Plenty of others have made guides for this, but there is so many people constantly falling victim, I believe there should be more.
This isn’t just about being careless or clicking the wrong link. These scammers have adapted. They use tactics like fake Faceit tournament invites, fake giveaways, and impersonating people you already know to gain access to your Steam account’s backend. Once that happens, they don’t need your password anymore. They use your own account against you.

For newer players, all of this may seem confusing. But if you’re investing into having an inventory, it’s your responsibility to understand the dangers and what to look out for. Same as pumping gas in a shady part of town.

Here’s everything you need to know so you don’t end up losing your inventory.

A Steam API scam isn’t your typical phishing scam. It’s more dangerous because it works after you’ve logged into what you think is a legit site.

It usually starts when a scammer tricks you into logging into a fake website using your Steam credentials. The site might look like a tournament platform, a trading site, or something related to giveaways. Once you log in, that fake site captures your credentials and either:

• Requests a Steam Web API key on your behalf
• Hijacks your active Steam session token

Once they have access, they can:

• Cancel real trades you’ve initiated
• Recreate a fake trade that looks identical
• Send it to themselves instead of the person you intended
• Wait for you to confirm it on your phone without noticing

By the time you realize what’s happened, it’s already too late. The trade is complete, and your skins are gone.

Fake Faceit Tournament Invite
A scammer will message you on Steam and say something like:
“Hey, we’re doing a Faceit tournament and we’re short a player. You’re pretty good, want to fill in?”

They’ll send a link that looks like a legit Faceit or Steam login page. But once you sign in, they silently grab your session or API key and wait for you to make a trade. That’s when they strike.

“Vote for My Team” or Giveaway Scam
You might get this through Discord or Steam chat. Messages like:
“Hey, can you vote for my CS2 team?”
or
“You won my giveaway! Just log in to claim.”

It all looks professional, but behind the scenes, they’re gaining access to your account. You think you’re helping a team or claiming a prize — they’re setting up to hijack your trade.

Cloned Friends or Bots
This is one of the most dangerous ones.

Scammers will copy your real friend’s:

• Steam name
• Avatar
• Profile description
• Even their entire friend list

Then they’ll send you something casual like:
“Hey, quick trade test?”
or
“Can you swap me that skin real fast? I’ll send it back.”

Since it looks like your friend, you let your guard down. But here’s the red flag: the scammer’s account is usually level 0, has no badges, and looks hollow. Always click on the user’s profile from the trade confirmation screen and check their level and details.

Once they have your API key or session, here’s what they do:

• You send a trade to your real friend
• The scammer silently cancels that trade
• They recreate the same trade, but from a cloned account
• You get the confirmation on your phone, and it all looks fine

You hit confirm, thinking it’s your original trade — but the scammer walks away with your item.

Go to: https://cs2bus.com/dev/apikey

If it says: “You do not have a Steam Web API Key”, you’re safe.

If it shows anything else, especially a domain or key, click “Revoke My Steam Web API Key” immediately.

Then:

• Change your Steam password
• Deauthorize all devices from your Steam Guard settings
• Review your recent logins and connected sites

• Never log into a site with Steam unless you’re 100% sure it’s official
• Be suspicious of login links — even if they come from a “friend”
• Always check the user’s Steam level before trading
• Click into the user’s profile from the trade window to confirm it’s real
• Use Steam Guard Mobile Authenticator for extra security
• Enable email confirmations if you want more time to spot scams
• Don’t rush. If something feels off, step back and double-check

• Revoke your API key here: https://cs2bus.com/dev/apikey
• Change your Steam password
• Log out of all devices and deauthorize them in your Steam Guard settings
• Contact Steam Support with all the info you have (Highly unlikely you'll get your items back)
• Scan your PC for malware or keyloggers just to be safe

Unfortunately, most people don’t recover their items — but reporting it helps Steam investigate and may prevent others from getting hit.