Tens of millions of dollars worth of CS2 skins get stolen every year, and in almost every case the victim confirms the trade, enters the password or clicks the link themselves. Scammers do not hack Steam — they hack your attention. The good news: there are not that many schemes, they have been recycled for years with cosmetic changes, and every single one of them falls apart if you know a few simple rules. Let's go through the scammers' entire current arsenal and how to keep the inventory you spent months building.
The top scam schemes and how they work
Fake trade offers
The classic. You receive a trade that looks like a deal with a marketplace bot or an exchange with someone you know, but it was actually created by a scammer. The bet is on inattention: a similar nickname, a similar avatar, a similar Steam level. You confirm the trade in your mobile authenticator on autopilot — and the skins are gone. A separate subtype is the "double trade": first they send an honest offer, cancel it "due to a technical issue", and you confirm the second, already swapped one without looking, because you "just checked everything".
"Skin verification" from fake Steam moderators
A "Valve employee", "Steam moderator" or "marketplace admin" messages you: your account has supposedly been flagged for item duplication, your skins need to be "sent for verification", otherwise you get a trade ban. Sometimes the pressure comes through a friend: they scam someone you know first, then message you from that account saying their account got locked because of a trade with you, and this "moderator" will help "sort it out". Remember this once and for all: Valve has no "skin verification" procedure that involves trading. No real employee will ever ask you to hand over items. Any such request is a scam, one hundred percent, no exceptions.
Phishing clones of marketplaces
Scammers put up an exact copy of a well-known marketplace on a similar domain: an extra letter, a hyphen, a different TLD. The design, the logo, even the reviews — all pixel-perfect. You enter your Steam login and password "to authorize" — and hand over your account. Links to these clones spread through search engine ads, YouTube comments, direct messages and "great deals" in Discord. The only defense is to check the address bar letter by letter — or better yet, never open marketplaces from links in messages at all.
The API-key scam: the most insidious one
If you ever entered your Steam credentials on a phishing site, scammers may have obtained your Steam Web API key. Then the magic begins: you list a skin on a marketplace, the marketplace bot sends you a trade, the scammer's script instantly cancels it via the API and sends its own — with the same item name, but from a clone of the bot's account. You see "the same" trade, confirm it — and the skin goes to the fraudster. The scheme is scary precisely because the victim does everything "right" and sells the skin on a real marketplace. Check right now whether there is an API key registered on your account that you never created, and revoke it on Steam's API key management page.
Quick-switch: the last-second swap
In the trade window the scammer shows an expensive skin, say a knife, and a second before confirmation cancels the trade and sends a new one — with a visually similar but cheap item, or the same knife in battle-scarred condition. The bet is that you will not double-check the second time. Any cancellation followed by an instant repeat offer is a reason to re-verify the trade contents from scratch, item by item.
"A streamer's friend is giving away skins"
You get a message: a famous streamer is running a giveaway, you "won" a knife, claim it on a site via a link, or send your skins "to verify participation". Sometimes they attach screenshots of "payouts" and fake videos. The logic is ironclad: real giveaways never require the winner to log in on a third-party site, send items in return, or pay a "withdrawal fee". If they do — it's a scam.
Summary table: scheme, hook, defense
| Scheme | What it preys on | How to defend |
|---|---|---|
| Fake trade offer | Inattention, similar nicknames | Verify every item and the recipient before confirming |
| "Skin verification" | Fear of a ban | Valve never asks for items — ignore and block |
| Marketplace clone site | Haste, links from messages | Check the domain letter by letter, use bookmarks |
| API-key scam | Swapped marketplace bot trade | Revoke rogue API keys, verify the bot account |
| Quick-switch | Repeat offer "with no changes" | Re-check the trade after any cancellation |
| "Streamer giveaway" | Greed and free stuff | Real giveaways ask for no logins and no items |
Five rules that shut down 99% of schemes
First: enable Steam Guard via the mobile authenticator and never turn it off — without it trades are either impossible or delayed, and that delay is your insurance. Second: never enter your Steam login and password anywhere except steamcommunity.com and steampowered.com — verified letter by letter in the address bar. Legitimate marketplaces use Steam's official OpenID sign-in window, and the address in it is always steamcommunity.com. Third: check the marketplace URL before every deal and open platforms from your own bookmarks, not from links in DMs and comments. Fourth: buy and sell only on established platforms with an escrow system, where the marketplace itself supervises the deal — a direct trade with a stranger "without fees" saves a couple of percent and risks your entire inventory. Fifth: if an offer is too generous to be true — it is a scam. Not "possibly a scam". A scam. A knife at half price because "I urgently need money", a win in a giveaway you never entered, a trade where a stranger adds items on top for you — it is all the same fishing rod.
Knowing the market price is your armor
Almost every scheme exploits ignorance of the real price. The scammer needs that "knife at 60% of value" to look like luck rather than a red flag. That is why the habit of checking the market price before any deal is not about saving money — it is about safety. Always verify the market price — here it is in real time:
If someone offers you this skin noticeably below the lowest marketplace price, you are looking at either a stolen item or bait. And this is what an honest price spread across marketplaces looks like for the same item:
A 5–10% difference between marketplaces is a normal market picture: fees and liquidity differ everywhere. A 40–50% discount in a DM offer is not "getting lucky" — it is a scheme.
How reSkins helps you stay safe
reSkins is a price aggregator, and in the context of security that gives you two things. First, we only route you to established marketplaces — Skinport, Lis-Skins and Market.CSGO: platforms with a reputation, escrow and real support. The "go to marketplace" button leads directly to the item's page on the platform's official domain — you never have to google the marketplace and risk landing on an advertised phishing clone. Second, our prices refresh every 30 minutes, so "too cheap" gets spotted instantly: open the catalog, glance at the real price range — and that generous DM offer immediately shows its true colors. At the same time, reSkins never holds your money or skins and never asks you to sign in through Steam — the deal always happens on the marketplace itself. For more detail on how the aggregator works, read how reSkins works, and if you are just building your first inventory, start with the best first inventory for $100 guide — it also covers where to buy safely.
Scams live on haste, greed and trust in pretty interfaces. Slow down for ten seconds before every trade confirmation, check domains and prices — and your inventory will stay yours.
