The Absolute Basics: Account Security
- Enable Steam Guard Mobile Authenticator: This is non-negotiable. Without it, your items can be traded away instantly if someone guesses your password. The Mobile Authenticator requires you to physically approve every trade on your smartphone.
- Use a Strong, Unique Password: Do not use the same password for Steam that you use for other websites.
- Secure Your Email: The email address associated with your Steam account must also have Two-Factor Authentication (2FA) enabled. If a hacker gets your email, they can often bypass Steam security.
The Golden Rules of CS2 Trading
Rule #1: If it's too good to be true, it's a scam.
Rule #2: Never log into links sent via chat.
- The Fix: If someone tells you to check an item on a specific site, type the website address into your browser manually or use your own bookmarks.
Rule #3: The Mobile Confirmation is your final contract.
- The Fix: When your phone buzzes to confirm a trade, stop and read it. Verify the items you are losing, the items you are receiving, and the exact name/level/join date of the person you are trading with. If anything looks wrong, cancel the trade immediately.
Rule #4: Valve employees will never ask for your items.
- The Fix: Ignore and block anyone claiming to be official support in a chat window. Official support only happens through the Steam Help ticket system.
Rule #5: Cash trading is inherently dangerous.
- The Fix: As a beginner, only use reputable, established third-party marketplaces (like Skinport, CSFloat, etc.) if you want to buy or sell skins for real money. These sites act as secure middlemen, ensuring both parties get what they paid for. Do not attempt peer-to-peer cash trades until you are highly experienced.
Rule #6: Beware of the "Bait and Switch".
- The Fix: Take your time. Never let the other person rush you. Hover over the item in the final confirmation window to verify its condition (wear) and whether it is StatTrak.
What to do if you make a mistake
- Do not panic, but act quickly.
- Change your Steam password immediately.
- Deauthorize all devices: Go to Steam Settings -> Security -> Manage Steam Guard -> Deauthorize all other devices.
- Revoke API Keys: Go to
steamcommunity.com/dev/apikey. If there is any text in the domain box and a key listed, click "Revoke My Steam Web API Key". (This stops the infamous API scam).
