How to secure your Steam account (and get it back if it's stolen)

Steam Guard by email versus the Mobile Authenticator

Steam Guard is switched on by default once your email is verified, and in its basic form it emails you a code whenever someone signs in from a device Steam does not recognise. That is better than nothing, but it moves all the risk onto your inbox. Valve's own help page on how Steam Guard accounts get stolen puts the email route first: if your verified email is compromised, someone who knows your account name can get in, because the password can be reset from that inbox.

The Steam Guard Mobile Authenticator lives inside the Steam Mobile App. It generates a code that changes every 30 seconds, can be used only once, and works even when your phone is offline (your phone does need the correct time). It also adds two faster ways to approve a sign-in: scanning the QR code on the Steam sign-in panel, or confirming a notification on your phone after entering your name and password.

To add it, sign in to the Steam Mobile App and you land on the Steam Guard tab. Select "Add authenticator", enter a phone number Steam can text (there is a link if you do not have one), type in the code it sends, and then copy down the Recovery code it shows you. Steam Support's walkthrough is blunt about that last part: do not skip it. The app works on iOS 13.0 or later and Android 5.0 or later.

Why Steam holds trades after you add an authenticator

People are sometimes surprised that turning on extra security makes trading slower for a while. Steam Support explains the rule: any trades or Market listings created before a Mobile Authenticator is added, or during the first 7 days after it is added, are held for 15 days. Trades created more than 7 days after the authenticator is added are not held. Adding an authenticator does not shorten holds that already exist.

The holds exist to give the real owner time to spot and cancel something they did not intend. If you remove the authenticator later, Valve says your trades and Market listings will slow down again for the same reason. So if you are setting up security right before a big trade, expect a delay and plan around it rather than looking for a shortcut.

Moving to a new phone is supported. Install the Steam Mobile App on the new device, sign in, and choose the Move Authenticator option on the Steam Guard screen. If you no longer have the old authenticator, select "I no longer have access to my authenticator" and follow the SMS steps. Valve notes that transferring an authenticator also triggers a trade hold, so do it before you need to trade.

The trade-redirection trick and the Steam Web API key

Valve has a dedicated support page on what players call the "API scam". In short, a scammer who already has access to your account, often through a fake login page or malware, waits for you to make a trade. They cancel it and send an almost identical trade to an impersonation account they control, hoping you confirm it on your phone without checking.

Valve's advice is practical:

• Any request to trade your items for nothing, or for much less than they are worth, is very likely a scam, even if it comes from a friend's account.
• Always read the full details in the Steam Mobile confirmation window before you approve a trade. Valve says it contains everything you need to tell whether a trade has been redirected.
• If your profile suddenly changes to show a ban threat, your account security is already compromised.
• If you think someone created a Steam Web API key on your account, revoke it at steamcommunity.com/dev/apikey.

Valve also points out that scammers often claim you cannot recover your account because they have changed all its details. That is false: Steam Support can still restore it. See our wider guide to trade and item scams for the patterns that lead up to this.

Signs a Steam login page or message is fake

Valve lists the only domains where official Steam logins happen: www.steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com. Anything else asking for your Steam password should be closed. Valve also warns that scammers use clever misspellings to make links look official, so read the address slowly.

Steam Support does not contact people through the Friends network or Steam Chat, and it will never ask for your password or authenticator codes. Valve specifically warns against following instructions to talk to "Steam Support" on Discord or any other chat app, even when the request comes from a friend's account or promises to clear a false report. That is the accidental report scam, and it is common.

Malware is the other big route in. Valve says malware aimed at Steam may be disguised as pirated software, cheats, fake game demos or betas, or tools such as chat apps and mod or inventory managers. Some of it waits until your Steam Wallet has funds before acting, and some removes itself afterwards. Be wary of any download someone sends you, even if it is hosted somewhere you normally trust. Our guide to "test my game" malware covers the most common version.

Getting a stolen Steam account back step by step

Valve's stolen-account page asks you to do two things before you reset the password, and the order matters. First, scan your computer for viruses, keyloggers and spyware, because anything still on the machine can capture your new password. Second, change the password on the email account linked to Steam, because Steam accounts are commonly taken after the email is compromised.

Only then use the Steam Support site to recover the account. Start at help.steampowered.com and choose "Help, I can't sign in". If you have lost your phone and your recovery code, use the "Help me with my issue" route to ask Steam Support to remove the authenticator. If you no longer control the email address, Valve asks you to include proof of account ownership in your ticket.

When you are back in, work through Valve's checklist: check Authorized Devices and use "Sign out everywhere", change your Steam password, review your email and other linked accounts, and scan for malicious apps and browser extensions. Then set up the Mobile Authenticator again if it was removed. Our hacked account triage walks through the same order across every platform.

Steam Families, purchase requests and younger players

Steam Families replaced the older Family Sharing and Family View features. A family can have up to six members, managed from the Steam client, a mobile device or a web browser. To start one, go to Account Details on the Store page and open the Family Management section, then choose "Create a Family" and "Invite a Member", picking adult or child for each person.

For parents, the useful part is the controls. An adult can go to Account Settings > Family Management > Manage, expand the child's entry and toggle 'Enable Parental controls' to manage game access, Steam feature access and playtime limits. Child purchase requests let a child ask an adult to pay for their basket; the adult approves and pays from a mobile device or email, so the child never needs a saved card.

Steam Families can also help if a child is locked out: an adult can recover a child account's credentials after the child has been a family member for at least 30 days. More on this in our parents' guide.