Originally posted by EnnQ:

My girlfriend just registered a new Steam account last week, and used my credit card to purchased a game.

This week, the Steam client auto logoff her account and she forgot her password.

When trying to reset the password, Steam sent an email with verification link to my girl friend. But that link brought her to a page where she needed to input my credit card credentials and billing address to verify the account.

The point is, she didn't remember what exact billing address she input when she created account, and the system just said info didn't match the purchase history.

I never saw a service needed this much info to reset a password, and isn't email recovery enough (not to mention it's just feel very suspicious as phishing)?

Really have no idea how she could recover her account now it feels mind blowing and frustrating.

This is really interesting framing on your part. Your girlfriend wholly mismanaged her account and you're frustrated at Steam for having a process to recover an account. Plus given your story I'm not sure I'd trust she didn't venture into the account recovery process rather than a password reset. I mean I didn't see what she did, but I'm not sure I'd immediately trust she started dotting i's and crossing t's and doing the simplest process by the book. It's not impossible, but I question the plausibility.

At any rate you can be critical of Valve's processes. But Steam accounts are a popular target for phishing and scammers, which means Valve has spent years and years developing processes to prevent bad actors from getting control of account with a minimal of information. Yeah, that would be convenient for you your girlfriend in this moment, but methinks you'd change your tune real quick if someone was able to steal your account with barely any proof of ownership. "Valve should require a higher burden of proof!" You might argue. Well, fortunately, they do.

Plus it's not as if keeping track of a password is actually a difficult thing. Or using the correct billing address for your CC. I mean, why didn't she use your billing address? That would make things simple? These are all unforced errors on her part.

Honestly this is all the perfect argument for her to start using a proper password manager to keep track of passwords, and account details, and I dunno, steam guard backup recovery codes, for instances like this. After all she's just learned how fallible human memory is, and she's only human. So, it might not be a bad idea to mitigate some of those fallibilities.

As for her issue, seems like you can either help her do the correct processes if you're not already, or keep working the process she's in the middle of now. And once you get the account recovered, and having learned some lessons, do a better job of account management in the future.

So, that's a good learning experience: when you make an account that's supposed to last, write down your login data like username and password. And if you use made-up things, write them down too...