Steam Safety
Steam Support does not reach out to people by Steam chat or Discord. Anyone approaching you that says they're from Steam Support (or Trickys Support) and asks for your account information or items is a scammer.
Watch out for Account Hijacking
- NEVER give out your password to anyone.
- NEVER click unknown links from untrusted sources.
- NEVER follow instructions to speak with someone claiming to represent Steam Support through Discord or any other chat system, even if they come from a friend's account.
- There's no such thing as a false report that you need to take steps to solve. This is a scam.
Get Secure
- Having a phone number linked with your account will help you recover your account if it is compromised - Manage Now
- Steam Guard Mobile Authenticator Get Steam Guard
Common Type Of Scams
These cover most common scams that occur on Steam. It includes various trade scams and also several other risks for your account.
Quick Reference For Common Scams
A Steam/Valve administrator/employee/moderator will NEVER contact you through Discord, Steam chat or any other place to talk about anything pertaining to your account.
A Steam/Valve administrator/employee/moderator will never add you as a friend to talk about any of the following things. If Valve needs to talk to you about something they will contact you through an account alert. Here are some examples of what an account alert might look like: Example 1, Example 2, Example 3, Example 4, Example 5.
A Steam/Valve administrator/employee/moderator will never send you a picture, gif, video or any other form of media as proof or information about anything. Any pictures, gifs, etc. sent to you that look like your account is being viewed by someone with special permissions are fake.
A Valve employee will always have a Valve Employee Steam profile badge and a Steam moderator will always have a Steam Community Moderator Steam profile badge on their Steam profiles. Check it yourself, never trust ANY form of picture or media sent to you, and never trust a link to a profile sent to you. A scammer can send you a link to any profile.
A scammer screensharing with you on Discord or somewhere else will use programs and extensions to falsely modify Steam pages, and make fake pages that look like they have special administrator privileges. This is never real, just understand that a Valve employee or Steam moderator will NEVER contact you in this way, the only way you will ever be contacted is through Steam Support, and no other way.
- There's no such thing as appealing a pending or false report or ban. - There's no such thing as a pending ban.
- There's no such thing as a pending report.
- There's no such thing as a false or accidental report.
- There's no such thing as item verification or item scanning.
- There's no such thing as a Certificate of Eligibility.
There's no such thing as an accidental report, and if someone truly did accidentally report you, Valve will see that the report is not valid and nothing will happen, you would never be contacted about it in such a manner. Someone representing Valve or Steam will never ask you for your items, money or other monetary commodity such as gift cards, account credentials, this includes your log-in name and authenticator codes. Do not share them with anyone.
Someone's account age, profile level, high amount of friends, or high amount of comments on a profile is NOT a way to verify someone's legitimacy. Scammers purchase old accounts, it costs a few dollars to get a high profile level, friends can be farmed through malicious groups and comments can also be farmed or bought.
You cannot trade Steam wallet funds or CD-keys via Steam, and there's no way for it to be automatically added to your account when a trade is completed.
CD and Wallet codes can be purchased with stolen credit cards or other malicious methods. If this has happened with a CD or Wallet code you've redeemed your account is at high risk of being locked for fraudulence, as such it is never recommended you trade for CD or Wallet keys, and it is never recommended to purchase anything from unauthorized re-sellers like the scam sites G2A or Kinguin.
A Steam/Valve administrator/employee/moderator will never add you as a friend to talk about any of the following things. If Valve needs to talk to you about something they will contact you through an account alert. Here are some examples of what an account alert might look like: Example 1, Example 2, Example 3, Example 4, Example 5.
A Steam/Valve administrator/employee/moderator will never send you a picture, gif, video or any other form of media as proof or information about anything. Any pictures, gifs, etc. sent to you that look like your account is being viewed by someone with special permissions are fake.
A Valve employee will always have a Valve Employee Steam profile badge and a Steam moderator will always have a Steam Community Moderator Steam profile badge on their Steam profiles. Check it yourself, never trust ANY form of picture or media sent to you, and never trust a link to a profile sent to you. A scammer can send you a link to any profile.
A scammer screensharing with you on Discord or somewhere else will use programs and extensions to falsely modify Steam pages, and make fake pages that look like they have special administrator privileges. This is never real, just understand that a Valve employee or Steam moderator will NEVER contact you in this way, the only way you will ever be contacted is through Steam Support, and no other way.
- There's no such thing as appealing a pending or false report or ban. - There's no such thing as a pending ban.
- There's no such thing as a pending report.
- There's no such thing as a false or accidental report.
- There's no such thing as item verification or item scanning.
