Hi everyone,

I recently had an issue where my Steam Wallet funds were spent without my knowledge on overpriced Community Market items. What’s concerning is that:

I had Steam Guard enabled.

There were no new device logins.

I received no email or mobile alerts.

Steam Support confirmed my account was compromised, but said Community Market purchases “cannot be refunded.”

After running full malware scans (Windows Defender + Malwarebytes), checking startup processes, and monitoring network activity, I found no evidence of malware or suspicious outbound connections on my PC. All Steam traffic went only to verified Valve/Akamai servers.

This strongly suggests a session hijack — attackers can reuse an existing Steam login session (token/cookie) without triggering Steam Guard or login notifications. This would explain how purchases can be made silently, even with Steam Guard enabled.

🔎 The problem:

Selling items requires a confirmation step.

But Community Market purchases use wallet funds instantly with no extra confirmation.

If a session is hijacked, attackers can drain wallet balances without the account owner ever being notified.

💡 Suggestion:
Add an optional setting (or default) where Steam Guard confirmation is required for Community Market purchases, just like it is for trades. This would protect against session hijacks and give users a chance to block fraudulent transactions before money is lost.

Given that reports of this kind of issue have been circulating since at least 2021, I think it’s time this was addressed.

Thanks for reading, and I hope Valve takes this feedback seriously — it would help protect all of us.