Before signing in
Type or use a saved bookmark for the operator’s exact official domain. Inspect spelling, the top-level domain and the secure connection before choosing Steam sign-in. A lookalike page can reproduce logos and layout while sending credentials elsewhere.
Steam OpenID sign-in should take place on a Steam-controlled domain. A third-party page should not ask you to type a Steam password directly into its own form.
Before opening the offer
Read what the site says it will send or receive, the quoted balance and the expected trade partner. Keep the site page open, but treat the Steam trade offer as the final source of truth.
If an offer arrives unexpectedly, stop. Do not approve it because a chat account, moderator impersonator or countdown says it is urgent.
Inside the Steam confirmation
Verify the account identity and inspect every item moving in both directions. Steam’s guidance emphasizes confirming that the correct person and complete contents are shown. A deposit commonly sends items without receiving Steam items in the same offer, so the external site’s promised balance exists outside Steam’s trade protections.
Read warnings shown by Steam. Do not rely on a profile name or avatar alone; impersonation accounts can copy both.
Trade redirection and API-key risk
Steam documents trade-redirection scams in which a compromised account cancels an intended offer and substitutes an offer from an impersonation account. The final mobile confirmation may therefore differ from the offer a user thought they created.
An API key should never be shared. If an unknown key exists or account compromise is suspected, revoke the key through Steam, change credentials from a trusted device, deauthorize other sessions and contact Steam Support.
After confirmation
Save the Steam trade ID and the operator transaction reference. Check that the site balance or withdrawal status matches the exact completed offer. Contact the operator through a support route reached from the official domain if the records disagree.
A 60-second final-confirmation routine
Pause before touching the mobile confirm button. Reopen the transaction from Steam rather than a chat link, then read the partner and both item columns from top to bottom. Compare them with the operator transaction still open on the verified domain. If the expected trade was cancelled and a near-identical one appeared, treat the replacement as hostile until independently explained.
For a deposit, Steam may correctly show that you receive no Steam item in return. That is precisely why the external balance promise deserves extra scrutiny: Steam can show what left the inventory, but it cannot enforce a later credit on another service. Save the quote and transaction ID before confirming.
Stop immediately when any one detail changes
- The partner account is not the one displayed for the transaction.
- An item was added, removed or replaced after the first review.
- A message claims Steam Support needs a verification trade or private code.
- The login page is outside an official Steam domain.
- An extension, executable or screen-sharing session is required to “unlock” the offer.
- The mobile confirmation conflicts with the desktop summary.
Do not send a second item to recover the first. Pressure, countdowns and threats of an account ban are persuasion tactics, not evidence that the offer is valid.
If you suspect account compromise
End the conversation and use Steam Support from a manually opened official address. Steam's current account-security guidance recommends reviewing authorized devices, signing out elsewhere when something looks wrong, changing the Steam password, securing the connected email account and scanning the device for malware. Revoke an unknown Web API key, but do not assume that key revocation alone repairs a compromised computer or session.
Preserve the trade history and relevant messages before deleting anything. The support evidence checklist explains how to record times and identifiers without sharing a password, authenticator code, session cookie or private wallet material.
Final-confirmation safety record
The final Steam confirmation is the authoritative item-transfer screen, even when an external site initiated the request.
| Field | What to record | Why it matters |
|---|---|---|
| Domain | Exact saved operator and Steam domains | Reduces lookalike-login risk |
| Trade partner | Account identity and expected route | Helps detect substituted offers |
| Item list | Every item moving in each direction | Prevents approval based on a summary |
| Account security | Authenticator, sessions and API-key status | Surfaces common redirection conditions |
Interpretation: Stop when the final confirmation differs from the expected account or items. Urgency is not evidence that a changed offer is safe.
For pricing and inventory questions, continue with how Rust skins are valued. For a broader account review, use the Rust gambling safety checklist.