- There's no such thing as a Certificate of Eligibility.
There's no such thing as an accidental report, and if someone truly did accidentally report you, Valve will see that the report is not valid and nothing will happen, you would never be contacted about it in such a manner. Someone representing Valve or Steam will never ask you for your items, money or other monetary commodity such as gift cards, account credentials, this includes your log-in name and authenticator codes. Do not share them with anyone.
Someone's account age, profile level, high amount of friends, or high amount of comments on a profile is NOT a way to verify someone's legitimacy. Scammers purchase old accounts, it costs a few dollars to get a high profile level, friends can be farmed through malicious groups and comments can also be farmed or bought.
You cannot trade Steam wallet funds or CD-keys via Steam, and there's no way for it to be automatically added to your account when a trade is completed.
CD and Wallet codes can be purchased with stolen credit cards or other malicious methods. If this has happened with a CD or Wallet code you've redeemed your account is at high risk of being locked for fraudulence, as such it is never recommended you trade for CD or Wallet keys, and it is never recommended to purchase anything from unauthorized re-sellers like the scam sites G2A or Kinguin.
SteamAPI Scam (Phishing)
This is functionally a sub-set of Phishing and Trading, but because its extremely common we're outlining it here.
In order to trade items, a user must initiate the trade and confirm it in the Steam Mobile Authenticator. There is no way for a scammer to bypass this. However they can trick users into approving the 'wrong' trade via this scam. It effectively tricks a user into approving a bad trade without them knowing via the SteamAPI.
1. User logs into a fake website - This is PHISHING. YOU ALREADY SCREWED UP, you are essentially just giving away your log-in credentials and authenticator code.
2. The attacker then logs into your account.
3. They add a SteamAPI key to your account.
4. The attacker waits, this is the insidious part, because you dont know you've been compromised.
5. You get a legitimate trade from someone.
6. The attacker detects this via the SteamAPI key they created on your account.
7. The attacker then immediately cancels that trade, creates another account that looks exactly like the account from the original trade, and sends you that trade instead. They can do this automatically via the SteamAPI key by way of programs, scripts and bots.
8. You look at your trades, and at first glance everything looks fine as the profile at first glance looks the same as the one from the legitimate trade.
9. You approve the trade in your Steam Mobile Authenticator.
10. Your stuff is now gone.
Change your steam password
De-authorize all other devices
Set up 2FA if you haven't already
Functionally this is a phishing scam. You logged into a phishing site to get free money or whatever and gave away your steam credentials.
If there is anything in here your account is compromised.
In order to trade items, a user must initiate the trade and confirm it in the Steam Mobile Authenticator. There is no way for a scammer to bypass this. However they can trick users into approving the 'wrong' trade via this scam. It effectively tricks a user into approving a bad trade without them knowing via the SteamAPI.
1. User logs into a fake website - This is PHISHING. YOU ALREADY SCREWED UP, you are essentially just giving away your log-in credentials and authenticator code.
2. The attacker then logs into your account.
3. They add a SteamAPI key to your account.
4. The attacker waits, this is the insidious part, because you dont know you've been compromised.
5. You get a legitimate trade from someone.
6. The attacker detects this via the SteamAPI key they created on your account.
7. The attacker then immediately cancels that trade, creates another account that looks exactly like the account from the original trade, and sends you that trade instead. They can do this automatically via the SteamAPI key by way of programs, scripts and bots.
8. You look at your trades, and at first glance everything looks fine as the profile at first glance looks the same as the one from the legitimate trade.
9. You approve the trade in your Steam Mobile Authenticator.
10. Your stuff is now gone.
Change your steam password
De-authorize all other devices
Set up 2FA if you haven't already
Functionally this is a phishing scam. You logged into a phishing site to get free money or whatever and gave away your steam credentials.
If there is anything in here your account is compromised.
Scams Via Viruses
This risk exists pretty much everywhere on the internet and Steam is not an exception. Just as usual, it is very important that you pay attention to what links you click and what you download. The vast majority of threats can be dealt with an anti-virus software and common sense.
- Be especially cautious with new friends who want something from you.
- We highly recommend you enable Steam Guard two-factor authentication to secure your account - How to set up
- NEVER trust a website when your friend has to bypass Steam's URL filter in order to send you the URL, e.g.
• [username]: Visit this awesome website: fakeandmalicioussite .com
• [username]: Just remove the space
You might end on a site like this one and the downloaded file is a Trojan.
Either via a comment or pm this person will make up a story in order to make you click the link. You assume it leads to a screenshot. The most common stories are e.g.
