Losing a Steam account stings in a way few other account losses do: years of purchases, hundreds of hours of save data and a friends list built over a decade, suddenly in someone else's hands. Here is the uncomfortable truth about most hijackings: the account was not hacked. Its owner handed over the keys — through a fake login page, a too-trusting trade or a scammer posing as support. This guide locks your account down properly and teaches you to spot the tricks. It takes about ten minutes.
Switch on the Steam Guard Mobile Authenticator
This is the single most important step on this page. Steam Guard is Steam's two-factor authentication: even if someone learns your password, they still cannot sign in without the rolling code generated on your phone.
- Install the Steam mobile app and sign in.
- Open the menu and tap
Steam Guard. - Choose
Add Authenticatorand follow the steps, confirming with the SMS code sent to your number. - Write down the recovery code it shows you and store it somewhere safe — not as a screenshot on the same phone.
From then on, every sign-in from a new device needs the current code from the app. There is a practical bonus beyond security: without an authenticator attached for at least seven days, Steam places a 15-day hold on trades and Community Market listings, which effectively pauses trading. The older email-code version of Steam Guard still works as a fallback, but the mobile authenticator is stronger and more convenient.
Lost your phone? That recovery code from step four is your way back in, along with the SMS fallback to your registered number. Keep your phone number up to date under Account details — an outdated number is the most common reason legitimate owners get locked out of their own accounts.
Use a strong password that exists only on Steam
Reused passwords are how credential-stuffing attacks work: one breached forum hands attackers an email-and-password pair that they then try everywhere, Steam included. In the Steam client, click your username, open Account details and choose Change password. Make the new one long, random and unique to Steam — a password manager makes this painless. And never share it with anyone: Valve employees will never ask for your password, and neither will any legitimate support agent.
Deauthorise devices you don't recognise
Signed in on a friend's PC, a hotel computer or a machine you have since sold? Remove it. In the Steam client go to Settings > Account, open Manage Steam Guard Account Security and use Deauthorize all other devices now; the same option lives under your account details on store.steampowered.com. This forces every other device to sign in again, cutting off anyone quietly sitting in your account. Make it a habit after any sign-in on hardware you do not control.
Know what to share — and what to never share
Steam gives you two names, and the distinction matters:
- Account name — the login name you chose when the account was created. It can never be changed. Treat it as half of your credentials: never post it publicly and never hand it to another player.
- Profile name — the display name everyone sees. Change it as often as you like; it has no security value.
The same rule covers codes and details: support will never ask for your password, your authenticator codes or your payment details over chat. Anyone who does is a scammer, full stop.
Secure the email behind the account
Your Steam account is only as safe as the email address attached to it, because password resets and confirmations flow through that inbox. If that email uses a weak or reused password and no two-factor of its own, an attacker can walk in through the back door. Give the email a strong unique password, switch on its own two-factor authentication, and make sure the address on your Steam account is one you still control — check it under Account details.
Share games with Steam Families, not your password
Handing your login to a sibling or friend so they can play your games is one of the most common ways accounts end up compromised — and it breaks Steam's rules besides. Use Steam Families instead: it lets up to five family members play your library from their own accounts, with your saves, achievements and wallet untouched.
The scams to watch for: a cheat sheet
Memorise these patterns and most phishing attempts become obvious:
| Scam | How it works | The rule |
|---|---|---|
| The 'accidental report' | A stranger claims they accidentally reported you, then a 'Steam admin' — their accomplice — contacts you to 'verify' the account. | Steam has no admins who friend you to resolve reports. Block both accounts. |
| Free skins or tournament sites | A link promises free items or tournament entry; the login page is a lookalike that harvests your credentials. | Never sign in to Steam through a link someone sends you — type the address yourself. |
| The API key trick | You are talked into generating a Steam API key and pasting it somewhere, giving the scammer a silent window into your trades. | Never create an API key for anyone else; revoke existing keys at steamcommunity.com/dev/apikey. |
| The fake middleman | A 'middleman' is added to a trade to keep it safe — then vanishes with the items. | Community middlemen never need your login, your code or your API key. |
| The code request | A site or a person asks for your current Steam Guard code to 'confirm' something. | Authenticator codes are only ever typed into Steam itself, and only for a sign-in you started. |
If your account is already hijacked
Move fast, in this order:
- Lock the account at store.steampowered.com/account/selflock — you will need access to the account's email to unlock it afterwards.
- Run the recovery wizard at help.steampowered.com. Have proof of ownership ready: the original email address, a retail CD key from a game you registered, or the payment method used on the account.
- Once you are back in, change the password, deauthorise all other devices and revoke any API keys at steamcommunity.com/dev/apikey.
- Scan your PC for malware — a surprising number of hijackings start with an infostealer quietly logging keystrokes.
If the hijacker spent your stored payment details, start with Steam's refund process for any unauthorised purchases inside the refund window, and talk to Steam Support about anything older.
The five-minute checklist
Authenticator on. Unique password. Email secured. Unknown devices deauthorised. Games shared through Steam Families, never through your login. Codes only ever entered into Steam itself. Do those and your account is harder to steal than the vast majority of hijacked accounts ever were.
