disable friend invites from people who arent "friends of your friends".

[Benji, limited edition shitlord]

Originally posted by †his is a †rick:

add a feature that allows me to auto decline "private profiles or not set profiles" from adding me.
or maybe just add a feature that allows me to hide my steam ID number so the ♥♥♥♥bots cant add me.

Ooor just dont let bots invite ANYBODY to their friend list? I hate bots in general, but perhaps some people find them useful 'inviting' (spamming, duh) group invites (tho that should be blocked as well IMO), but come on. Whats the point of bots having an option to invite to friends? Only to scam, plain and simple.

Originally posted by Fox:

And furthermore, I do believe that endorsing discrimination of any kind (even as an "option") is NOT something that should be implemented.
There are plenty of people that go private for a valid reason, and singling them out isn't going to help them.

I call ♥♥♥♥♥♥♥♥ on that. We should be able to choose who do we want in friend list or not. Its their choice to set their profiles to private, so it should be my choice NOT to accept their invites.

About the problem itself:
1) Limit the number of friend invites account (lets say under lvl 10) can invite hourly (daily) to its friend list to 10 (20, 50) [lets say, not more than 10 per hour and not more than 50 a day] - I refuse to agree somebody NEEDS to invite MORE than 50 people a day. Those restrictions should be even more strict for accounts at level 0 (like, 5 an hour, 15 daily).
2) Disable API command allowing bots to invite people to its friend list. Its pointless and is only used for spam and scam.
3) Disable inviting people to friends at all below level 1. If I recall correctly all you need to do to hit level 1 is set up some info about the account.

[pupoy]

@Βenji, the sleepy tigerthing

The problem is sometimes steam cannot tell an account is a bot, because my account was an actual account, had lots of hours on games, etc. But when it got hacked they kept everything the way it was, and basically tried to get my friends accounts.

Later on they did change the information and put in a fake name, etc and they keep it updated, But I'd assume thats because I had around 130 games. :I


As for;

About the problem itself:
1) Limit the number of friend invites account (lets say under lvl 10) can invite hourly (daily) to its friend list to 10 (20, 50) [lets say, not more than 10 per hour and not more than 50 a day] - I refuse to agree somebody NEEDS to invite MORE than 50 people a day. Those restrictions should be even more strict for accounts at level 0 (like, 5 an hour, 15 daily).
2) Disable API command allowing bots to invite people to its friend list. Its pointless and is only used for spam and scam.
3) Disable inviting people to friends at all below level 1. If I recall correctly all you need to do to hit level 1 is set up some info about the account.

I honestly, think this is a great idea to limit how many people you can add. The problem is getting level can be harder for people, because I had to make a facebook specifically to get that badge and level one.

Regards, Azhoo.

[pupoy]

@†his is a †rick

I completely understand that situation, I've lost serveral accounts because my little cousins fall for the link things and -sigh- It's easily fixed if you just change your password, as you said you do.

But yeah, it disappoits me to know that the steam tickets and people don't really help like they say they will. I gave them literally everything they asked for, and they were still 'lol nop we can't help' and honestly, I was just, like, oh. okay.

It kinda sucks.

Regards, Azhoo.

[Fox]

Originally posted by †his is a †rick:

@Fox
I get what you're saying, but I mean imagine facebook where you can disable friend invites from people who arent "friends of your friends".

This may seem like a better solution to me, as bots are more often without common friends than with private profiles. Besides, it may have other uses, for example, be a forced setting a family mode to prevent limited accounts to befriend "unknown people". But I'm veering off topic here.

Originally posted by ­­Βenji, the sleepy tigerthing:

I call ♥♥♥♥♥♥♥♥ on that. We should be able to choose who do we want in friend list or not. Its their choice to set their profiles to private, so it should be my choice NOT to accept their invites

And we hit the main issue here : sometimes, it's not their choice to go private. Harrassment victims, for example, are advised to go private during the time the harrasser gets bored with it or is dealt with appropriately. And I do recall a mod who went private because of a similar story (friend list harrassment), although I forgot who exactly.
Putting those people within the same bag as scammers (the main justification for people who want "private profile forbidden" invite option) is inflicting a double punishment to them, and that I may not support.

