Steam sends email when something security-related happens on your account: a Steam Guard code for a new sign-in, a password change, an email change, and notices tied to new backup codes. A real notice never asks you to reply with a password or code, and you can check any of it without clicking a link by signing in to Steam yourself. If a genuine notice describes something you did not do, treat it as a sign that someone else has your password and act from the official Steam Help site.
The security emails Steam actually sends
Steam says it emails you about security changes to your account and asks you to follow up on any change you did not expect. The messages you are most likely to see fall into a few groups.
- Steam Guard codes. If email Steam Guard is on, signing in from a device Steam does not recognize triggers a code sent to your account email. Only the most recent code works, so older code emails in your inbox are useless.
- Password change notices. Changing your password while signed in sends a verification email with a short code first, and a confirmation email after the change.
- Email change notices. When the contact email on the account changes, Steam still sends a confirmation to the old address. This is the notice most worth knowing about after a takeover.
- Backup code notices. If you use the Steam Mobile Authenticator, Steam emails you whenever new backup codes are generated or used.
- Purchase and refund emails. Steam typically emails about store activity such as refund confirmations. Treat these as a record to compare against your account's purchase history, not as a security alert on their own.
Steam says these messages come from [email protected] and [email protected], and that they go to the last email address registered on the account. Menus and wording change over time, so check your current account settings if something looks different.
The lock link inside real notices
According to Steam, notices about a password change, an email change and a Steam Guard code request include a link to lock the account, and the email-change notice still reaches the previous address even after the swap. Steam describes the tool on its self-lock help page. When and how to use that link after a takeover is covered in our guide for when a hacker changed your Steam email; only use it from a message you have confirmed is genuine.
What fake lookalikes usually get wrong
Scam emails copy Steam's layout, but their goal is always the same: get you to type your sign-in details or a code somewhere Valve does not run. Common signs include:
- A link that leads anywhere other than the official Steam domains. Steam says official sign-in happens only on www.steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com, and warns that scammers use clever misspellings of those names.
- A request to reply with your password, a Steam Guard code, a recovery code or card details. Steam Support does not ask for card or key details unless you opened a request with it first.
- A threat of a ban or a deadline. Steam says restrictions are normally shown as a notice on the account itself while they are active, and that Steam Support does not email owners of restricted accounts in most circumstances.
- A message from "Steam Support" that arrives through chat, Discord or a friend. Steam says its support team does not use the Friends network to contact users, and the only way to reach an agent is the Steam Support site.
Our guide to spotting Steam phishing sites covers lookalike pages and fake sign-in windows in more depth.
How to verify a message without clicking it
The safest habit is to treat the email as a pointer, not as the place where you act.
- Open the Steam client or type store.steampowered.com into your browser yourself.
- Sign in and look at your account details, Steam Guard settings and authorized devices. A real change will be reflected there.
- For account problems, go to help.steampowered.com directly rather than through a link in the message.
If what the email describes matches what you see in your account, it was real. If your account shows nothing of the kind and the message pushes you toward a link, it was most likely a fake, and you can simply delete it.
When a real notice describes something you did not do
A genuine notice about an action you did not take is the most useful warning Steam can give you. What it means depends on the type:
- An unrequested Steam Guard code usually means someone entered your correct password on a new device and was stopped at the second step. Our page on Steam Guard code problems explains both unrequested codes and codes that never arrive.
- A password or email change you did not make means someone may already control the account. Steam's own advice is to secure the email account linked to Steam first, because accounts are commonly taken after that email is compromised. The full owner route is in the same email-change guide linked above.
- Backup codes you did not generate or use mean someone has had access to your authenticator settings. Treat it as a compromise.
Steam also says you can always contact Steam Support about recovery, even if the email, password and phone number on the account were changed. Recovery goes through help.steampowered.com; no third party can do it for you.
What to do next
Add both Steam sender addresses to your contacts so real notices do not land in spam. Keep the email linked to Steam protected with its own unique password and two-factor sign-in, since that inbox is where every warning arrives. When a message worries you, sign in through an address you typed yourself and check before acting. For a one-sitting setup of the protections that make these emails less likely to matter, read how to secure your Steam account, and review Steam's own account security recommendations.