How Phishing API Substitution Works
The player enters their login, password, and Steam Guard mobile authenticator code on a fake site that looks identical to the official one. Once access is gained, the scammer's bot creates a secret digital key (API Key): when the victim decides to send a skin to a real friend, the bot instantly cancels the deal and sends an exact copy of the request to the scammer's fake profile.
Steps to Protect Your Inventory
- never log in via your platform account on sites offering free cases and giveaways
- check the Steam Web API Key management section and immediately revoke any unfamiliar keys
- verify the recipient's registration date and profile level directly in the mobile trade confirmation window
- change your account password and terminate all active authorizations on other devices