An API key scam starts with a phishing page. You type your Steam login and Steam Guard code into a fake site, often one that promises a free skin, a vote for a team or a trade check. The scammer uses that login to register a Steam Web API key on your account. Nothing looks different. You can still log in, and your items are still there.
The trap springs later, when you send a real trade offer to a friend, a marketplace bot or a buyer. The scammer's script sees the offer through your API key, cancels it, and sends a new offer with the same items from an account that copies the real recipient's name, avatar and profile. You confirm on your phone, thinking it is the offer you just made, and the items go to the scammer.
How do I know if I am a victim of an API key scam?
The clearest sign is two trade offers in a row for the same items, where the first is cancelled and you did not cancel it. Another sign is a confirmation on your phone for an offer to an account that is not on your friends list, or whose Steam level does not match the real trader. Finally, a key you did not create on steamcommunity.com/dev/apikey confirms it.
How do I remove an API key scam from my account?
Revoke the key on the API key page, change your Steam password, and use the option to deauthorize all other devices. Check that your Mobile Authenticator is still yours. Then look at your trade history. If items already left in the last 7 days, you can reverse those trades through CS2 trade protection, which also locks the account for 30 days.
To avoid the scam, never log in through a link someone sent you, and read the recipient name on every phone confirmation. Marketplace bots show their exact account name on the site, so compare it before you confirm. Paste any link you are unsure about into the scam link checker before you click.