Almost every CS2 scam β and there are dozens of variations β comes down to one of two fundamental tricks. Either someone is impersonating somebody you'd reasonably trust (Steam Support, a friend, a "middleman"), or they're manipulating the trade itself so the items in the window aren't what you think they are. Internalize those two patterns and you'll spot most scams the first time you encounter them.
The single biggest defensive habit isn't technical, though. It's slowing down. Almost every successful scam involves urgency: a "quick trade" before the tournament, a Steam Support DM claiming you've been reported and need to verify now, a buyer pressing you to send items first because they're "about to leave." If you feel rushed in a trade, that's the scammer's actual tool. The defense is to stop, verify what's in front of you, and accept that legitimate trades will still be there in five minutes.
Fake Steam Support
You get a friend request or in-game message from "Steam_Support" or "Valve_Admin" or some variation. They say your account has been reported for fraud, and you need to verify your ownership to avoid suspension. They'll ask for your password, your Mobile Authenticator code, or a link to a phishing site that looks identical to Steam's login.
Steam Support does not contact users on Steam. Ever. They respond to tickets you file at help.steampowered.com. Anyone messaging you claiming to be Steam Support is, with no exceptions worth treating as real, a scammer. Block, report, move on.
The fake middleman
You're trying to sell skins for crypto to someone you met on a Discord server. They suggest using a "trusted middleman" β a Steam profile that looks legitimate, with a high Steam level, some decorative profile elements, maybe a custom URL that includes the word "middleman."
The middleman is the scammer's alt account. You transfer items to them "for verification." They vanish. You never see the items or the payment.
The defense here is structural: don't do unstructured P2P trades. Use a marketplace that escrows items automatically. SkinsWave handles escrow as part of the trade itself, so you never need a human to hold anything. If you absolutely must use a human middleman, only use one suggested by an established community moderator from a server you've been in for months, never one suggested by the other party.
Friend impersonation
A "friend" messages you in a panic. They need to borrow your knife for ten minutes for a tournament match, they'll trade something valuable back as collateral, they swear. The Steam profile looks just like your real friend's β same avatar, same display name, similar custom URL.
The SteamID is different. Display names and avatars can be copied; SteamIDs are unique. Click the profile and check whether they're actually in your friends list. The fake won't be.
Even without that check, the request itself is the red flag. Real friends don't pressure you on Steam for quick favors. They text you, they call, they bring it up on Discord with people who know them. A Steam DM with urgency is suspicious by default, even from someone who looks like someone you know.
The lookalike skin swap
You agree to a trade. The items look right in the chat β the other person shows you a screenshot of what they're offering. You confirm the trade. Later you realize you got a Field-Tested instead of the Minimal Wear they showed, or a Falchion knife instead of a Karambit, or a non-StatTrak in place of the StatTrak they promised.
The trade window is the source of truth, not the chat or the screenshot. Click every item in the trade window before you confirm, and look at the full name, wear tier, float, and StatTrak/Souvenir indicators. If anything doesn't match what was offered, cancel. The cost of cancelling a legitimate trade is "the other person is mildly annoyed." The cost of confirming a swapped trade is losing the items.
Steam Web API key theft
Someone tells you about a useful "trade-checker" extension or a desktop tool that's supposed to make your life easier. You install it. It asks for your Steam Web API key (visible at steamcommunity.com/dev/apikey) β claims it's needed to function.
With your API key, an attacker can intercept your outgoing trades and replace the recipient with their own account. You tap Confirm in your Mobile Authenticator thinking you're sending to a friend; the trade actually goes to the scammer. This works because the API key has more privileges than most people realize.
Never share your Steam Web API key with any third-party tool. If you're not actively using one that needs it, go to steamcommunity.com/dev/apikey and click Revoke. Most people never need an API key in the first place. While you're confirming trades in the Mobile Authenticator, glance at the recipient profile that's shown on the confirmation screen β if it doesn't match who you think you're trading with, cancel.
Phishing sites
Someone sends you a link to log into Steam β to check a trade, claim a prize, verify your account, look at a deal. The URL is steamcomnnunity.com or steam-community.com or steamcornmunity.com or some other variant designed to look right at a glance. The login page is a perfect replica.
You type your password. They have your account.
Two defenses. First, never log into Steam from a link anyone sends you, ever. Always navigate to steamcommunity.com yourself, or use the official mobile app. Second, the Mobile Authenticator makes credential theft alone insufficient β the attacker would need access to your phone too. Which is why "your authenticator broke, here's a tool to fix it" scams target the second factor specifically.
"I sent payment, send the items first"
This one is mostly P2P, mostly with cash or crypto outside a marketplace. The buyer shows you a screenshot of a payment transaction. They tell you the money's on the way. You send the items. The payment never arrives β the screenshot was photoshopped, the transaction never happened, or it was sent to a different wallet and reversed.
Never trust screenshots as proof of payment. Check your wallet directly. For crypto, look up the transaction hash on a block explorer. Wait for the confirmation depth your wallet recommends. For fiat, wait for the actual deposit, not the "pending" status.
The structural fix, again, is escrow. Marketplaces hold items until payment is verified, which is the entire reason they exist. P2P payment-first trades are a recurring source of losses for traders who think they're streetwise enough to handle it. They aren't.
Mobile Authenticator hijack via "helper" tools
A scammer convinces you to import your Mobile Authenticator into Steam Desktop Authenticator (SDA) or some similar unofficial tool, framed as a convenience or a fix for something. The import process requires exporting your authenticator secret β and during that process, the scammer captures it.
Use only the official Steam mobile app for the authenticator. SDA exists and works, but if you don't fully understand what you're doing, the risk of either losing access to your account (you exported wrong) or having the secret stolen (you trusted the wrong tool) outweighs the convenience. The official app is fine.
What to do if you've been scammed
Stop trading. The single most predictable behavior after being scammed is trying to "win it back" with another trade, and scammers count on that. Just stop.
Change your Steam password. Revoke your Steam Web API key. Cancel any pending trades you can. Contact Steam Support β and this is critical β they can only reverse trades that are still within the trade hold window (7 to 15 days), and only if you can prove account compromise. They cannot reverse trades you confirmed in error, no matter how convincingly you were tricked. The Mobile Authenticator's 15-day hold exists exactly for this reversal window.
Document everything before you do any cleanup: screenshots of chat, trade IDs, scammer profile URLs. You'll need them for the support ticket. Then file the ticket and wait.
If the trade has already completed and there was no hold, recovery is extremely unlikely. The scammer's account will get banned eventually, but the items are gone.
The actual defensive playbook
Most of this comes down to a few habits. Trade through escrow-based marketplaces by default, not via direct P2P with someone you met online. Verify what's in the trade window before confirming. Never share authenticator codes or API keys with anyone or anything. Slow down when someone is pressuring you. Assume any DM that claims authority you didn't initiate is fake until proven otherwise.
The Mobile Authenticator is the cornerstone of the rest. Without it, you're at the highest risk tier Steam recognizes β 15-day holds on everything and an attacker who steals your password owns your inventory. With it set up and active for a week, you have both fast trades and meaningful protection against the most catastrophic compromise paths.
The single most reliable defense is letting a marketplace handle the trade. SkinsWave's trade bots handle escrow automatically β no human "trusted middleman" required, no payment-first negotiations.