Skip to content
respawnr
Menu

Steam · Independent guide

Fake Steam Login Pages: How to Spot a Phishing Link Before You Sign In

Concept illustration of a magnifying glass examining two lookalike gaming pages.

Fake Steam sign-in pages arrive as a vote for a friend's team, a free skin giveaway, a trading site or a QR code to scan. Steam says official logins happen only on www.steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com. If you already typed your details somewhere else, there is a clear first-hour routine for your own account.

Learn to read the address

We never ask for your password, Steam Guard codes or recovery code, and we never sign in to your account.

Concept illustration, not a screenshot of the recovery process.

On this page

Steam's own warnings

Domains and lock-down steps come from Steam Support pages, read September 2026.

No codes, no passwords

We never collect sign-in details, Steam Guard codes or recovery codes.

Independent guide

Respawnr is not affiliated with Valve or Steam; check your current account settings.

The address tells a different story

A familiar logo can be copied. Read the hostname in your browser’s own address bar before entering account details.

Address anatomy · teaching example

Official hostname example

https://steamcommunity.com/login

Read the hostname. The path begins at the slash after it.

Lookalike · not a Steam hostname

https://steamcommunity.com.example.com/login

The extra ending changes the destination. This hostname belongs under example.com, not steamcommunity.com.

What if “steamcommunity.com” appears after a slash? https://example.com/steamcommunity.com

Here it is part of the path. The hostname is still example.com.

Non-clickable examples, not a live link checker. HTTPS and a familiar logo alone do not prove a site is Steam.

Steam’s account security guidance ↗

Phishing lures that lead to fake Steam sign-in pages

Each lure ends at a page that looks like Steam but is not on Steam's addresses.

Warning sign

"Vote for my team in this tournament, you just need to sign in with Steam."

Steam lists this as a named scam. The link goes to a phishing site, often sent from a friend's hijacked account.

Warning sign

"Free skins giveaway: log in with Steam to claim your prize."

Giveaway and trading sites that ask for your Steam login outside Steam's domains are collecting your password and code.

Warning sign

A "Sign in through Steam" pop-up that looks like a normal browser window.

A page can imitate the appearance of a browser window. Check the real browser address and navigate to Steam yourself if you are unsure.

Warning sign

"Scan this QR code with your Steam app to verify your account or claim items."

Scanning a Steam QR code starts a sign-in for the device showing it; tapping approve lets that device into your account. It never verifies or rewards anything.

Warning sign

A link that says steamcommunity but is spelled slightly differently, or hides behind a link shortener.

Steam warns that bad actors use clever misspellings. Steam itself hides some suspicious links as {LINK REMOVED}.

Warning sign

"Join our tournament / get free access to Steam games: sign in with Steam to register."

Steam lists tournament invitations as a named scam; the sign-in page is a copy on a non-Steam address.

What to do instead

  • Type the address yourself or use the Steam client instead of following a link someone sent you.
  • Read the hostname in the browser address bar, before the next slash. Check the exact spelling against Steam’s listed login addresses. A familiar name in a path, or before an extra domain ending, is not enough.
  • Read the browser’s actual address bar, including for a sign-in pop-up. A page can draw a fake browser window inside itself; appearance or the ability to move a window is not proof of authenticity.
  • Scan a QR code only on Steam's own sign-in screen, on a device in front of you, and read the location and map the app shows before approving.
  • Turn on the Steam Guard Mobile Authenticator so a stolen password alone is not enough to sign in.
  • If a friend sent the link, tell them through another channel and report their profile as possibly hijacked.

Clicked the link, or already signed in? Two different situations

What you need to do depends on whether anything was typed or approved.

Starting point

You opened the link but entered nothing

  • Opening a phishing page alone does not hand over your Steam password.
  • Close the tab and do not come back to finish "voting" or "claiming".
  • Report the sender's profile on Steam, or on the platform where the link came from.
  • If a file downloaded or you installed anything, scan your PC for malware.

After the change

You typed your login or code, or approved a QR sign-in

  • Assume someone else now has a live session or your password.
  • Use Sign out everywhere under Authorized Devices first, then change your Steam password.
  • Secure the email linked to Steam and watch it for Steam security notices.
  • Report the sender's Steam profile with Report Player; report off-Steam senders on that platform.

Moving from the first state to the second takes one typed password or one tapped approval, so stop at the address bar. If you are already in the second state, the steps below still help, but no step can promise the attacker has not acted yet.

The first hour after signing in on a fake Steam page

Steam's own lock-down order for your account, done as soon as you notice.

You entered your Steam login, a Steam Guard code, or approved a QR sign-in on a page that turned out to be fake.

  1. Sign out everywhere

    On the Authorized Devices page, review devices and use Sign out everywhere to end other sessions.

    What to check: Unknown devices disappear from the list and need a new Steam Guard check to return.

  2. Change your Steam password

    Set a new password you have never used anywhere else, especially not on the email account.

    What to check: Steam emails you a security notice about the password change.

  3. Secure the email linked to Steam

    Check that you can still sign in to that email, change its password and review its recovery options.

    What to check: Only your own devices and recovery details appear in the email account.

  4. Scan for malware and extensions

    Steam recommends scanning your system and checking browser extensions, especially if the site made you download something.

    What to check: The scan finishes clean, or you remove what it found and scan again.

  5. Check for a Web API key you did not create

    A phishing sign-in can register a key that watches your trades; the API key scam guide below shows how to check and revoke it.

    What to check: No key you don't recognise is listed on your account.

  6. Locked out? Recover through Steam Support

    Use Help, I can't sign in; Steam says recovery works even if email, password and phone changed.

    What to check: Steam Support replies through the help site and asks for proof you own the account.

No step here comes with a guaranteed time or outcome. Steam Support decides how long a recovery takes, and nobody outside Steam can speed it up; anyone promising that is running another scam.

A few details worth knowing

How do I know a Steam login page is real?

Steam says official logins happen only on www.steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com. Read the address bar letter by letter before typing; lookalike spellings are the classic trick.

I only clicked a Steam phishing link. Am I hacked?

Opening the page alone does not give away your password. Close it, report the sender, and scan your PC if anything was downloaded. If you typed your login or a code, follow the first-hour steps on this page.

Is a QR code on a trading or giveaway site safe to scan with the Steam app?

No. Scanning a Steam QR code asks you to approve a sign-in for the device showing it. Scan only Steam's own sign-in screen in front of you, and check the location and map the app shows before approving.

My friend sent me the phishing link. What now?

Their account is probably hijacked. Report their profile on Steam, and tell them through another channel so they can recover it through Steam Support.

Does Steam Guard protect me if I typed my password on a fake page?

It helps, because a password alone is not enough to sign in. But a fake page can also ask for your code or an approval, so still sign out everywhere and change your password.

Official guidance

Check the platform’s current instructions and the options shown for your own account.