Spotting CS2 Trading Scams: Phishing, Fake Offers, API Keys

A Steam account full of CS2 skins is a wallet that anyone can empty with one confirmed trade. As of October 14, 2026, the cheapest Field-Tested AWP | Dragon Lore tracked on cs2skins.gg was $5,900, and even ordinary inventories are worth hundreds. That's why scams in CS2 are organised, persistent and constantly adapting. Almost all of them still rely on a handful of tricks.

1. Phishing logins

The goal is your Steam login session. Once a scammer has it, they can act as you.

How it looks: a friend's account messages you asking you to vote for their team, check a tournament, claim free skins or look at "your" item on a trading site. The link leads to a page with a "Sign in through Steam" button. Clicking it opens what looks like a Steam login window, but the window is drawn inside the fake page itself. Whatever you type goes to the scammer, including your Steam Guard code.

A variation shows a QR code and asks you to scan it with the Steam app. That logs the scammer's browser into your account.

How to stop it:

• Sign in only on steamcommunity.com or store.steampowered.com, or in the Steam client itself.
• A genuine Steam login window is a real browser window with its own address bar showing a Steam domain. Try dragging it outside the page: a fake one can't leave.
• Never scan a login QR code shown on a third-party site.
• Treat any message from a friend that pushes a link as suspicious. Their account may already be compromised.

2. API key and trade redirection

This is the scam that catches experienced traders, because it hides inside a trade you meant to make.

How it works: with access to your session, the attacker registers a Steam Web API key on your account. That gives them instant notice of your trade offers. When you start a real trade, say selling a skin on a marketplace, they cancel your offer and immediately send a near-identical one to a fake account with the same name and avatar as your real trade partner. You open the Steam Mobile app, see an offer for the right item to the "right" person, and confirm it.

What Valve changed: creating an API key now requires confirmation in the Steam Mobile Authenticator. An unexpected confirmation request for an API key means someone else is in your account: deny it and secure the account immediately. Players also report that the mobile app can show a warning when an identical offer was recently cancelled. Never ignore that warning.

How to stop it:

• Check your API key page, steamcommunity.com/dev/apikey. If a key exists that you didn't create, revoke it.
• In every confirmation, check the recipient's Steam level, profile age and the friend icon, not only the name and avatar.
• Look at your sent offers after confirming. An identical offer that was cancelled seconds earlier is a red flag.
• When trading through a marketplace, start the trade from the marketplace's own page.

3. Impersonation and fake support

How it looks: someone claims you've been reported, your account is flagged, or a trade was made "by mistake". They send you to a "Steam Support agent" or "Valve employee" on Discord or Steam chat, who asks you to log in somewhere, send items for "verification" or pay a fee.

The rule: Steam Support never asks for items, never trades with you and never contacts you on Discord. Anyone asking you to prove ownership by moving items is stealing them.

A related trick is the fake middleman. The other side "suggests" a trusted middleman account, which they control. Use marketplace escrow instead.

4. Fake offers and item swaps

How it looks: a trade that matches what you agreed, except for one detail. Common swaps include:

• a cheaper Doppler phase or a weaker Case Hardened pattern under the same item name;
• a different exterior, or a StatTrak and normal version swapped;
• a screenshot of a valuable item, while the trade contains a different copy.

How to stop it: read every item in the Steam confirmation screen, not in chat. For pattern or phase items, inspect the exact item in the offer. High-value items such as knives attract the most swap attempts.

5. Trade-reversal abuse

Valve's Trade Protection, added in July 2025, lets an account reverse its protected CS2 trades within seven days. It exists to recover stolen items, but it creates a new risk in direct cash deals. If you pay someone over PayPal, crypto or bank transfer and they send the skin, they can reverse the trade during that week. The skin goes back to them, and your payment usually doesn't come back to you.

How to stop it: don't pay strangers directly. Use a marketplace that holds the seller's money until the protection period ends. Most established stores now do this. The marketplace comparison page lists the main options.

6. Fake sites, extensions and downloads

Scammers clone marketplace sites with lookalike domains and buy ads for them. Others push browser extensions or "trading tools" that steal your session cookies. Type marketplace addresses yourself or use bookmarks, install extensions only from official stores and from the developer's own site, and be wary of any download offered in chat.

A 30-second check before every trade

1. Did I start this trade myself, from a site I typed in?
2. Is the recipient the right account: level, age and friend status, not just name and avatar?
3. Are the items exactly right, including phase, pattern and exterior?
4. Has anyone asked me to log in, scan a code or move items to "verify" something?
5. If money is involved, is it held in escrow until protection ends?

If it already happened

1. Change your Steam password and deauthorize all devices.
2. Revoke any API key you didn't create.
3. Contact Steam Support to regain full control if needed.
4. Within seven days of the trades, open Trade History and reverse the protected trades. Valve applies a 30-day trading and Market restriction to accounts that reverse.
5. Warn friends in case your account was used to message them.

Steam's own market profile on cs2skins.gg explains how Valve's rules apply to the official market.