If you don’t know by now Steam Support had outsourced support by hiring contractors for performing support operations. This support contractors would have access to a lot of metadata and sensitive account data, very usual and common that made them a golden hen for running a huge steam account takeover rally.
Let’s say you have a steam account with good trading activity, huge inlet and outlet of skins. Rotation of cash and skins. Then you leave the account dormant.
Your steam inventory was a mix of private and public and when it was public, bots captured a snapshot of your inventory. All this is common - steam trades made, market manipulation - low balling good skins and selling them / botting / sniping them (not always easy) , Steam to Steam - skin trade history, tracking a unique item and the trades / exchange of hands that took place from account to account, everything is tracked, well established public ledger market without which - CSGO market wouldn’t have been a billion dollar market. -
https://www.bloomberg.com/news/articles/2025-03-07/market-for-counter-strike-2-digital-items-hits-all-time-high
After being active in the trading scene for a long time, your steam64 id , your linked email, your account history, your account activity, your steam reputation, your trading forum activity is all tracked. You can’t become a scammer or disappear all of a sudden without traces. There’s vouches, reputation, 3rd party forums. Public vouches and some legitimate trade history in the past to have gained a decent reputation.
Suddenly you become inactive. Your inventory becomes public and all of your items are being sold online for quick sell prices.
Pause a minute,
But if a scammer had scammed your account - the scammer could possibly either have stolen the password through a stealer malware. But how on earth can he make trades ? Did he force convince you to change the authenticator to your account? Did you fall for a script and get scammed.
stolen 2FA codes - “smuggled” straight from your keyboard and screen - but that ought to be a nasty malware. 2FA exists on your phone and getting persistent access to 2FA would be impossible. Probably your email id is also compromised so changing your steam account email is also possible to do covertly.
Probably your mobile is stolen? Your iCloud password is stolen?
However in this case, let’s assume nothing is known so far. But you’ve found out that your account was hacked and this was an insider job.
The scheme
You’re chatting with a steam support executive - steam support on telegram. He’s helping you recover some accounts. You’re chatting with him for a couple of weeks now, The accounts you’re recovering are obviously not yours. He told you before that he’s helped others recover their own accounts for a fee but no one before you ever thought to take advantage of this.
It started out simple, with a couple of texts , you messaged him with links to a few dormant accounts, claiming he forgot the information. And after paying in crypto he provided you with sufficient information to recover the accounts. At this point, you realize just how much money you can make.
You start moving high value CSGO items and selling them for profit. The scheme is very thought out. With the agents help, you look for steam accounts with high value skins, account that have been inactive for atleast a few years. This is so that owners don’t notice, that their information gets changed. Then you make alt accounts / burner steam accounts and transfer the skins to and sign them up to buff163
Using fake information. Finally with the help of the agent, you community ban the accounts , this makes it harder for them to realize what’s about to happen. others can’t message them From there, you can access the account and undo the ban at the precise moment you want to trade skins out to your burner. Once that’s done, you can either delete the account or reban it to make it harder for people to notice.
Once the skins are out, you can sell them on buff, cash out to a different skin, to sell somewhere else or just sell your buff balance to another user.
Then from there you can just delete your burner steam account and do this all over again.
Steam’s Role
Steam then starts reversing trades done by the skin buyers, these buyers then tried everything to prevent trade rollbacks. They privated their inventories and ran up their trade history - bought a stolen skin, exchanged it for a legitimate same value or fairly close or less value skin and “test the waters of steam” to check if there is a limit to how many trades steam can roll back. But steam got to it very quick and this technique got outdated.
Some put items to storage containers, this actually managed to save skins. Not always. More later……..
Steam Account Recovery - keys to the kingdom
If you made a support ticket and managed to convince steam through contact steam support. Account ownership - if you managed to prove you are the owner of the account , steam would give you the keys to the entire account
There are only 2 things that qualify as proof of ownership
- This can either be payment information that was used on the account previously
- Product codes redeemed on the account
The easiest ways to get it is access to the email of the account. Through malware. Stealthy stealer logs.
Social engineering ? - You can make multiple support tickets and try to get more information about the account.
Steam username known? - you can send money to that account as a gift and claim to support that it’s your account and support will give you access to the account.
You’ve been doing this for quite some years now. Mostly unnoticed. Something’s changed. You figure out that most of the accounts you were wishing to target for quiet some time now, the accounts have been banned and the skins have already left the inventory. Trade banned. And VAC banned.
You’re not the only one doing this method anymore.
This account was well known by other traders
Traders in the community are vigilant. You realize that the community figures out that something’s wrong. You see this as an opportunity and quickly report all the thieves account. You can easily find all the burner accounts as “the support friend on telegram” can see everything in the background.
Once they’re banned, the thieves retaliate by reporting your buff accounts. Then they just disappear.
Your telegram friend, gets to know slowly that you’ve been abusing the system so he asks you if you’ve been working with another support agent or another support company, he reassures you like one cunning wolf, that no one else does this except him in the entire department. And this is the first time that he’s seen that the skins have vanished and the account has been banned way before he started the entire account recovery process and the scheme.
Foreign markets
Russian website - Market.csgo.com doesn’t have KYC. And most of these stolen skins were sold on Buff163 - the biggest Chinese market place.
All the stolen skins are commonly traded through these 2 websites.
But smartly enough there are many NO KYC gambling websites that can be used to trade and hold stolen inventory or trade it back forth , gamble it loose it, trade it for another skin and then sell it back to another gambling websites.
Unlimited possibilities??
Now once you have a stolen account you have one task. Untraceable quick sell to get rid of the skins as soon as possible and at lesser than market value. Cash out in Crypto. Mix the crypto.
After steam reversed the trades, some accounts end up getting community bans, trying to evade the rollback with the STORAGE UNITS TRICK
Steam investigation - Huge pressure and reputation and investment in the skin industry at stake
In the ban wave and a huge rollback of account trades and restoring accounts and giving back to rightful owner.
A fresh steam account is banned for no reason. This account was an alt account and had received multiple direct trades with a high high high profile account that was under investigation by official steam - your account in the entire story.
The hacker had created this fresh account with a similar Steam Profile URL to the high profile account under investigation. After the initial hack of the high profile account. The hacker also changed the Steam profile URL of the high profile account. - and when you compare the two accounts URLs they have a similar pattern.
Steam’s Honeypot account - Friends with Steam? - Bulletproof Account Triggers an Alarm
A few months later you’re gathering information for another account, this is slightly different. This one’s nothing special, but he does have an inventory that is slightly more expensive than your usual targets. But as per fit for scamming protocol, he hasn’t used the account or played with it for quite some years now. He won’t really find out.
Something’s wrong after the account takeover, the account doesn’t have any history of bans and it’s a clean account. For some reason you can’t trade with that account. How is this even possible?
This account is a special account, is very well connected to Valve employees. The account almost gets automatically revived and on immediate threat response, almost immediately the account is frozen and is made bulletproof, and reverted back to its original state , before the scammer recovered it. In exchange the telegram support company received an internal investigation by Valves request and the entire department is fired. Steam terminated contracts with multiple customer support companies and ever since then, mysterious Steam account takeovers are almost completely unheard of.
