Trade&Secured : Engage, Exchange, Evolve

Important information about the 'Steam web API' scam: How to avoid losing your valuable skins!
Today, scammers often use a trick called the "Steam web API key scam" to steal skins from people.

Every day, some of my friends ask for my help because they lost skins this way. To prevent this from happening to you, take some time to read and understand the information provided here.

This post will explain how this scam method works and provide tips to help you protect your skins.

The method is based on the use of phishing websites with a fake "Login with Steam" button.
Usually, those websites are advertised in the search engine and copy the style of popular services. Sometimes fake traders may ask you to visit such websites and check the prices of your skins there, or take actions on those sites etc.
When you click on this fake "Login with Steam" button, you will see a fake "Steam login" form which asks for your login, password and 2FA code later.
Hacker's script uses this data to log in to your Steam account and set Steam web API key on this page: https://gtm.steamproxy.vip/dev/apikey Using this API, the script can monitor all your trade offers and if there is an offer with valued skins - this trade offer will be instant cancelled and you will get an absolutely similar-looking offer but from the hacker's account.

To protect your skins, always follow the next rules:

1. Don't type your Steam account info when using the "Login with Steam" button. Instead, make sure you're already signed into Steam and then just click the "Login" button on the Steam website. If you asked for login data - load https://gtm.steamproxy.vip website and log in here.

2. Don't ever log in to any website if someone tells you to, even if they say they're a "reputable trader" In most cases, they are NOT reputable traders its just a scammers pretending to be traders.

3. Try not to use a search engine to find a service you already know. Do not use results from the “advertising” section. Use direct addresses.

4. Make sure to do some basic checks when u trade. Before accepting an offer on your phone, verify the items you will be giving and receiving. Additionally, check the level of the person you are trading with before accepting the offer.


What should you do if you already was scammed?

Unfortunately, you can not return your skins. You should write a report to the hacker's Steam account. Most likely this account will be banned, but trades will not be reversed.

To make your account secure you should do two simple steps:

First: You have to Deauthorize all devices. (You can do this from your Account Details page > Manage Steam Guard page. This will deauthorize all computers or devices that have access to your Steam account. Users that have enabled Steam Guard on their Steam Mobile app will be able to see information about devices that have access to their Steam account.)

Second: Go to this page: https://gtm.steamproxy.vip/dev/apikey and "Revoke" Steam web API key.

If anyone finds this post helpful, either now or down the road, I'll consider it a success.