Steam API key scams and fake trade offers: a Rust player's defense

The Steam API key scam is quiet by design. Your skins stay in your inventory, your password still works, and nothing looks wrong until the moment you make a real trade. Then your offer disappears, a near-identical one arrives from an account dressed as your trade partner, and you confirm it on your phone without a second look. The skins go to a stranger.

Rust players are a natural target because so many of us trade with bots every week, for gambling deposits, marketplace sales and withdrawals. This guide covers how the scam works, how accounts get compromised in the first place, the checks that catch it, and what to do if it has already happened to you.

How the API key scam works

A Steam Web API key is a developer credential. Legitimate developers use one to build tools that read Steam data. In the wrong hands, a key registered on your account lets someone watch your trade offers as they are created and act on them automatically. The attack usually runs like this:

1. You log in to Steam through a fake page, or a malicious program or browser extension copies your logged-in session. Someone can now act as you on Steam's website.
2. They register a Web API key on your account, or find one you created and forgot about.
3. They wait. Nothing is taken, so a quick look at your inventory tells you everything is fine.
4. You start a real trade, for example a deposit on a Rust gambling site.
5. A script sees the new offer, cancels it, and sends you a replacement from an account set up to look like the real partner: same name, same avatar, the same items listed.
6. You confirm the replacement in the Steam app. The skins go to the scammer, and the site's deposit simply times out.

The important detail is the last step. The key lets the scammer watch and react, but approving a trade still takes your phone. Every version of this scam still needs you to confirm a trade you have not checked properly, which is exactly where you can stop it.

Valve has added friction to key registration over the years, and scammers have adapted by tricking players into approving steps themselves. Treat any website that asks you to create, paste or confirm an API key as hostile. A Rust gambling site has no need for one.

How accounts get compromised in the first place

Fake Steam login pages

The classic route is a page that looks like a Steam sign-in and sends your details to someone else. They show up behind free skin giveaways, fake gambling sites with free cases, links asking you to vote for someone's team in a tournament, and cloned versions of real Rust sites.

A more convincing variant draws a fake login popup inside the page itself, complete with a fake address bar showing steamcommunity.com. Two quick tests catch most of them. Try to drag the popup outside your browser window: a real window can leave, a fake one drawn by the page cannot. And watch your password manager: it will not offer to fill a login on the wrong domain, however real the page looks.

QR code logins

Steam lets you sign in by scanning a QR code with the mobile app. Scammers abuse this by showing you a code on a third-party page, or sending one in a DM, and asking you to scan it to log in or claim something. Scanning it approves their login on your account. Only scan a code on a Steam login screen you opened yourself, in the Steam client or on steamcommunity.com.

Malicious extensions and downloads

Browser extensions that promise skin price checks, trade helpers, free skin tools, game cheats and files sent by a friend asking you to try their game are all common carriers. Some of them steal your browser's session data, which lets someone use your logged-in Steam session without knowing your password or seeing a Steam Guard code. Install software only from sources you looked up yourself, remove extensions you do not use, and be very suspicious of any file sent in a message, even from a friend whose account may already be compromised.

Handing over the key yourself

Some sites and so-called trade bots ask you to paste your API key to verify trades or speed things up. Do not. Even when the site means no harm, a live key on your account is one database leak away from someone else's script.

A five-minute account audit

Do this now, and again any time you suspect you logged in somewhere you should not have. Do it in one sitting, because the order matters: you want to cut off access before you clean up.

1. Change your Steam password from the Steam client or a Steam page you typed in yourself. Make it unique to Steam.
2. Open Manage Steam Guard in your account settings and use Deauthorize all other devices. This ends every other logged-in session, including one a scammer may be using.
3. Type steamcommunity.com/dev/apikey into the address bar. You should see a form to register a key, not an existing key. If a key is listed, click Revoke.
4. Check that the email address and phone number on the account are yours, and that the email account has no forwarding rules you did not create.
5. Look through your browser extensions and remove anything you do not recognize or no longer use. Run a malware scan on the PC.
6. If your trade URL has been posted publicly, create a new one in your trade offer settings and update it on the sites you use.

Check the API key page again a day later. A key that comes back after you revoked it means someone still has access, so repeat the steps and contact Steam Support.

Reading a trade offer that might be fake

Impersonation bots copy what is easy to copy. A display name and an avatar can be changed in seconds. A Steam ID, a profile link, a Steam level and the age of an account cannot be faked as easily, and that is what you check.

• Open the offer in full. Use the Steam client or steamcommunity.com, not just the phone notification.
• Click through to the partner's profile from inside the offer. Compare the level, the account age and the profile link with what the site shows for its bot. Impersonators are usually new or recently bought accounts.
• Match the security code if the site prints one in the offer message and on screen.
• Check the items line by line. On a deposit, only what you selected leaves. On a withdrawal, nothing leaves at all.
• Be suspicious of a second offer. If an offer vanished and a new one appeared seconds later, treat the new one as hostile until you have checked it from scratch.
• Read the mobile confirmation. Tap into it and check the partner and items before approving.

One symptom deserves its own line. If your trade offers are being cancelled without you touching them, assume your account is compromised and run the audit above before you trade anything else. Our guide to depositing and withdrawing skins safely has a full checklist for deposit and withdrawal offers.

Fake support and fake admins on Discord

The second big family of scams skips the technology and works on you directly. The most common one in Rust and CS2 circles starts with a message saying someone reported your account by accident, and that you need to talk to a Steam admin to clear it up. The admin is a scammer with a convincing name and a Valve logo, and the conversation ends with a request for your login details, a Steam Guard code, a screen share or a trade to verify your items.

Steam Support works through help.steampowered.com. Valve staff do not contact players on Discord to resolve bans or reports, and nobody genuine needs your password or codes.

Gambling site support gets impersonated the same way. Complain in a site's public chat or Discord about a stuck withdrawal, and you may get a DM within minutes from a support agent offering to help. Scammers watch public channels for exactly that. Real site support answers through the on-site live chat or ticket system, and it does not ask you to send skins or crypto to fix anything.

Scams Rust players run into most

The skin price check angle is worth a closer look if you value an inventory regularly. Our explainer on how Rust skin prices work shows how to value items with the Steam Market page alone, with no extension involved.

If it has already happened to you

Speed matters more than anything else here, because a compromised account can be emptied again while you work out what happened.

1. Run the account audit above straight away: password, Deauthorize all other devices, then revoke any API key.
2. Report the account that received your items using Report Player on its Steam profile.
3. Open a ticket with Steam Support through help.steampowered.com and explain what happened, with dates and trade details.
4. Tell the gambling site's support, through its own live chat, which bot was impersonated and when. Sites cannot normally reverse a Steam trade, but they want to know their bots are being copied.
5. Change the password on any other account that shared the same one, starting with your email.

Be realistic about recovery. Steam's policy is that items lost through trades are generally not restored. Anyone who contacts you offering to recover stolen skins for a fee is running the next scam on the list.

Habits that keep you off the list

None of this needs technical skill. It comes down to a handful of habits you repeat until they are automatic: reach sites through bookmarks you made, keep the Steam Guard Mobile Authenticator on, never paste an API key anywhere, never scan a QR code you did not ask for, and read every trade offer in full before you confirm it. Treat every unsolicited DM as hostile.

Account security is part of how we score sites too. Our rating method gives trust and safety the largest weight of the six criteria, and every review in our reviews section lists the domain we tested so you can check you are on the real one.

Losing skins to a scammer can feel a lot like losing them on a bad run, and the urge to win them back is just as strong. If you catch yourself depositing more to make up for a theft, take a break and read our responsible gambling page, which lists free support services.