"Congratulations, you won a prize in the giveaway group X. Simply tell me which of the ones on this image you want."
"I want to trade with you, but I sadly have to keep my inventory private due to many scammers. Please tell me which skin you'd want to trade from this screenshot"
Some may notice the link leads to a site similar looking to other popular image hosting sites, but is in fact malicious. Usually one letter is changed, or sometimes their order. Even if the url says sitename.com/image.png, is doesn't mean it leads to an image file. Some sites will try to download the file in the background, other will display a fake error message ("unable to load the picture") and tell you to download the image which, as it later turns out, isn't actually one. It was straight up malware named image.png.scr, or image.png.exe
The guy who added you will do everything to be nice to you: offer you some items for free, play matches with you, etc...
After a while, he'll ask if you have ever played on ESEA or if you know about it. You probably have heard about it, but since you're playing competitive, you don't have a subscription for it. The scammer knows this and will use it against you.
He will ask you if you want it for free. Meanwhile, behind the scenes, the file he wants to send you will hijack you.
- Be especially cautious with new friends who want something from you.
- We highly recommend you enable Steam Guard two-factor authentication to secure your account - How to set up
- NEVER trust a website when your friend has to bypass Steam's URL filter in order to send you the URL, e.g.
• [username]: Visit this awesome website: fakeandmalicioussite .com
• [username]: Just remove the space
You might end on a site like this one and the downloaded file is a Trojan.
Variation: Fake screenshot link
Here a scammer will try to get you to download a file by tricking you into believing it is a screenshot.Either via a comment or pm this person will make up a story in order to make you click the link. You assume it leads to a screenshot. The most common stories are e.g.
"Congratulations, you won a prize in the giveaway group X. Simply tell me which of the ones on this image you want."
"I want to trade with you, but I sadly have to keep my inventory private due to many scammers. Please tell me which skin you'd want to trade from this screenshot"
Some may notice the link leads to a site similar looking to other popular image hosting sites, but is in fact malicious. Usually one letter is changed, or sometimes their order. Even if the url says sitename.com/image.png, is doesn't mean it leads to an image file. Some sites will try to download the file in the background, other will display a fake error message ("unable to load the picture") and tell you to download the image which, as it later turns out, isn't actually one. It was straight up malware named image.png.scr, or image.png.exe
Variation: ESEA Crack
Sometimes, when you're playing competitive Counter-Strike: Global Offensive, you meet a nice dude who you'd like to play with again. Sadly do some people have bad intentions. This rarely happens, but if it does, it often goes as this:The guy who added you will do everything to be nice to you: offer you some items for free, play matches with you, etc...
After a while, he'll ask if you have ever played on ESEA or if you know about it. You probably have heard about it, but since you're playing competitive, you don't have a subscription for it. The scammer knows this and will use it against you.
He will ask you if you want it for free. Meanwhile, behind the scenes, the file he wants to send you will hijack you.
Phishing Scams
One of the most common ways for account hijackers to get access to your account is by creating a fake page and tricking their victims into believing it is the real website. The URL and the site itself will usually look very similar to the original, e.g: steamcomnunity, steamcomuniity or staemcommunity.
Hackers will usually spread these fake links via automated bots or already hijacked accounts which either add you or just comment the fake links. The chance of receiving these messages increases when using trading sites like TF2Backpack, CSGOLoungue and DOTA2Lounge.
Such a message could for example look like this:
[username]: Hi, my friend somehow can't add you as a friend. He always receives an error message, but he wants to trade with you. Can you please add him: steamscommuntiy.com/id/scammerusername/
The easiest way to never fall for a phishing scam (especially if you're unsure if the login page is legit) to use a simply trick:
Visit the official Steam Community page first and log in as usual. Now tell the other page to log in via Steam. If the site is legit, it will now show you as already logged in. If it asks you to enter your credentials, it is a phishing scam and you should immediately close the site.
Valve operates the following websites for Steam. If you are prompted with a login page, the first part of the URL within the browser will always be one of the following domains:
• https://steamcommunity.com
• https://steampowered.com
• https://store.steampowered.com
• https://help.steampowered.com
This files is essentially a prove that the current device is already authorized and doesn't require a SteamGuard code anymore (the Remember me feature).
The best way to protect yourself against it is to either type in the URL manually or copy only parts of it (e.g. /id/scammerusername/). If you don't want to do this effort, you should at least check the link displayed in Steam's warning message. Steam will in these cases show you a different, weird looking, URL at which point you should immediately stop. Here is an example of how it could look like.
