Steam Guard stops one specific thing well: someone who has only your password cannot sign in from a new device, because Steam also asks for a code that goes to your email or your phone. The Steam Mobile Authenticator adds a second job, confirming trades and Market listings on your phone. What Steam Guard cannot stop is you approving a sign-in or a trade that a scammer set up, or an attacker who already controls your email or a PC you have signed in on.
What Steam Guard is, in plain terms
Steam Guard is a second layer on top of your password. Steam Support describes two ways to get it: codes sent by email, or codes and approvals from the Steam Mobile app, which Steam calls the Steam Guard Mobile Authenticator. Either way, the check kicks in when someone signs in from a device Steam does not recognize. A computer or browser that already passed the check is remembered, which is why you are not asked for a code every day.
Email Steam Guard is normally on by default once your email address is verified and Steam has been restarted twice. The mobile authenticator is something you add yourself, and Steam allows one authenticator per account at a time.
Email codes vs the Mobile Authenticator
Email codes
With email Steam Guard, a sign-in from a new device triggers a code sent to the address on your account. Only the most recent code works. The protection is exactly as strong as that inbox: if someone can read your email, they can read your Steam Guard codes too. Steam Support lists a compromised email account as one of the common ways accounts protected by Steam Guard still get taken.
The Mobile Authenticator
The app generates a code that changes every 30 seconds and works only once. With it on, Steam offers three ways to confirm a sign-in: scan a QR code with the app, approve a notification on your phone, or type the code shown under "Show Steam Guard code". The QR approval screen shows a map and the approximate location of the device that is signing in, which is a useful check before you tap anything.
With the authenticator on, a new-device sign-in needs your phone, not a code from your inbox. The email still matters, because Steam lists a compromised email among the main ways accounts are taken and it is tied to password resets. The flip side is that losing the phone becomes the main risk, which is why the recovery code Steam shows during setup matters. If that has already happened, the route back is covered in what to do after losing the phone that holds Steam Guard.
Trade and Market confirmations: the part people overlook
The authenticator does more than guard the door. Trades and Community Market listings are confirmed in the Steam Mobile app, so a person who gets into your account still has to get past your phone before items leave.
Without the authenticator, Steam Support says items leaving the account can be held for up to 15 days, which gives the owner time to cancel a trade they did not make. More on that in why Steam holds trades after a security change.
What a stolen password can and cannot do
- No Steam Guard at all: the password is the only barrier. Someone who has it can sign in from anywhere.
- Email Steam Guard: a password alone is not enough on a new device, unless the attacker also has your email or is using a computer you already authorized.
- Mobile Authenticator: a password alone is not enough to sign in on a new device or to confirm trades, unless you approve the request yourself.
A Steam Guard code you did not ask for is worth taking seriously. New-device codes are triggered by someone entering the right password, so an unexpected code usually means your password is known. Change it and never pass the code on to anyone.
What Steam Guard can't stop
Every protection above assumes the person approving the request is you, looking at what you are approving. Most account losses happen at that point.
- Approving a phishing sign-in. A fake login page or a request to scan a QR code you did not start can hand the attacker a valid sign-in that you approved yourself. Steam Guard did what it was told. The QR approval screen shows a map and the approximate location of the device signing in, and that is your last check.
- Trade redirection and API key abuse. Steam Support describes a scam in which someone who already has access to your account cancels a trade you set up and resends it to a lookalike account, hoping you confirm on your phone without reading. Steam calls it trade redirection; some users call it the "API scam". Steam notes the key is not strictly needed for this, so revoking it is only one part of the fix. The details are in how the Steam API key scam works and how to revoke a key.
- A compromised email or PC. Steam Support names malware on an already-authorized computer and a compromised email account as ways around Steam Guard. A remembered device does not ask for a new code.
- Social engineering. Steam Support will never ask for your password or your Steam Guard codes, and Valve says never to give an SMS recovery or removal code to anyone. Steam Guard cannot tell a code you typed into Steam from one you read out to a stranger in a chat.
Valve's own pages spell this out in the Steam Guard FAQ and the Mobile Authenticator FAQ on Steam Support.
What to do next
If you only have email Steam Guard, consider moving to the Steam Mobile Authenticator and writing the recovery code down on paper. Then secure the email address linked to Steam, because it is still the route to password resets. Make it a habit to read the approval screen, whether it is a sign-in location or a trade partner and item list, before you tap confirm. For the full set of settings to review in one pass, work through the Steam account security checklist. Menus and options change over time, so check your current account settings as you go.