Just a heads-up in case it's something that might cause issues for me here on Steamgifts.

It looks like i was hijacked by a fake site setup to steal Steam accounts.
I mentioned it here 3 hours ago:
https://www.steamgifts.com/go/comment/6n2FPWb

Malicious SITE!!!! DO NOT USE!!!!
magnat-gift DOT com

My Steam account has had it's email changed and i can't login .

Obviously i should have checked it was the official steam api when it asked. for my steam api link.
Normally i would login first to steam and then check.
But this time i wasn't thinking straight and screwed up.

First time ever this has happened to me ,i'm usually always very careful.

I've contacted steam support and i'm now waiting to get my account back.

Edit:
All fixed ,account is back and 100% ok.

"ALWAYS log into Steam via the store page or community page before you log into a 3rd party site.
If after logging on the store/community page the 3rd party site asks you for your username and password to log in,
you'll know you are logging into a phishing site."

4 years ago*

Comment has been collapsed.

Ouch. This is still a bad thing going on. Happened to me last Christmas but I was able to get it backwithin 24 hours. Steam support was REALLY on the ball there.

I wish you luck in this.

4 years ago
Permalink

Comment has been collapsed.

Thanks .

I got it back a few hours later ,very quick.
Everything present and correct.
15 day trade ban and all trading cards dumped back to my inventory (A lot of trading cards ,will takes days to put back on the market)).

4 years ago
Permalink

Comment has been collapsed.

4 years ago
Permalink

Comment has been collapsed.

Yeh ,i've just been reading that , good information .

Just caught me off guard but that's all they need.
I hope there's a special place in hell for all online scammers.

4 years ago
Permalink

Comment has been collapsed.

No i mean that's your reply link, not the one in op.

4 years ago
Permalink

Comment has been collapsed.

oh ,lol ,thanks , fixed it.

4 years ago*
Permalink

Comment has been collapsed.

Just yesterday I mentioned a talk similar to my Steam friend.
Flagfox | A blog for the Flagfox extension and its development
It gives the flag of the site to the URL bar.
It will be a guide if you are wary of a particular country.
It is also good to introduce an app for security measures appropriately.

4 years ago
Permalink

Comment has been collapsed.

I'm wondering if malwarebytes browser extension might have picked up on it. ,not sure.

4 years ago
Permalink

Comment has been collapsed.

Thank you for the good advice and Happy Cakeday!!! ~

4 years ago
Permalink

Comment has been collapsed.

Did you want us to temporarily suspend your SG account until you get things sorted?

As this thread has been closed by you, I cannot respond to your question directly. Instead, I'll put the answer here. Yes, it is easy to get it back. You just tell us (in the ticket) that you have regained control of your Steam account, and we list the suspension on your account.

4 years ago*
Permalink

Comment has been collapsed.

Maybe ,is it easy to get it back ?

4 years ago
Permalink

Comment has been collapsed.

I like you for that comment and the temporary suspend that you have mentioned.
If there was a like I would have given you one. Also here is a piece of my heart.

4 years ago
Permalink

Comment has been collapsed.

How do people still fall for such websites..

4 years ago
Permalink

Comment has been collapsed.

Thanks for adding to the conversation ,very useful info.

4 years ago
Permalink

Comment has been collapsed.

It's true though.

4 years ago
Permalink

Comment has been collapsed.

I've finally seen the light ,wouldn't have been possible without you jumping in there.....unannounced.
The world is a better place this evening ,thanks to your input.
Bless you.

4 years ago*
Permalink

Comment has been collapsed.

I don't understand why some people feel the need to take a shit on an already bad situation, but you played it well, sir.
Thanks for the chuckle and best of luck getting your account back. seems like you got it back already. Very nice. :3

4 years ago*
Permalink

Comment has been collapsed.

Good old British sarcasm usually does the trick. :P

It's just frustrating reading pointless comments like that .

The internet is full of it ,someone asks a question or starts a conversation and you have to
wade through a bunch of useless comments before you get to anything of interest or relevant to the OP..

Though maybe we're all guilty of doing that sometimes :)

And thanks ,luckily i got it back very quick ,thanks to the Steam Support guys.

4 years ago*
Permalink

Comment has been collapsed.

How do people..... is a slippery slope isnt it?

4 years ago
Permalink

Comment has been collapsed.

How do people still fall down slippery slopes?

4 years ago
Permalink

Comment has been collapsed.

If someone falls for that it isn't their fault. Not everyone is super self-aware and check the link from everysingle website. Not even myself. How can you expect to a vulnerable demographic, as small kids and older generations, to do that. The amount of condescending attitude coming from you in this comment is just deplorable.