For example, try to tell the difference between the following URLs (first one is the original, second one fake):
• store.steampowered.com
• store.steampоwered.com
For the more technical part, it works by using certain unicode characters that look identical to the "normal" ASCII ones. One example would be о and o which look very similar, but are not the same letter (cyrillic on the left, latin on the right). Many browsers will convert these unicode letters to ASCII which results in Punnycode, this weird looking url (here: store.xn--steampwered-wnj.com).
Hackers will usually spread these fake links via automated bots or already hijacked accounts which either add you or just comment the fake links. The chance of receiving these messages increases when using trading sites like TF2Backpack, CSGOLoungue and DOTA2Lounge.
Such a message could for example look like this:
[username]: Hi, my friend somehow can't add you as a friend. He always receives an error message, but he wants to trade with you. Can you please add him: steamscommuntiy.com/id/scammerusername/
The easiest way to never fall for a phishing scam (especially if you're unsure if the login page is legit) to use a simply trick:
Visit the official Steam Community page first and log in as usual. Now tell the other page to log in via Steam. If the site is legit, it will now show you as already logged in. If it asks you to enter your credentials, it is a phishing scam and you should immediately close the site.
Valve operates the following websites for Steam. If you are prompted with a login page, the first part of the URL within the browser will always be one of the following domains:
• https://steamcommunity.com
• https://steampowered.com
• https://store.steampowered.com
• https://help.steampowered.com
Variation: SSFN Scam
One way hijackers are trying to bypass SteamGuard is by asking you to upload the "SSFN" file(s) which lie in Steam's installation folder. Never under any circumstances upload or share this file. Not even Valve themselves will ever ask you for it.This files is essentially a prove that the current device is already authorized and doesn't require a SteamGuard code anymore (the Remember me feature).
Variation: Punycode
This scam is essentially also phishing, but the most difficult one to notice and it requires quite a lot of effort. The attacker will send you a link that looks exactly like the original and often can not be distinguished by looking at it. However when opening the link, it will send you to a different site, which is usually a phishing site; in some case even straight up malware.The best way to protect yourself against it is to either type in the URL manually or copy only parts of it (e.g. /id/scammerusername/). If you don't want to do this effort, you should at least check the link displayed in Steam's warning message. Steam will in these cases show you a different, weird looking, URL at which point you should immediately stop. Here is an example of how it could look like.
For example, try to tell the difference between the following URLs (first one is the original, second one fake):
• store.steampowered.com
• store.steampоwered.com
For the more technical part, it works by using certain unicode characters that look identical to the "normal" ASCII ones. One example would be о and o which look very similar, but are not the same letter (cyrillic on the left, latin on the right). Many browsers will convert these unicode letters to ASCII which results in Punnycode, this weird looking url (here: store.xn--steampwered-wnj.com).
Scams Via Impersonation
There are several scam variations of essentially the same concept of impersonation. This is usually done with the intention to scam valuable items, but doesn't have to.
Always verify that people are who they claim to be, for example if they claim to be from Valve, visit this page click on the person in the list and see if you have them added as a friend (very unlikely).
Give your friends nicknames so you can easily distinguish them from impersonator and also better remember them (open the Friends window, right click on the person and select Add Nickname).
After that he will ask you if you can trade your expensive item to your friend to see it really is your friend ("you trust your friend so it should be no problem"). After you've given your item to your friend, the scammer's second account will come into play. Now that your friend probably accepted the chatroom invite, he will change his second account's name similar to yours (usually adding a . (dot) into the end of your name so that there wont be YOURNAME (2) when trading).
And after that, he will send a trade invite to your friend and your friend will probably give the item back to "you" (the scammer's 2nd account with a name similar to yours).
Everyone associated with Valve is listed here. If the person actually worked for Valve, they would be listed on that page and have a badge that says "Valve Employee" or "Steam Community Moderator".
This scam method can also include spoofed emails from Valve or Steam Support. Please keep in mind that neither of them will ever send you emails with attachments.
Always verify that people are who they claim to be, for example if they claim to be from Valve, visit this page click on the person in the list and see if you have them added as a friend (very unlikely).
Give your friends nicknames so you can easily distinguish them from impersonator and also better remember them (open the Friends window, right click on the person and select Add Nickname).
