API vs. Phishing Scam
If you have ever tried to send some items to someone on Steam, but the items went to a different Steam account, you most likely have been a victim of a phishing scam. Many people tend to confuse it with API-scam, but the outcome is very different.
This post is very informative in regard to how to spot if you have been compromised, and how you can prevent becoming a victim of a phishing scam. We advise you to read the whole blog post.
Why many people mix up Phishing scam with API-scam
To get a better understanding of why people tend to mix up these two scams, we will have to go back in time to the year 2017. This is the year we first became familiar with the term “API-scam”. If your API key was compromised, what would happen is that you would receive an offer from someone on Steam for one or more of your items. Once a script detected this through your API key, they would cancel the tradeoffer and make another tradeoffer from a bot that had copied the account details of the first person who sent the trade.
7-day trade lock
March 2018
7-day trade lock March 2018
Let us skip forward to March of the next year, 2018. Valve implements a 7-day trade lock on all items traded on Steam. In the weeks and months after this update, multiple CSGO sites of all sorts began to change from their usual setup of storing items on bots to P2P as we know it today. As you might know, you have to provide your API key in order to use P2P sites, so this was great news for the scammers, as more people would learn about the Steam API key without knowing what could happen if it would be compromised. Therefore, API-scams began to blow up and more users than ever became a victim of an API-scam.
Since then, people have used the term “API-scam” on every occasion where skins you meant to trade to someone were sent to a bot - we advise you to start using the term “Phishing scam” as using “API-scam” is misleading and creates a lot of confusion, most likely ending in people thinking they no longer are compromised, however, the reality is that they are more compromised than they think.
API-scams are not happening in 2022. Why? They are not effective.
Yes, you read it right. API-scams are not happening in 2022. Here is why:
Steam has made changes to its API. This means you are no longer able to cancel trades by only having the API key. This makes it very easy to spot if you have been compromised, as you would see multiple trades for the same item when checking your incoming offers.
People tend to be more aware of what to look out for when accepting trades. If someone were to become a victim of an API-scam in 2022, they would most likely check the Steam level, and notice it was wrong already when accepting the offer, while you can only spot it when confirming the offer on your phone, if you are a victim of a phishing scam."
What is a phishing scam, and how do you get phishing scammed?
A phishing scam is essentially a hack of your account, however, in most cases of phishing scams, the hackers do not have full control of your account. You are still protected by the Steam Guard Mobile Authenticator (as long as you have it activated), and that is why you only fall victim to this scam when trying to send a trade. More on that later.
Hackers will get access to your account by creating a fake Steam login page. When you type in your Steam credentials, it will request for you to type in your Steam Guard code. Once you type in the code you receive an error.
In the meantime, while you have given your credentials as well as the Steam Guard code, a script has used your credentials and logged into your account with these. The script is now logged onto your account and has your Steam login token active on a virtual device. The script will also create an API key to track all your information regarding your trades.
Since the script has access to your account, it can cancel, create and accept tradeoffers - all this happens in a matter of seconds while you try to send items to another account. This means when you try to accept a tradeoffer from a user, from the time you accept the offer to the time you try to confirm the trade on your Steam app on your phone, another trade has been created and accepted. This trade is directed towards a bot that has the same account details as the account you intended to send the trade to. The bot will most likely be Steam level 0 and have a relatively new date or a limited account.
Remember me mentioning you only fall victim when trying to send a trade? This is exactly what I referred to. The script does not have access to your Steam Guard, so the scam will only occur when you try to send trades, so you do not suspect that someone unauthorized has access to your account.
What is the difference between a phishing scam and an API-scam?
One of the biggest differences is how the scam methods works
| Phishing Scam | API-scam |
|---|---|
| A script has access to your account and can send trades | Trades are being sent to you by different accounts |
| Can be done even if you open the correct tradeoffer through the link | You have to open the wrong tradeoffer on Steam |
| Level and date are only wrong when confirming on the mobile App | Level and date are wrong already when accepting the tradeoffer |