And such an option may provoke an unwanted reaction, as people who desire to not go public may not appreciate a new option especially made against them (Privacy-related restrictions are always to be treated with caution). But this is another subject entirely.

Originally posted by ­­Βenji, the sleepy tigerthing:

About the problem itself:
1) Limit the number of friend invites account (lets say under lvl 10) can invite hourly (daily) to its friend list to 10 (20, 50) [lets say, not more than 10 per hour and not more than 50 a day] - I refuse to agree somebody NEEDS to invite MORE than 50 people a day. Those restrictions should be even more strict for accounts at level 0 (like, 5 an hour, 15 daily).
2) Disable API command allowing bots to invite people to its friend list. Its pointless and is only used for spam and scam.
3) Disable inviting people to friends at all below level 1. If I recall correctly all you need to do to hit level 1 is set up some info about the account.

1)Yes, sadly, there is : Traders who don't wish to use trade offers. There was a feature before where people were limited to 5 a day : people complained that their trading was hampered so much, the limit had to be raised.
I do agree with this, but I guess some people won't be happy about it.

2)It may need a rework of the steam client, as I recall a link which would do this for any profile.
Rendering it harder to access for non-humans only is the way to go.

3)No, IIRC, you only need to purchase or activate a game and you're automatically level 1.

[Benji, limited edition shitlord]

Originally posted by Fox:

And we hit the main issue here : sometimes, it's not their choice to go private. Harrassment victims, for example, are advised to go private during the time the harrasser gets bored with it or is dealt with appropriately. And I do recall a mod who went private because of a similar story (friend list harrassment), although I forgot who exactly.

Balls. The magical 'Block' button. Problem = solved. You dont need to go private for that.
How bout optional auto-ignore for people that are level 0/1 AND private? That should do.

Originally posted by Fox:

1)Yes, sadly, there is : Traders who don't wish to use trade offers. There was a feature before where people were limited to 5 a day : people complained that their trading was hampered so much, the limit had to be raised.
I do agree with this, but I guess some people won't be happy about it.

2)It may need a rework of the steam client, as I recall a link which would do this for any profile.
Rendering it harder to access for non-humans only is the way to go.

3)No, IIRC, you only need to purchase or activate a game and you're automatically level 1.

1) Again, make those limitations for accounts lvl 0/1. I bet people that trade MORE than FIFTY times a day BOTHERED raising their account level to AT LEAST lvl 2.
2) You know how API works? Just disable this one function 'add_to_friend_list' or wahtever its called for people that arent steam developers, BAM, problem solved.
3) Really? I bet majority of those bots dont even have one game. But then again, limit the amount of friend invites available to 20 a day until they hit level 2, problem solved.

[CrimsonTriton]

...

[Fox]

Originally posted by ­­Βenji, the sleepy tigerthing:

Balls. The magical 'Block' button. Problem = solved. You dont need to go private for that.
How bout optional auto-ignore for people that are level 0/1 AND private? That should do.

When people start making numerous alts, blocking may not be efficient or fast enough, which means that "private" is needed to contain the breach. If this makes it easier, it's like a server who goes offline due to too many requests. It may be uncommon, but it sadly happens.

Level-based blocking, for me, is the lesser of the two evils, and may be worth testing.

Originally posted by ­­Βenji, the sleepy tigerthing:

1) Again, make those limitations for accounts lvl 0/1. I bet people that trade MORE than FIFTY times a day BOTHERED raising their account level to AT LEAST lvl 2.
2) You know how API works? Just disable this one function 'add_to_friend_list' or wahtever its called for people that arent steam developers, BAM, problem solved.
3) Really? I bet majority of those bots dont even have one game. But then again, limit the amount of friend invites available to 20 a day until they hit level 2, problem solved.

1)Why not ? I'd even go as far as level 5, which is the summer-sale limit.
2)Oh, I was mistaken, I thought about the steam:// link. My apologies.
Well, in that case, I'm afraid my knowledge is limited on that point, but your reasoning makes sense.
3)Really. There is only two ways a bot can add someone else : either they activate a game, or the "can't add friends until level 1" feature is broken and needs a fix ASAP.
I'd have rather seen a system where the more leveled you are, the more invites you can send. Akin to 20 + 5 * Steam Level or a formula like that. It'd provide an incensitive to level up.