CS2 Scam Prevention: Every Scam Type and How to Stay Safe

The Ultimate CS2 Trader's Scam Survival Guide

The URL is wrong. It might be steamcommunty.com (note the missing 'n'), steampowered.com.ru, or steam-login.com. Always, always check the address bar.
You were linked from an unofficial source. No legitimate service needs you to log into Steam via a link they provide.
It asks for your Steam Guard code on the webpage. The real Steam login never asks for your mobile authenticator code on a website. That only happens in the app.

Bookmark the real Steam sites. Log in only through your bookmarks or the official Steam client.
Use a password manager. It won't auto-fill on a fake site because the URL won't match.
Enable Two-Factor Authentication (2FA) everywhere. This is non-negotiable.

Pressure to trade fast. Any legitimate trader will give you time to inspect.
Multiple similar offers from the same person. If they cancel and re-send, it's a massive warning.
The trade window "jumps" or refreshes. Sometimes they'll spam chat or trade actions to distract you.

Check. Every. Single. Item. Line by line. Compare the name, wear, and float value in the trade window to what you agreed on.
Ignore all pressure. If they threaten to leave, let them. A good deal will still be there in 5 minutes.
Use the "Compare with my item" feature in the trade window. This directly juxtaposes the item they're offering with the one in your inventory.

The middleman contacts you first. Real, busy middlemen don't solicit business.
You're asked to trade the item to a profile that isn't verifiably the middleman's main. Check their entire social footprint—Twitch, Twitter, known forum posts.
Buyer uses "Friends & Family" but wants buyer protection. That's contradictory. F&F is for gifts, not goods.
Buyer has a very new account, or odd payment methods.

For middlemen, YOU initiate contact. Go to the official Discord server or Twitch stream of the middleman and contact them there. Do not trust links sent to you.
Use a reputable escrow service designed for digital goods, though they come with fees.
For cash, understand the risks. Use platforms with seller protection (some marketplaces) or only trade with individuals with years of verifiable cash rep. Assume PayPal Goods & Services can be charged back.
Cryptocurrency is final. Once sent, it cannot be reversed. This shifts risk but eliminates chargebacks.

Trade offers come from unexpected people, even when you just tried to send one to a friend.
You feel like you're going crazy—"I just sent that offer, why is it different?"
You logged into a sketchy site in the past.

Revoke your Steam API key regularly. This is the single most important step.
- Go to: Steam > Settings > Account > Manage Steam Guard Account Security > Deauthorize all other devices.
- This instantly invalidates all stolen API keys.
Never log into any site unless you are 1000% sure of its legitimacy.

The account is very new, despite the persona being old.
They message you out of the blue with a request that seems odd for that person.
They refuse to join a voice call to verify identity.

Always verify through a second channel. Message the real person on their known main account or their public social media. Ask, "Did you just add me on an alt?"
Check the profile's history. An impersonator won't have years of game ownership, screenshots, or friends.
Be suspicious of any unsolicited contact, no matter who it appears to be from.

You never entered a giveaway. You can't win something you didn't enter.
The site asks for any fee, deposit, or "verification" payment. Legitimate giveaways do not do this.
The URL is strange and the site design is poor.

If it seems too good to be true, it is. Nobody is giving away a Karambit | Case Hardened blue gem to random people.
Only participate in giveaways from established, trusted community figures or organizations on their official channels.
Never pay to receive a prize.

Anyone sending you an unsolicited QR code. There is almost zero legitimate reason for this in trading.
Pressure to scan it quickly.

Never, ever scan a QR code from an untrusted source. Period.
If you need to visit a profile or trade offer, manually type the URL or use a bookmark.

Steam Guard Mobile Authenticator: ENABLED. It's a 7-day trade hold versus losing your entire inventory. No debate.
Trade Confirmations: ENABLED. Every trade must be confirmed on your mobile device. This stops most unauthorized trades even if someone has your login.
API Key Audit & Revocation: MONTHLY HABIT. Go to Steam > Settings > Account > Manage Steam Guard > Deauthorize All Other Devices. Do it right now after reading this. It severs all stolen API keys.
Inventory Privacy: Set to Private or Friends Only. There's no need for the whole world to see what AK-47 | Bloodsport you're holding. It just makes you a target.
Unique Password: Use a strong, unique password for your Steam account. Not the one you use for your email or anything else.
Email Security: Your associated email account needs 2FA as well. If they get your email, they can often start the Steam account recovery process.