Safety5 min read

CS2 gambling scams: fake sites, phishing and API key theft

How CS2 skin scams work, from fake Steam sign-in windows to redirected trades and fake support, what Valve changed, and how to lock down your account.

Fact-checked 18 October 2026 · 8 sources

Steam's own support pages make a simple point about skin theft: a scammer can't redirect your trades unless they already have access to your account, and the usual ways in are a fake sign-in page or malware. This guide covers the tricks that keep coming up around skin gambling, what Valve has changed to blunt them, and the habits that stop them.

Fake sites and fake sign-in windows

Steam's security page lists the only places a Steam sign-in belongs: www.steampowered.com, store.steampowered.com, help.steampowered.com and steamcommunity.com. A genuine "Sign in through Steam" button sends you to a login form on the Steam Community site, and once you've signed in Steam sends you back with your Steam ID. The other site never sees your password.

Phishing sites copy that flow, often down to the page design. A fake tournament page, a giveaway or a look-alike of a site you use asks you to sign in, and the form that opens belongs to the thief. In 2022 the security firm Group-IB described phishing kits that draw an entire fake browser pop-up inside the page, with an address bar showing a Steam URL, a green padlock and even a second window asking for your Steam Guard code. Victims arrived through messages inviting them to join a tournament team, vote for a team or buy cheap tickets to an esports event, and in one case through an ad in a recorded gameplay stream promising a free skin.

Group-IB's tests for a fake window are worth remembering. A real pop-up is a separate window: it shows up in your taskbar, you can resize it, you can drag it over the controls of the window behind it, and clicking its padlock shows the site's certificate. A drawn window can't leave the page it lives in, and its padlock is just a picture.

Redirected trades and the API key scam

Once a thief has access to your account, the usual target is your next trade. Steam calls this trade redirection. You set up a trade with an account you trust; the scammer cancels it, redirects it to an impersonation account they control, and hopes you confirm it on your phone without looking.

Players call this the API key scam, because the swap can be automated with a Steam Web API key, either one the owner gave away or one the thief registered on the account. Steam says your key should never be shared and that you can revoke one at steamcommunity.com/dev/apikey; a key you didn't create means someone else has had access. Steam also warns that the key isn't essential: anyone with access to your account or computer can automate the same steps without it.

Two changes have made this harder:

  • Since early December 2023, creating a new Web API key needs a Steam Guard Mobile Authenticator and a confirmation in the Steam app, as developers of Steam tools documented when their key-creation code stopped working. A stolen browser session can no longer register a key silently.
  • Since July 2025, CS2 items received in a trade are protected for 7 days, and you can reverse your recent trades if you lose items, at the cost of a 30-day trading and Market restriction. Steam trade protection explains how a reversal works.

Neither helps if you approve the redirected trade yourself, so the confirmation screen is your last check. Steam says the mobile confirmation gives you everything you need to spot a redirected trade. Read the account and the items in it, and compare them with what you were expecting, every time.

Fake support, fake reports and fake giveaways

A well-known opener is a message, sometimes from a friend's hijacked account, saying they reported you by mistake and that you need to talk to "Steam Support" to avoid a ban. Steam's answer is blunt: any claim that you've been falsely or accidentally reported is a scam, false reports are simply disregarded, and Valve staff never contact you about your account over Steam Chat or Discord. The only real support channel is help.steampowered.com.

Steam lists the warning signs. Someone asks for your password, or for a code Steam sent you by email, SMS or the app. Someone says they represent Valve or Steam Support. Someone asks you to make a purchase or send a gift card code to prove the account is yours. Some versions use malware that blocks your library behind a fake alert telling you to contact an agent, and some change your profile to look like a ban notice. Steam Support never edits your profile to threaten a ban, so an unexpected change means the account is already compromised.

Trade scams follow the same logic. Steam's rule is that any request to trade your items for less than roughly equal value is unsupported and probably a scam, however the request is dressed up. Free skins are no different: a giveaway that needs your Steam login on its own page is a phishing page.

How to protect your account

  1. Use the Steam Guard Mobile Authenticator. Sign-ins then need your phone, and a QR-code sign-in shows a map with the approximate location of the device asking; deny anything that isn't you.
  2. Reach Steam by typing steamcommunity.com or using a bookmark, not through a link someone sent you.
  3. Never share your password, Steam Guard codes, backup codes or recovery code, whoever asks. The same goes for codes from gambling sites: on cs2.casino every withdrawal is confirmed with a code sent to your verified email, and that code is for you alone.
  4. Check steamcommunity.com/dev/apikey now and then, and revoke any key you don't recognise.
  5. Read every trade confirmation in full before you approve it.
  6. Give your email a different password from Steam, and turn on two-factor sign-in for it too, since hijackers often go after the email to reach the Steam account.

If something has already gone wrong, Steam's steps are to sign out everywhere from your Authorized Devices page, change your Steam password, secure your email, scan your computer for malware, and revoke any API key. Don't pay anyone who claims to hold your account: Steam says you can recover it through Steam Support at any time, even if the thief has changed all of its details.

Before you sign up anywhere, run through how to check a CS2 gambling site, which includes the sign-in check.

Sources

Read next

All posts