The Most Dangerous Scam in CS2 Trading
Red flags at a glance
| Signal | What it means |
|---|---|
Unexpected domain on /dev/apikey (e.g. localhost) | Account likely compromised—revoke immediately |
| Canceled + duplicate trade offers in history | Bot may be intercepting and re-sending clones |
| Partner name looks right but Steam ID differs | Classic clone-account redirect |
| "Vote for my team" / "verify items" login prompt | Phishing entry point for API key creation |
| Trade confirmed but items never arrived at bot | You confirmed a clone, not the real partner |
Step-by-Step Anatomy of an API Hijack
1. Phishing setup
2. Fake login and API key creation
3. Bot monitoring
4. Trade interception and clone redirection
5. User confirmation and inventory loss
How to Audit Your Steam API Key Status
Open the official API key page
Interpret what you see
Check for trade red flags
Clone-account verification checklist (before confirming any trade)
- Open the partner's Steam profile from the trade window—not from chat links.
- Compare Steam ID64 and account creation date against the marketplace's published bot list.
- Check account level and badge count; clones often have thin profiles despite copied avatars.
- For P2P trades, confirm the exact item float and sticker placement in the offer matches what was agreed in writing.
The 3-Step Account Rescue Protocol
Step 1: Revoke your Steam Web API key
- Go to
https://steamcommunity.com/dev/apikey. - If a key is present, click "Revoke My Steam Web API Key".
- Verify that the page now reads "You do not have a Steam Web API Key".
Step 2: Secure your account login and devices
- Change your Steam password from a secure device, using a unique new password.
- Deauthorize all other devices in Steam's management page, forcing a re-login everywhere.
- Ensure Steam Guard Mobile Authenticator is enabled and generate new backup codes.
Step 3: Reset your trade URLs and audit history
- Reset your Steam trade URL so that any previously shared link (for market bots or friends) becomes invalid.
- Check recent trade history for unauthorized or suspicious trades and cancel any pending offers you did not initiate.
- If items have already been stolen, contact Steam Support with a detailed description of the incident.