4 years ago
Permalink

Comment has been collapsed.

What. Small Kids? Steam ToS clearly says that you need to be at least 13 years old. And in that age, you're not a small kid anymore. Also, I geniunely doubt that there are people of such a high age on Steam as they might suffer from dementia lol.

As you can see, I was simply referring to FREE GAME-phishing websites. As a matter of fact, I did not include "classic" phishing stuff like the ones which actually put an effort into faking a bank email, etc. - I can see why people COULD fall for these. Still, using a modern browser with enough appropriate extensions still prevents you from harm.

I don't want to sound ignorant, but the fact that there's been so massive amounts of heads-ups through classic media (TV, radio) as well as modern media (Social media, Google itself, etc.) and people STILL havn't heard of it baffles me somehow.

4 years ago
Permalink

Comment has been collapsed.

I've never seen anything about Steam phishing sites on TV or social media. I know only about that because I inform myself a lot about Steam and everything that surrounds it. You can't expect that from everyone. Your usual casual gamer does not take part in discussions on forums. And he does not read gaming or IT news. It' frankly baffling to me that there are still people who find it baffling that not everybody knows about how Steam account phishing works exactly. ;)

In this case your argument doesn't even apply, since the OP said he is usually careful about stuff like that but screwed up this one time. He made a mistake. We all do from time to time.

4 years ago
Permalink

Comment has been collapsed.

At least here there's news about all kinds of online scams even in the newspapers for your grandma to read. Not mentioning Steam ones specifically is just because they are a tiny minority and you lose some overpriced pixels instead of the contents of your bank accounts. But the same lesson still applies to this too, look at what you're doing and think for a minute do I really want to give this random website my information?

4 years ago*
Permalink

Comment has been collapsed.

Even though it's against ToS, there is people younger than 13 years. As a matter of fact, phishing is against of the ToS and this doesn't mean that they are gone and need to be ignored/neglected. If you play couple rounds of cs:go you can see that this statment is simple untrue. Eventually, you will hear a little kid screaming in the microphone. Even if that statment is true, 13 years old kids aren't that capable of differenciating real websites from fake. You really need to be tech savy to not fall for it.
Even if you are tech savy, you take things for granted and will not check the url from a website every single time.

Let's be honest here, free game websites already sound scketchy by default, for example dlh and even humble bundle. The premise of free games for advertising sounds pretty suspicous. And both of this sites require steam link/login to get the free game.

Where did you see heads-ups? I live in a third world country and the least thing the media/population is concerned is about phishing websites. And the most common thing to do to inform yourself is to read local news. Maybe you live (hopefully) in a country where there is no big problems to be worried about so the media will cover that. Considering this chart the amount of people are in the same situation is substantial.

I know you don't want to sound ignorant, but this is not a response to someone that lost their account that they took a lot of time and money to build. You sounded as you are mocking him for falling for that.

4 years ago
Permalink

Comment has been collapsed.

Mocking him was never my intention. If anything, I feel bad for him because no one deserves to get their account taken from them by lowlife criminals.

Maybe I really did not take into account that not all countries cover online theft in classic and modern media. I apologize that I went too far on this one.

I'm from Germany and we suffer MASSIVELY from phishing, especially at ATMs. It's criminal groups from Eastern Europe who screw us over all the time. So yeah, coverage about that issue as well as online theft is nearly a daily topic mentioned in the news and other media. So even really old people and kids know about it.

Anyhow, I also think that Google should do more about it. Yes, they block websites once they checked it and it turns out to be a scam. But the timeframe which happens between a user's report and they doing something about it is way too lengthy.

4 years ago
Permalink

Comment has been collapsed.

Just noticed ,this comment a bit late .
No worries ,i didn't feel mocked :)
Not a big deal .

You were just "thinking out loud" ,i do that sometimes .

4 years ago
Permalink

Comment has been collapsed.

I use a password manager. There is no way I'm going to accidentally login to any website when my password looks something like this: l%#@erfGVc%^Y^cfCDFRT%ktvhh4d8*

4 years ago
Permalink

Comment has been collapsed.

We use the same password? o.O

4 years ago
Permalink

Comment has been collapsed.

xD

4 years ago
Permalink

Comment has been collapsed.

lol guppy :P

4 years ago
Permalink

Comment has been collapsed.

Best of luck getting it back

4 years ago
Permalink

Comment has been collapsed.

What about two factor authentication?

4 years ago
Permalink

Comment has been collapsed.

Not sure what you mean .

I had to make a completely new one.
I think they wiped my old one.