Variation: Third person scam / Chatroom Scam
A random guy adds you. He makes an offer (CS:GO/TF2 keys for a high-priced item for example) for you via steam chat, usually an overpay. He then says that he doesn't know if he can trust you, so he asks you if you have a trusted friend. Then the guy wants you to tell him the friends name/link to his steam profile. He then adds your friend and asks him some useless questions about trust (and invites your friend to a chatroom with another account).After that he will ask you if you can trade your expensive item to your friend to see it really is your friend ("you trust your friend so it should be no problem"). After you've given your item to your friend, the scammer's second account will come into play. Now that your friend probably accepted the chatroom invite, he will change his second account's name similar to yours (usually adding a . (dot) into the end of your name so that there wont be YOURNAME (2) when trading).
And after that, he will send a trade invite to your friend and your friend will probably give the item back to "you" (the scammer's 2nd account with a name similar to yours).
Variation: Middleman Injection
After a trade that takes place partially outside Steam has been agreed to, a middleman needs to be chosen. The scammer will suggest a trusted middleman that checks out correctly on SteamRep. However, once the victim agrees to the middleman a fake account pretending to be that middleman adds the victim. Once the unaware victim completes their side of the transaction, believing that they are using a trusted middleman, both the scammer and accomplice will delete and block them while keeping the stolen goods. Make sure you personally add the middleman yourself, and independently verify the identity of the person who added you using the instructions above (look up both accounts on SteamRep and compare). If you're not listed in the friends list of the actual trusted middleman, you're dealing with a scammer. You need to check the MM out yourself - that means you click on the MM's profile and copy/paste their profile URL into SteamRep and verify that it's the person they say they are.Variation: Valve Impersonation
Some people will try to scam items by telling you that they're an employee and that you got reported for duping/scamming/... and/or that they want to "scan" your items. Valve will NEVER trade or participate in trading. Do not trust anyone who claims otherwise, even if they go so far as to threaten with some kind of ban. Everyone claiming to be from/involved with Valve and is trying to trading with you or threatening you is lying.Everyone associated with Valve is listed here. If the person actually worked for Valve, they would be listed on that page and have a badge that says "Valve Employee" or "Steam Community Moderator".
This scam method can also include spoofed emails from Valve or Steam Support. Please keep in mind that neither of them will ever send you emails with attachments.
Trade scams
There are many trade scams ranging from pathetic to very sneaky.
You should always keep all aspect of a trade within a single trade. Avoid all external trades such a game keys or money, especially if you're inexperienced. Otherwise you could end up trading your goods first and when it's your trading partner's turn, they'll simply block you and walk away with your items.
There are a few things that are always a scam:
• Trading Steam Wallet funds: Steam Wallet funds can not be transferred or added to a trade.
• Item verification: There is no such thing as item verification. Valve will never ask you for items.
• Borrowing an item: This can be a teammate begging for items, or sometimes even an impersonator of popular individuals (e.g. YouTube) who claims to "borrow" your items for a few matches.
• Voting for a team on a website: A user will ask for you to vote for their "team", such as a CS:GO or Dota team. They will direct you to a website to vote, but it is a normal phishing scam.
With a PayPal Invoice, sellers are able to customize the contents of an invoice they are planning to send to a buyer. They can list the items they are selling, the quantity, unit price, and amount, all leading to a total amount for the invoice. Additionally, there are "Terms and conditions" and "Note to recipient" sections where they can add in more details about the transaction. Because sellers are free to write whatever they want in these two sections, businesses who use PayPal Invoice will write down the conditions of the transactions so customers will understand them before purchasing goods from them. Scammers take advantage of these two sections by writing in such a way that misleads buyers into thinking the invoice is a payment method.
In the "Terms and Conditions," they may write variations and combinations of the following statement: "This is a PayPal Gift. Gifts are non-refundable. It may take up to 24 hours to process and reflect in your PayPal balance. PayPal has you covered." All of this is written by the scammer to mislead the reader into thinking that the invoice is actually a "PayPal Gift" payment system with PayPal's terms and conditions. The "Note to recipient" section may have similar wording that suggests PayPal is more involved in the transaction than the service actually provides. With these set in place, scammers will send invoices to potential victims.
One version of the scam involves the scammer who is the buyer sending an invoice to the seller. Because of the wording in the two sections in the invoice, it would suggest that the seller would have to pay the scammer. The solution is to ignore the invoice.
Another scam involves the scammer who is the buyer offering to pay first to the seller.
1. Scammer offers to pay for item prior to trade.This would instill a sense of ease in the seller for not having to worry about being paid.
2. Scammer sends an invoice disguised as a fake PayPal Gift statement.Remember that it should be the seller who sends an invoice to the buyer, but what the scammer does is after sending the invoice to the seller, he will mark it as paid. Marking it as paid does not mean a transaction has taken place, but it will show up to the seller as though one has been made.
