Steam Trade Scams in 2026: Common Tactics, Red Flags & How to Report Scammers

API Scam (The Most Dangerous)

How it works: You unknowingly install malware (often disguised as a trading tool, skin checker, or tournament signup) that registers a Steam Web API key on your account. The malware monitors your outgoing trade offers in real time. When you send a legitimate trade, the malware instantly cancels it and creates an identical-looking offer from the scammer’s account. You see what appears to be the same trade and confirm it—sending your items to the scammer.

Red flags: If a trade offer appears to have been “cancelled” and immediately recreated, or if you receive a confirmation that looks slightly different from normal, stop and verify. Check your API key at Steam’s settings page—if there’s an API key you didn’t create, revoke it immediately.

Prevention: Never install software from untrusted sources. Regularly check and revoke unknown API keys in your Steam account settings. Use Steam Guard Mobile Authenticator and carefully verify every trade confirmation.

Phishing Sites

How it works: Scammers create websites that look identical to Steam login pages, popular trading platforms, or tournament registration sites. They send you a link through Steam chat, Discord, or social media. When you “login” on the fake site, your credentials (and Steam Guard code) are captured and used to hijack your account.

Red flags: URLs that are slightly misspelled (steampowered vs. steampoweered), unexpected login prompts when you’re already logged into Steam, links from strangers or even from compromised friends’ accounts, and any site that asks for your Steam Guard code outside the Steam client.

Prevention: Only log into Steam through the official Steam client or steamcommunity.com. Bookmark legitimate trading sites. Never click login links sent through chat. If a friend sends you an unusual link, verify with them through a different channel first.

Item Switching

How it works: During a trade, the scammer initially shows a valuable item (e.g., a Factory New knife skin) and then quickly swaps it for a similar-looking but much cheaper item (e.g., a Battle-Scarred version or a completely different skin with the same icon). They rely on you confirming the trade without carefully re-checking every item.

Prevention: Always verify every item in the trade window before confirming. Check the exact skin name, wear condition (Factory New, Minimal Wear, etc.), and value. If the other person modifies the trade at any point, start over and re-verify everything. Never rush a trade confirmation.

Fake Middleman Scams

How it works: In high-value trades, scammers suggest using a “trusted middleman”—someone who supposedly holds items during the exchange to prevent scams. The middleman is actually the scammer’s second account. You send your items to the “middleman,” and both accounts disappear.

Prevention: Only use middlemen from established, verifiable communities with public reputation systems. Verify the middleman’s identity through multiple channels. Better yet, use direct Steam trades with trade confirmations rather than middlemen at all.

Impersonation Scams

Scammers copy the profile picture, name, and bio of well-known traders or streamers, then approach you claiming to be that person. They often say they’re making a special offer or need you to “verify your items” through a trade.

How to verify: Check the account’s SteamID64—it never changes even if the display name does. Compare it against the real person’s known SteamID. Use SteamReport to look up the account and check its age, ban history, and profile data.

How to Report Steam Trade Scammers

• Screenshot everything: The trade offer, chat messages, the scammer’s profile page. Evidence disappears quickly when scammers change names.
• Get the SteamID64: This is permanent and identifies the account even after name changes. See: SteamID formats explained.
• Report on Steam: Visit their profile, click the flag icon, select “Attempted trade scam” and fill in the details.
• File a report on SteamReport.net: Use the reporting tool to submit a structured report with the scammer’s SteamID, method of scam, and your evidence.
• Report phishing URLs: If a phishing site was involved, report the URL to Google Safe Browsing and your browser’s built-in reporting as well.