I chose a insanely long 512 password for my new 2-factor.

When they give you your account back ,everything is new again ,you have to reinstate your account security , like it was a new account.

Also ,anything you had on the market will be dumped back to your inventory.
So i now have thousands of trading cards that i will have to re-list.

It looks like they trace everything linked to your ownership and bring it all back to your inventory.

4 years ago*
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 4 months ago.

4 years ago
Permalink

Comment has been collapsed.

Yeh ,i was using that ,i've had 2-factor for a long time.

I was just reading this :
https://dmarket.com/blog/steam-api-key-scam/

https://steamcommunity.com/discussions/forum/1/3315110799622769849/

I'll just have to be more careful in future ,dam fake site just caught me off-guard.
I'd just woken up ,hadn't had me coffee yet :)

Strangely ,i went to lock my steam account to stop any further problems and it was already locked.
Not sure what was going on there, might have just been the scammers at work.

4 years ago*
Permalink

Comment has been collapsed.

I mean using the app to login as GrimReapurr explained. If i want to login to steam I need my phone with me to enter the code it generates :)

4 years ago
Permalink

Comment has been collapsed.

Yeh ,the scam came after ,with a steam api login.

Weren't we always told ,steam api is ok ?
A site can't get your account from just showing it your steam api ?
Seems like that's no longer true.

4 years ago
Permalink

Comment has been collapsed.

Hmm strange.

4 years ago
Permalink

Comment has been collapsed.

Steam api is safe. The page that asked you to log in was fake, so you gave your login info to a hacker.

4 years ago
Permalink

Comment has been collapsed.

Ah ,yes ,i see ,that's why the safe thing is to login to steam first and then check the page that is asking for your steam login.

I did the lazy thing and paid the price.

4 years ago
Permalink

Comment has been collapsed.

find my last topic and think once more about steam protection

4 years ago
Permalink

Comment has been collapsed.

2-factor authentication is useless against social engineering / fishing attempts. It's important to keep this in mind, since it can create a false sense of security that can turn against you.

4 years ago
Permalink

Comment has been collapsed.

Yep and it's seems to be where a lot of the scammers are operating these days.

4 years ago
Permalink

Comment has been collapsed.

I don't understand. If someone had my password they still wouldnt be able to login right? So what can they do with it?

4 years ago
Permalink

Comment has been collapsed.

The fake page also asks for your mobile auth code, so they can login.

4 years ago
Permalink

Comment has been collapsed.

Ah ofcourse. That makes sense, but they have to be quick though.

4 years ago
Permalink

Comment has been collapsed.

Glad you got it back.

4 years ago
Permalink

Comment has been collapsed.

Thanks man ,i was surprised how quick they did it.

4 years ago
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 4 months ago.

4 years ago
Permalink

Comment has been collapsed.

lol .i do like a funny gif.

4 years ago
Permalink

Comment has been collapsed.

thats easy, u dont lost a thing because u dont have a thing,
if there was gifts, csgo or other keys - u ll lost a lot, and steam dont care about it
congrats u have brains not to collect steam shit on your inventory

4 years ago
Permalink

Comment has been collapsed.

Yeh ,csgo stuff seems to be what scammers are usually after.

4 years ago
Permalink

Comment has been collapsed.

If you had SteamGuard enabled, nobody can steal your items that easily.

4 years ago
Permalink

Comment has been collapsed.

oh rly?

4 years ago
Permalink

Comment has been collapsed.

https://support.steampowered.com/kb_article.php?ref=1047-edfm-2932#newdevice

If you have not had Steam Guard enabled for 15 days, you will be unable to trade or use the Community Market. Accounts that currently have Steam Guard disabled will be unable to trade and use the Community Market.

With SteamGuard on, they will have to disable SteamGuard first (if they happened to steal your account and able access your SteamGuard settings). Once disabled, the account will be unable to trade/market for 15 days.

If you are logging onto Steam from a device that has not been previously authorized by Steam Guard (log in confirmed via email), you will not be able to trade or use the Community Market from this device for 7 days.

If they do not disable your SteamGuard, but have access to your SteamGuard device, new device will still be locked for 7 days.

So, at worst you have 7 days to recover your account before your items are compromised.
Unless you're talking about in-game items, then those depends on the game. For instance, Dota 2 do not allow you to gift any in-game item to new friends. You must be friends for at least 30 days.

Sometimes I complaint about the inconvenience myself too. But at least I can safely assure that my items are quite secured.

4 years ago
Permalink

Comment has been collapsed.

Except all these scams just ask you to give them the code just like your username and password. Also putting it on your phone means there is a much less secure 1FA way to get all your items with the phone.