3. Seller thinks that he has been paid.By reading the "Terms and conditions" and "Note to recipient," the seller will believe that he has been paid through a PayPal gift process. Furthermore, because the term says the gift is non-refundable or can't be charged-back, he will be mislead into thinking that he will not be a victim of a chargeback scam (even though he's about to become the victim of another scam).
4. Seller then trades item with scammer.What the seller failed to notice is that his PayPal balance has not changed, so he has not actually been paid. Even if the seller did notice, because the misleading "Terms and conditions" created by the scammer states that PayPal Gift payments may take up to 24 hours to process, he may think that it will take a while before his PayPal balance is updated. 5. Result is that the scammer has received an item from the seller and the seller did not receive payment.
You should always keep all aspect of a trade within a single trade. Avoid all external trades such a game keys or money, especially if you're inexperienced. Otherwise you could end up trading your goods first and when it's your trading partner's turn, they'll simply block you and walk away with your items.
There are a few things that are always a scam:
• Trading Steam Wallet funds: Steam Wallet funds can not be transferred or added to a trade.
• Item verification: There is no such thing as item verification. Valve will never ask you for items.
• Borrowing an item: This can be a teammate begging for items, or sometimes even an impersonator of popular individuals (e.g. YouTube) who claims to "borrow" your items for a few matches.
• Voting for a team on a website: A user will ask for you to vote for their "team", such as a CS:GO or Dota team. They will direct you to a website to vote, but it is a normal phishing scam.
Variation: Quick-switching
This involves the victim thinking they're getting one item but gets another instead. While in a trade, a scammer will put up the desired item. Without the victim noticing, he'll quickly switch it to another item of less value that looks similar. A common attempt is switching an expensive unusual hat with a much cheaper unusual version of that hat; the item will look the same in the trade window but have a different effect. The item might also be renamed so that chat window of the trade that updates when items are removed/added looks less suspicious. After trading, the victim is left with the switched item. This scam often involves misdirection; they'll ask a question in Steam chat so the victim switches windows and then the scammer will swap the item while the victim is typing. They might also ask the victim to add another item or remove one of them, or add and remove many items themselves to mask the visible chat log from showing that they've switched the item. With updates to Steam trading this has become easier to notice. Any change in items is shown in the trade chat log and any change after you have readied up on the trade will stop you from accepting the trade. Always take your time in trades, and double check all items after you have clicked "ready".Variation: Charge-backs
One issue that comes with any external transaction that allows charge-backs, such as PayPal. This feature allows customers to get their money back if the seller did not properly deliver sold goods. However this system can rather easily be abused, since PayPal can not properly verify these "trades". If you still want to use these transaction methods, inform yourself of the risks and how to prevent them.Variation: Invoices
An invoice is a method for a seller to request payment from a buyer, and there are scams designed to take advantage of people's familiarity and lack of familiarity with the process. The following covers PayPal, a popular service that can send invoices.With a PayPal Invoice, sellers are able to customize the contents of an invoice they are planning to send to a buyer. They can list the items they are selling, the quantity, unit price, and amount, all leading to a total amount for the invoice. Additionally, there are "Terms and conditions" and "Note to recipient" sections where they can add in more details about the transaction. Because sellers are free to write whatever they want in these two sections, businesses who use PayPal Invoice will write down the conditions of the transactions so customers will understand them before purchasing goods from them. Scammers take advantage of these two sections by writing in such a way that misleads buyers into thinking the invoice is a payment method.
In the "Terms and Conditions," they may write variations and combinations of the following statement: "This is a PayPal Gift. Gifts are non-refundable. It may take up to 24 hours to process and reflect in your PayPal balance. PayPal has you covered." All of this is written by the scammer to mislead the reader into thinking that the invoice is actually a "PayPal Gift" payment system with PayPal's terms and conditions. The "Note to recipient" section may have similar wording that suggests PayPal is more involved in the transaction than the service actually provides. With these set in place, scammers will send invoices to potential victims.
One version of the scam involves the scammer who is the buyer sending an invoice to the seller. Because of the wording in the two sections in the invoice, it would suggest that the seller would have to pay the scammer. The solution is to ignore the invoice.
Another scam involves the scammer who is the buyer offering to pay first to the seller.
1. Scammer offers to pay for item prior to trade.This would instill a sense of ease in the seller for not having to worry about being paid.
2. Scammer sends an invoice disguised as a fake PayPal Gift statement.Remember that it should be the seller who sends an invoice to the buyer, but what the scammer does is after sending the invoice to the seller, he will mark it as paid. Marking it as paid does not mean a transaction has taken place, but it will show up to the seller as though one has been made.
