Avoiding CS2 skin scams: the survival guide
CS2 skins are worth real money, so they attract scammers. Most thefts do not rely on sophisticated hacking but on manipulation: you are pushed to click, to sign in at the wrong place or to trust too quickly. The good news is that a few simple rules keep you clear of almost every trap. Here are the 8 most common scams and how to recognise them.
The golden rule in 4 points
- Only sign in to Steam on
steamcommunity.comor in the official Steam app. - Never give your Steam API key, your password or a Steam Guard code to anyone.
- Never buy or sell a skin for money outside a marketplace.
- Check every trade offer in the Steam app before confirming it: recipient, items, account creation date.
1. The Steam API key scam
This is the most dangerous scam, because it is invisible. A fake site gets you to sign in with your real Steam credentials, then creates a Steam API key on your account. With it, a bot watches your trade offers. When you sell a skin on a real marketplace, it cancels the offer and immediately replaces it with an exact copy, sent by an account imitating the site's bot (same name, same avatar). You confirm, and your skin goes to the scammer.
How to protect yourself:
- Go to
steamcommunity.com/dev/apikey: if a key exists and you did not create it yourself, revoke it immediately, change your password and sign out of all other devices. - Be wary of a cancelled offer that reappears a few seconds later, and of a "bot" account created a few days ago.
- No serious marketplace needs your API key for buying or selling.
2. Fake sites and fake login pages
Some sites copy the look of a well-known marketplace with an almost identical address (one extra letter, a different ending). Others show a fake Steam login window that looks like the real one but sends your password to the scammer.
How to protect yourself: type the address of the sites you use yourself, or use your bookmarks. Before entering your password, check that the address bar really shows steamcommunity.com. Never click a link received by private message to "claim a gift" or "verify your account".
3. The fake admin or fake support agent
Someone claims to be a Valve administrator, a moderator or a marketplace's support. They explain that your account has been "reported" or that your items need to be "verified", and ask you to send them over temporarily.
How to protect yourself: Valve and marketplaces never contact players by private message to ask for items. Nobody needs to receive your skins for a verification. Block and report the account.
4. The fake middleman
For a trade between individuals, the scammer suggests going through a "trusted middleman" who will hold the items. The middleman is actually their accomplice, or an account imitating a well-known person.
How to protect yourself: to trade or sell with a stranger, use a marketplace that secures the transaction. A middleman found on Discord offers no guarantee.
5. The QR code and fake votes
A friend (whose account has been hacked) asks you to "vote for their team" in a tournament, or to enter a giveaway. The page asks you to sign in with Steam by scanning a QR code. By scanning it, you are actually authorising a login to your account from the scammer's device.
How to protect yourself: never scan a Steam login QR code that does not come from a page you opened yourself on steamcommunity.com. Always read the device and location shown in Steam Guard authorisation requests, and refuse any login you did not start.
6. The direct sale followed by a reversal
Since July 2025, a CS2 item trade can be reversed for 7 days. Scammers take advantage: they sell you a skin directly, for a bank transfer or a PayPal payment, then reverse the trade and get the item back. You lose both the money and the skin. Full details in our guide to the 7-day trade protection.
How to protect yourself: never buy a skin for money outside a marketplace.
7. Fake "escrow" services and sites that vanish
Sites or Discord servers present themselves as secure escrow services, take deposits, then block withdrawals and disappear. Even well-known platforms can shut down: BitSkins ceased trading at the end of June 2026 with withdrawals blocked according to several sources, and GamerPay closed at the end of May 2026.
How to protect yourself: favour marketplaces that have been around for several years, with a real volume of verifiable reviews. Don't leave a large balance sitting there: withdraw as you go. Our marketplace comparison lists the sites we track, with their reputation.
8. Gambling in disguise
Case sites, roulette, "crash", "coinflip", "upgrades"… They promise rare skins for a few euros, but they are gambling. Many are not licensed (in France, for example), many are accessible to minors, and the expected return is negative: on average, you lose. We list none of these sites, even when they offer higher commissions.
If you've been scammed: what to do right away
- Change your Steam password and sign out of all other devices (Steam, Settings, Security).
- Revoke any unknown API key at
steamcommunity.com/dev/apikey. - Check Steam Guard: turn the mobile authenticator back on if it has been disabled.
- Report the scammer's account on their Steam profile.
- Contact the marketplace's support if the transaction went through a site, with dates and screenshots.
Be aware that Steam Support generally does not restore items that have left your account, even in the case of a scam: prevention is your only real protection.
FAQ
Does a marketplace need my Steam API key?
No. For buying or selling, a serious site only needs your Steam login (on steamcommunity.com) and your trade link. A request for an API key is a red flag.
How can I tell if a trade offer is a scam?
In the Steam app, check the recipient account (name, level, creation date) and the exact list of items, and be wary of a cancelled offer that immediately reappears. If any detail doesn't add up, decline.
Can Steam give me back a stolen skin?
Generally, no: Steam Support does not restore items that have left an account. That is why you need to secure your account first.
A friend asks me to vote or scan a QR code: what should I do?
Be careful, even if the message really comes from a friend's account: their account may have been hacked. Don't scan any login QR code, and only sign in to Steam on steamcommunity.com. Warn your friend another way, for example by phone.
Are case-opening sites scams?
They are gambling, often unlicensed and accessible to minors. Even when they pay out, you lose money on average. Best avoided.