Buying Skins Safely and Avoiding Scams
Fake Domains and Phishing
Scammers register look-alike domains that mimic Steam or popular marketplaces, swapping a letter or adding a word so a quick glance misses the difference. They lure you with a fake login page designed to capture your username, password, and even your Steam Guard code.
Always check the full URL before signing in, type or bookmark official addresses rather than clicking links from chat or email, and never enter your Steam credentials on a page you reached through an unsolicited message. A legitimate trade never requires your Steam password on a third-party site.
Steam Guard and Two-Factor Authentication
Enable Steam Guard Mobile Authenticator and keep two-factor authentication turned on everywhere it is offered. This single step blocks the vast majority of account takeovers, because an attacker who steals your password still cannot log in without your device.
Never share a Steam Guard code with anyone. No legitimate support agent, trader, or marketplace will ever ask for it. A request for your code is, by itself, proof of a scam.
Never Trade Off-Platform
A common pitch is to move a deal into a private chat or a direct Steam trade to avoid fees. The moment you leave a platform's protected system, you lose escrow and any buyer protection, and you are relying entirely on a stranger's honesty.
Keep every transaction inside the marketplace that offers escrow or guarantees. If someone insists on going off-platform to save a little money, treat it as a red flag rather than a bargain.
Fake Bots and API Scams
Some scams impersonate the automated trade bots that marketplaces use, sending you a trade offer from a copycat account so the item you expect never arrives. Others try to trick you into revealing your Steam Web API key or installing a browser extension that silently redirects your trades to the scammer.
Verify bot accounts through the official platform only, never paste your API key where you were asked to by a stranger, and be suspicious of any tool promising free skins or guaranteed profits. If you suspect your API key was exposed, revoke it immediately in your Steam settings.
Inspect Link and Float
Before buying, use the in-game inspect link to confirm the item is exactly what the listing claims. The inspect link shows the real skin, its wear, any stickers, and the float value that determines its visual condition. A mismatch between the listing and the inspected item is a warning sign.
Checking float and stickers also protects you from overpaying. Two skins with the same name can differ significantly in value depending on wear and applied stickers, so the inspect link is both a safety tool and a pricing tool.
What to Do If You Are Scammed
Act quickly. Change your Steam password, revoke your Web API key, deauthorize other devices, and confirm Steam Guard is active. If you entered credentials on a fake site, assume they are compromised and update them anywhere you reused them.
Report the incident to the marketplace's support and to Steam, and gather evidence such as chat logs and trade IDs. Recovery is not guaranteed, but prompt action limits the damage and may help support investigate. The best protection remains prevention through the habits above.
Frequently Asked Questions
How can I spot a fake Steam or marketplace site?
Check the full URL carefully for misspellings or extra words, reach sites through your own bookmarks rather than links in messages, and never enter your Steam password on a third-party page. Look-alike domains are the most common phishing trick.
Will anyone legitimately ask for my Steam Guard code?
Never. No support agent, trader, or platform needs your Steam Guard code. Any request for it is a scam, so do not share it under any circumstances.
Is it safe to trade directly to save on fees?
No. Moving a deal off-platform removes escrow and buyer protection and leaves you dependent on a stranger's honesty. Keep every transaction inside the protected system even if it costs a little more.
What is an inspect link and why should I use it?
An inspect link opens the actual in-game item so you can verify its wear, stickers, and float before buying. It confirms the listing is genuine and helps you avoid overpaying for a worse-condition skin.
What should I do right after being scammed?
Immediately change your Steam password, revoke your Web API key, deauthorize other devices, and ensure Steam Guard is on. Then report the incident to the marketplace and Steam with any chat logs and trade IDs as evidence.
Why would a scammer want my Steam Web API key?
With your API key, a scammer can monitor and in some setups redirect your trade offers so items go to them instead of you. Never share it, and revoke it in your Steam settings if you think it was exposed.