3. Seller thinks that he has been paid.By reading the "Terms and conditions" and "Note to recipient," the seller will believe that he has been paid through a PayPal gift process. Furthermore, because the term says the gift is non-refundable or can't be charged-back, he will be mislead into thinking that he will not be a victim of a chargeback scam (even though he's about to become the victim of another scam).
4. Seller then trades item with scammer.What the seller failed to notice is that his PayPal balance has not changed, so he has not actually been paid. Even if the seller did notice, because the misleading "Terms and conditions" created by the scammer states that PayPal Gift payments may take up to 24 hours to process, he may think that it will take a while before his PayPal balance is updated. 5. Result is that the scammer has received an item from the seller and the seller did not receive payment.
Fake Gambling Sites
There are many different methods that involve a fake gambling site and all of them are centered around 2 things, phishing you and/or stealing your skins by baiting you into using the fake gambling site. In this section we will go over a few known methods.
Because all of them can be centered around phishing you we will not mention this in every method.
All of these sites also present themselves to be real by having a fake chat where there are bots saying things, usually in conjunction with a fake jackpot. For example when someone wins big the bots will spam about that specific big win. All of the events are scripted, and if you stay long enough you will start to see the events repeating themselves, think of it like a video playing over and over.
It can also be ran through an API where the bots basically have a library of things they can say with a time limit that controls how often the bots can say something, and trigger events as to when they say some specific things, like when someone wins/loses a jackpot.
Because all of them can be centered around phishing you we will not mention this in every method.
All of these sites also present themselves to be real by having a fake chat where there are bots saying things, usually in conjunction with a fake jackpot. For example when someone wins big the bots will spam about that specific big win. All of the events are scripted, and if you stay long enough you will start to see the events repeating themselves, think of it like a video playing over and over.
It can also be ran through an API where the bots basically have a library of things they can say with a time limit that controls how often the bots can say something, and trigger events as to when they say some specific things, like when someone wins/loses a jackpot.
The Common Scams
A common method is that you're just being phished, the gambling site is just to bait you. Phishing is something you should always be wary of, it can happen anywhere or anytime with any link or website.
Read Phishing Scams for further information.
Another common method is that you're presented with a fake gambling website that uses the real Steam API. It has a jackpot that is seemingly active with real players in it, but you will simply never win the jackpot because the website is just a facade, the chat and the jackpot is simulated, no matter how much you deposit, no matter how big of a chance you have to win, you will never actually win.
Read Phishing Scams for further information.
Another common method is that you're presented with a fake gambling website that uses the real Steam API. It has a jackpot that is seemingly active with real players in it, but you will simply never win the jackpot because the website is just a facade, the chat and the jackpot is simulated, no matter how much you deposit, no matter how big of a chance you have to win, you will never actually win.
The Deposit Scam
A scammer will add you and tell a story about how they won a lot of skins on a gambling site, but they are having issues with withdrawing them. That's where you get asked the help them out, and they will promise you a nice reward for helping them.
In this stage of the scam many different things can happen, but in short they try to convince you through one way or another of social engineering that to help them you need to withdraw the skins for them; this is where the scam kicks in.
To withdraw the skins you need to make a first-time deposit onto the gambling site. If you do this you will lose those skins and you've been scammed. There is no skins to withdraw, there's no one who needs help and there's definitely no reward at the end of it for you.
In this stage of the scam many different things can happen, but in short they try to convince you through one way or another of social engineering that to help them you need to withdraw the skins for them; this is where the scam kicks in.
To withdraw the skins you need to make a first-time deposit onto the gambling site. If you do this you will lose those skins and you've been scammed. There is no skins to withdraw, there's no one who needs help and there's definitely no reward at the end of it for you.
The Job Offer
In this scam there will be a person who adds you on Steam and pitches you a job offer on a fake gambling site, most commonly either a moderation job or a coding job.
Here you may notice that this job offer is quite weird. Unlike a traditional job offer where you have to prove yourself to the company, the scammer is trying to prove their website to you, they are pitching themselves to you as if you're the one in control, this is to make you feel comfortable, it is a method of social engineering. Usually they give you no real information. They usually tell you how many hours a day you need to work, but they wont go any further and literally anything you say will be okay with them. If you tell them you can only moderate for 30 minutes a day they will be completely fine with it.
Through social engineering they will try and convince you that they will pay you before you even start to work on the website. Again they are trying to make you feel comfortable and make you feel as if there's nothing to lose, they are even giving you the opportunity to scam them by taking the payment and leaving, but again this is social engineering, and the scam is about to begin.
