@norby89 Send them a trade offer link. After friended, remove link. Another solution would be a private message system with the friend link in the private message. Problem solved.

@[•L•R•] MrOmNomNom3 Nobody else seems to be making more suggestions. It does appear that site admins have already surrendered to phishing bots and have no intention of trying to do anything about phishing. However if site admins do care about phishing and want to try to do something about it here on the site, the only way to get more ideas is to listen to more ideas. There is a difference between "can't" and "won't", so hopefully someone will suggest something that can help. As long as new ideas are wanted, feedback should be encouraged.

Howdy!

Like many of you, I have been plagued with phishing bot friend requests that originate from this site. The bot’s current method is to scrape my Steam ID from links displayed here and then friend me directly with that information.

I have not seen this suggestion rejected after reviewing the list found here: https://steamhost.cn/steamcommunity_com/groups/tf2outpost/discussions/6/666826166345755101/

I propose a countermeasure by giving sellers the option to hide text or links that normally contain my Steam ID; buyers would ask to be friended in order to trade in person (rather than with Trade Offer link).

1. Add user profile option to hide Steam ID instances
   
   1. “Add on Steam” link
      
   2. “View Steam Profile” direct link to Steam
      
   3. Anywhere else my Steam ID directly appears to users
2. If a user wants to friend me to trade in person, that user must request to be friended (the usual “friend me” reply to a selling post) before in-person trading can occur.

Using this method will put me (the user) in control over who can and cannot see my Steam ID, thus making it more difficult for phishing bots to spam me. Users will still be able to communicate with me via post replies and trade offers. Anyone who wants to add me directly as a friend must first ask me directly in the trade post before being friended.

Thank you for your consideration and have a great day!

Joe.

No measure is 100%. This is an effort. I am looking for options and effort. Currently there are none.

People seem to cry, "if it's not 100% effective, why bother?" Seat belts are not 100% effective, but I wear them every time I get into a car and I refuse to ride in a car without them.

From what I can tell, the suggestion of a global captcha has been rejected (understandably so). This suggestion is a seller-controlled captcha option. I am unsure of any reasons why this new suggestion would be rejected.

@kléni It will put the burden of responsibility directly from tf2outpost.com to Steam; meaning, since tf2outpost.com did not provide the Steam ID for the phishing bot to use, tf2outpost.com is pushing the burden of responsibility away from it to Steam to deal with directly. Also, I did not see where this idea was rejected in that list you linked.

@HusKy No, the option described above is not currently available. Trade offer links do not directly contain my Steam ID; instead, they contain "partner" and "token" information.

@kléni This countermeasure will require more steps to potentially pull my Steam ID. The countermeasure also puts the responsibility directly in the hands of Steam since Steam will be providing my Steam ID instead of this site.

The goal of this countermeasure is, at my request, to add more complexity for phishing bots to be successful.

Howdy!

Like many of you, I have been plagued with phishing bot friend requests that originate from this site. The bot’s current method is to scrap my Steam ID from links displayed here and then friend me directly with that information.

I propose a countermeasure by giving sellers the option to require a captcha before users can view links that normally contain my Steam ID.

1. Add user profile option to require users to pass captcha
   
2. When profile captcha option is activated, add a middle captcha page to any link that normally contains my Steam ID
   
   1. User clicks on “Friend on Steam” link
      
   2. Link takes user to captcha page
      
   3. Once user passes captcha, user is given current regular “Friend on Steam” link
3. Steam ID page links references would include
   
   1. “Add on Steam” link
      
   2. “View Steam Profile” direct link to Steam
      
   3. Anywhere else my Steam ID directly appears to users

Using this method will put me (the user) in control over who can and cannot see my Steam ID, thus making it more difficult for phishing bots to spam me. Users will still be able to communicate with me via post replies and trade offers. Anyone who wants to add me directly as a friend must first pass a captcha at my request.

Thank you for your consideration and have a great day!

Joe.

Howdy!

Like many of you, I have been plagued with phishing bot friend requests that originate from this site. The bot’s current method is to scrap my Steam ID from links displayed here and then friend me directly using that information.

I propose a countermeasure by giving sellers the option to remove all references to their Steam ID and replace it with Steam Trade Offer links.

1. Add a “Steam Trade Offer” information option to user profile settings
   
   1. If my Steam Trade Offer link changes, I can modify it here in settings
2. Remove “Add on Steam” links for user and replace with “Steam Trade Offer” link
   
3. Remove all other plain text Steam ID references
   
   1. Trade post pages
      
   2. User profile page
      
   3. Anywhere else my Steam ID directly appears to users

Using this method will put me (the user) in control over who can and cannot see my Steam ID, thus making it more difficult for phishing bots to spam me. Users will still be able to communicate with me via post replies and trade offers.

Thank you for your consideration and have a great day!

Joe.

My dismissal interpretation came from the speed in which my threads were locked before my understanding of the topic was complete.

Of the other existing threads I have read, the vibe I received was, "Phishing: not our problem, sorry." If my site were being used for nefarious reasons, I would at least attempt to do everything I could to stop it, not just state nothing could be done. At the very least, I would try to fully educate users to the phishing problem.

Originally posted by norby89:

The staff's job is to provide a clean and safe environment for users to promote their trades.

Phishers are making this environment much less clean and safe. What is the staff going to do about phishing scrapers using this site? Nothing?

My understanding was that TF2 Outpost was a leading trade site. My hope is that leaders will lead.

Currently, my user experience has been greatly negatively impacted to the point where I am posting in the site forum, asking for information and making suggestions. I am not likely the only one who feels this way.

As for site functionality, I am not sure why anonymous site users need to see my Steam ID. Requiring Steam login (currently not implemented) seems like a reasonable minimum standard to view any Steam ID, be it my Steam ID or someone I wish to trade with. If an anonymous person wants to trade with me, using Steam Trade Offer link seems to be a reasonable method in my opinion.

Going beyond that measure, I cannot think of a reason why a logged in member would need to view my Steam ID until the user is ready to add me as a friend to trade. (Again, if they don't want to friend me to trade, they can use the Steam Trade Offer link.) Requiring a captcha at that point also seems reasonable to me, especially given the current rampant phishing activity. An explanation of the reasons for the captcha would help educate users: "We have implemented this captcha as a response to the wide usage of phishing bot scammers scraping Steam IDs from this site. This is a pilot program to gauge the captcha effectiveness as a phishing countermeasure. We don't like phishers and we hope you support us during this trial period. If you have any questions or would simply like to voice your opinion, please visit our forum linked here." You can then see how well that measure works for 2 weeks or so.

The current site attitude comes across to me as, "We won't try" and that truly makes me sad.