Install Steam
login
|
language
简体中文 (Simplified Chinese)
繁體中文 (Traditional Chinese)
日本語 (Japanese)
한국어 (Korean)
ไทย (Thai)
Български (Bulgarian)
Čeština (Czech)
Dansk (Danish)
Deutsch (German)
Español - España (Spanish - Spain)
Español - Latinoamérica (Spanish - Latin America)
Ελληνικά (Greek)
Français (French)
Italiano (Italian)
Bahasa Indonesia (Indonesian)
Magyar (Hungarian)
Nederlands (Dutch)
Norsk (Norwegian)
Polski (Polish)
Português (Portuguese - Portugal)
Português - Brasil (Portuguese - Brazil)
Română (Romanian)
Русский (Russian)
Suomi (Finnish)
Svenska (Swedish)
Türkçe (Turkish)
Tiếng Việt (Vietnamese)
Українська (Ukrainian)
Report a translation problem
No security measures will stop this from happening, because if a user hands out their details (via scams) then that's on them.
Steam has also opted to not replace any lost items because of prior abuse of that system.
Hope you learned your lesson.
Do ALL of these. Every single one.
1. Scan for malware https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours
3. Deauthorize all other devices https://steamhost.cn/twofactor/manage
4. Change passwords from a trusted/clean device
5. Generate new backup codes for your Mobile App https://steamhost.cn/twofactor/manage
6. Revoke the API key https://steamhost.cn/steamcommunity_com/dev/apikey (there should be nothing in the APIKEY)
7. Make sure your steam recovery email account is secure
Steam support will not restore any items or wallet funds that have left the account for any reason.
If any lost items are from a Trade Protected game, you might be able to recover them. See:
https://steamhost.cn/help_steampowered_com/en/faqs/view/365F-4BEE-2AE2-7BDD
You used your Steam credentials to log in to that site... they stole those details and sat on them for a while untill they thought it worth while to steal from you...
You have only yourself to blame...
And your stuff are gone...
It still hurts to lay your hand on a hot stove... it will never change...
That's unexpected.
I can see how hijackers stay out of sight until "it's worth it" -- which would be the first $20 theft you described. But, I would have assumed that they'd be going all-out, piling game bans on your account and using it for all kinds of nefarious things.
Instead, it seems they just waited for you to give them more money? Arguably, they went with the $2 opportunity instead of waiting for another $20-- but still: if you have hijackers on your account, KICK THEM OUT instead of just letting them sit there forever...
There are lists of things to do floating around, but the two most important steps are "deauthorize all devices" (this will end all login sessions and invalidate all login keys, so everyone will have to do the full credentials+2FA procedure again), and removing the API key if one exists (that one gives access to some aspects of the account).
Just be careful. It's not complicated. If something seems fishy, don't do it