Assuming this isn't a phishing scam and you've logged into the site using Valve's real Steam API the scammer will try to get you to deposit something, usually through 2 different methods.
One way of baiting you is that the scammer will add fake items to your site inventory and tell you to withdraw them, but to withdraw them you need to make a first-time deposit. If you deposit something you've been scammed, there's no job and there's no items for you to withdraw.
Another way of doing it is that the scammer will tell you to make a deposit on the gambling site and they will make you win the jackpot and they will try to convince you that you have to make a considerably large bet so your chances of winning are bigger than 1%-5% because it can be hard to make you win if your chances are too low.
If you do deposit something you've lost the items and the scam may be over, but sometimes it isn't. Sometimes the scammer will try to continue socially engineering you.
If the scammer decides to continue they will make it look like you've won the jackpot but you will obviously not receive any of these items, the scammer will try to convince you that a hiccup with the site happened and that you need to deposit and win the jackpot again. If you haven't caught onto the scam yet and you decide to deposit again they will yet again make it look like you won the jackpot, but you will be in this loophole until you're out of skins or until you've caught onto the scam.
The reason this scam can work quite well on gullible people is because throughout the entire scam you're always shown that you have the upper hand. For example the way they presented the job offer to you, and the fact that they are paying you before you even start to work, and at the last stage of the scam you are proven that you are talking to a real admin of the website because they did in fact make it look like you won the jackpot.
Social engineering can be quite malicious.
Here you may notice that this job offer is quite weird. Unlike a traditional job offer where you have to prove yourself to the company, the scammer is trying to prove their website to you, they are pitching themselves to you as if you're the one in control, this is to make you feel comfortable, it is a method of social engineering. Usually they give you no real information. They usually tell you how many hours a day you need to work, but they wont go any further and literally anything you say will be okay with them. If you tell them you can only moderate for 30 minutes a day they will be completely fine with it.
Through social engineering they will try and convince you that they will pay you before you even start to work on the website. Again they are trying to make you feel comfortable and make you feel as if there's nothing to lose, they are even giving you the opportunity to scam them by taking the payment and leaving, but again this is social engineering, and the scam is about to begin.
Assuming this isn't a phishing scam and you've logged into the site using Valve's real Steam API the scammer will try to get you to deposit something, usually through 2 different methods.
One way of baiting you is that the scammer will add fake items to your site inventory and tell you to withdraw them, but to withdraw them you need to make a first-time deposit. If you deposit something you've been scammed, there's no job and there's no items for you to withdraw.
Another way of doing it is that the scammer will tell you to make a deposit on the gambling site and they will make you win the jackpot and they will try to convince you that you have to make a considerably large bet so your chances of winning are bigger than 1%-5% because it can be hard to make you win if your chances are too low.
If you do deposit something you've lost the items and the scam may be over, but sometimes it isn't. Sometimes the scammer will try to continue socially engineering you.
If the scammer decides to continue they will make it look like you've won the jackpot but you will obviously not receive any of these items, the scammer will try to convince you that a hiccup with the site happened and that you need to deposit and win the jackpot again. If you haven't caught onto the scam yet and you decide to deposit again they will yet again make it look like you won the jackpot, but you will be in this loophole until you're out of skins or until you've caught onto the scam.
The reason this scam can work quite well on gullible people is because throughout the entire scam you're always shown that you have the upper hand. For example the way they presented the job offer to you, and the fact that they are paying you before you even start to work, and at the last stage of the scam you are proven that you are talking to a real admin of the website because they did in fact make it look like you won the jackpot.
Social engineering can be quite malicious.
Steam Gifts Scam
In this method, a scammer will try to trade your expensive items in exchange for gifts and sometimes even offer to go first. Usually the person asks you to add their "alt account" from which they want to send you them. This should already raise red flags. Everything might look fine at first, you usually even receive your gifts.
However these games were purchased with stolen credit cards or compromised accounts and the owner will do a chargeback when they notice the transaction.
Since you were involved in this fraud, all games will be revoked and your account may even be suspended. Yes, redeeming fraudulent gifts is explicitly listed as a possible reason to suspend an account (here).
Do not accept gifts from strangers.
However these games were purchased with stolen credit cards or compromised accounts and the owner will do a chargeback when they notice the transaction.
Since you were involved in this fraud, all games will be revoked and your account may even be suspended. Yes, redeeming fraudulent gifts is explicitly listed as a possible reason to suspend an account (here).
Do not accept gifts from strangers.
This page will be presented in English, as translators are unable to make edits to ensure the preservation of the guide's integrity.