Most attacks on Steam and PC gaming accounts are about money, not about you personally. An account can hold tradable items with real market value, Steam Wallet funds, a game library, and a trusted friends list, and each of those can be turned into cash or used to reach more victims. Knowing which of these an attacker wants tells you which protections matter most on your own account.
Items and skins: value that can move in minutes
For many accounts, the most valuable thing is not the games but the inventory. Cosmetic items and skins from games like Counter-Strike 2 can be traded or sold on the Community Market, which makes them easy to move once someone controls the account or tricks the owner into a trade. That is why fake trading sites, fake login pages and trade-offer swaps are so common: the goal is to get items out of your inventory before you notice. An unknown Web API key on your account is one warning sign of this; see how to check and revoke a Steam API key.
The hard part is what happens afterward. Steam Support states that it does not restore items that have left an account for any reason, including trades, Market sales and gifts. Its reasoning is that items change hands many times, so restoring them would duplicate items or take them from someone who did nothing wrong. There is a narrower exception called Trade Protection, which Steam says currently applies only to Counter-Strike 2 and lets the owner reverse recent protected trades within a short window. If your inventory has already been emptied, our guide on what actually helps when Steam items are stolen covers the reporting steps and what to expect.
Wallet funds and saved payment details
Money sitting in a Steam Wallet can be spent on games, gifts or Market items that are then moved elsewhere. Steam's own security guidance warns that some malware aimed at Steam waits until there is something worth taking, such as funds in the Wallet, and then removes itself. Malware of this kind is often disguised as pirated software, cheats, fake game demos or betas, or mod and inventory tools.
The same logic applies to Epic Games, Battle.net and Riot accounts that store a saved payment method (and, on some platforms, a balance): purchases made by an attacker are a direct way to extract value. Unexpected purchase or gift receipts in the email linked to your account are often the first visible sign.
Game libraries, resale and spam
An account with a large or rare game library can be resold, even though selling accounts breaks Steam's rules and the buyer never truly owns it. Hijacked accounts are also useful simply because they look real. An account with years of history, a profile level and real friends is far more convincing than a brand-new one, so attackers use taken-over accounts to send phishing links, fake giveaways and "I accidentally reported you" messages to everyone on the friends list.
This is the motive that most often reaches people who were never hacked themselves. If a friend suddenly messages you with an urgent link or a request to "verify" something, Steam advises reporting their profile as hijacked rather than replying. Steam also says Valve employees never contact you through Steam Chat or other chat apps; account issues go only through the Steam Support Help Site.
Bans the owner inherits
Some attackers use a hijacked account to cheat, scam other players or run spam, knowing any penalty will fall on the account rather than on them. That leaves the real owner with the consequences after recovery. Steam's policy text on VAC bans says bans stay on an account regardless of who was using it at the time, and it treats account security as the owner's responsibility. Account locks placed to freeze a compromised account are different and are designed to be resolved by the owner through Steam Support. If you are dealing with this, read what to do if you were banned after your Steam account was hacked before opening a ticket.
Which defense answers which motive
Each motive points to a specific protection. None of them is a guarantee, but together they close the most common paths:
- Items and trades: the Steam Guard Mobile Authenticator lets you confirm every trade and Market listing on your phone, and Steam holds trades longer on accounts without it. Always compare the details on the confirmation screen before approving.
- Hidden trade manipulation: do not keep a Web API key you did not create or no longer use.
- Wallet and purchases: install games and tools only from official stores, and treat any "free skins" or cheat download as a likely malware carrier.
- Account takeover in general: use a unique password for Steam, secure the email linked to Steam first with its own unique password and two-step sign-in, and store your Steam Guard recovery code offline.
- Phishing: Steam says official logins happen only on www.steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com. Be careful with any "Sign in through Steam" page reached from a chat link.
- Leftover access: review Authorized Devices and use "Sign out everywhere" if anything looks unfamiliar.
A single walkthrough of all these settings is in our guide to securing your Steam account. Steam's own overview of scam types is on the Steam Support scams and hijacking FAQ.
What to do next
- If nothing is wrong yet, spend ten minutes on the protections above, starting with the email linked to Steam and the Mobile Authenticator.
- If items are missing, lock the account down first, then follow the reporting route for stolen items.
- If you cannot sign in at all, start from Steam's official "Help, I can't sign in" option on the Help site and contact Steam Support as the owner.
- Never pay someone who claims they can return your account or items, and never share your password, Steam Guard codes or recovery code with anyone, including people claiming to be from Steam.