4 years ago
Permalink

Comment has been collapsed.

Yeah, that is when your phone is stolen.
It rarely happens over the Internet thought. Or at least I never heard of people having their phone stolen over the Internet.

4 years ago
Permalink

Comment has been collapsed.

It happens through the Internet exactly the same way as with PCs, you do something to put yourself at risk. The fact that they mainly bother with stealing banking and other more valuable information doesn't mean it wouldn't be trivial to make it steal Steam accounts instead. They find new mobile malware all the time and the numbers just keep growing. Here's a random recent link from top of Google:
https://thenextweb.com/security/2019/06/24/study-google-play-is-riddled-with-thousands-of-data-stealing-counterfeit-apps/

4 years ago
Permalink

Comment has been collapsed.

Good point! I totally forgot about mobile malware.

Still, the whole thing about 2FA is that, it is 2FA. Your mobile phone is your 2nd FA.

For scammer to steal your stuffs, they need to steal BOTH your Steam account (1st FA) and your mobile phone (2nd FA). Unless you are using your phone to browse the phishing site, and stupid enough to install mobile malware thru the phishing site (or unless your phone is already infected to begin with), then I still think SteamGuard is pretty safe.

Of course, there isn't a 100% foolproof way to prevent someone from getting hacked. But we cannot just dismiss every security measure as "useless".

4 years ago
Permalink

Comment has been collapsed.

But there is no 2FA if you gain control of the phone, trade offers made with the mobile client are verified by the same mobile client. More than phishing websites on PC it would happen with contaminated apps which are found on app stores all the time in huge numbers and downloaded by millions. Same as pirating stuff for PC from unreliable sources and getting Win32.SteamStealer to go with that latest AAA game you couldn't afford. Just make a Steam related app that promises free CS:GO skins or whatever and see 10 million kids install it on their phones.

Cynical pessimism is the surest way on top of common sense, nobody is going to give you something for free and if they are offering, it's 100% a scam.

4 years ago
Permalink

Comment has been collapsed.

Well shiet. You're right. I didn't know you can send trade offer with the mobile app.

Once your phone is compromised, there's no more 2FA anymore.
We must also make sure the phone itself is secured then.

4 years ago
Permalink

Comment has been collapsed.

if someone hacked your email, all steam security dont cost a thing, even if u ll restore account in 7 days, u ll lost gifts, money, ingame items (like csgo keys)
steam protects you till its interesting for steam, steam dont interested in saving your money, your gifts and your items
steam save your 0.03 usd cards, only
also if u get vac ban after hack - steam dont care about it too

4 years ago
Permalink

Comment has been collapsed.

If someone hacked your email, then you cannot blame Steam for being unsecured.
It is your email account that is unsecured.

Having SteamGuard enabled still means they cannot steal your stuffs unless they also stolen your phone.

4 years ago
Permalink

Comment has been collapsed.

where is trade hold?

4 years ago
Permalink

Comment has been collapsed.

Did you have 2FA enabled? People seem to think it's some magic bullet but tbh surely the fake site can ask for your 2FA code and pass it through just the same.

4 years ago
Permalink

Comment has been collapsed.

He had, he simply gave fake-site his login, password and 2FA code.

That's why you should log through Steam's site, so any other legit site will only show "confirm your account" screen, not "please give login and password".

4 years ago
Permalink

Comment has been collapsed.

Yep , that's the mistake i made.
I'd just woken up and wasn't thinking straight.
I clicked without checking first.
I've been doing this type of thing for years and never had problems ,all it takes is that one time when you forget.

Plus ,normally i use an alt account for any of these giveaway sites so it can't cause me any problems.
Should have had my cup of coffee first :)
.

4 years ago
Permalink

Comment has been collapsed.

Sorry you lost it, glad its back in your hands! :)

4 years ago
Permalink

Comment has been collapsed.

Glad you got it back its happen to me with links friends has sent to me before.

4 years ago
Permalink

Comment has been collapsed.

Glad you got your account back. Hopefully you'll be more cautious in the future so it doesn't happen again.

4 years ago
Permalink

Comment has been collapsed.

Yeh , I look at it like a serious reminder to be 100% careful in the future.
Hopefully by mentioning it here others will read it and think too.

You can't let your guard down ,ever.

4 years ago
Permalink

Comment has been collapsed.

ALWAYS log into Steam via the store page or community page before you log into a 3rd party site.
If after logging on the store/community page the 3rd party site asks you for your username and password to log in, you'll know you are logging into a phishing site.

4 years ago
Permalink

Comment has been collapsed.

Sign in through Steam to add a comment.