What does a scam CS2 trading site look like?
A scam trading site looks like a real one. That is the whole point. It has a modern design, a live-looking price feed, a Steam login button, and often a copied logo and name from a site you have heard of. The difference is in what happens after you click.
Scam sites make money in a small number of ways, and each way leaves a mark you can learn to see. This guide gives you a checklist you can run in two minutes before you log in anywhere, then explains what each check catches. If you want a faster first pass, paste the link into our scam link checker and then come back here for the rest.
Valve's own Scam FAQ sets the tone for all of this: "Once you confirm a trade offer, there is no way to reverse it." The only partial exception is the 7-day trade protection window for CS2 items, which we cover at the end. Prevention is the strategy.
What are the biggest red flags on a trading site?
Any one of these is a reason to close the tab. Several together is a certainty.
| Red flag | What it usually means |
|---|---|
| The Steam login opens on a domain that is not steamcommunity.com | Fake login page built to take your password and Steam Guard code |
| The site asks you to paste or create a Steam Web API key | Setup for an API key scam that swaps your trade offers |
| The site asks for your Steam password, authenticator code, or recovery code | Direct account theft |
| "Free skins", "free knife", or a giveaway you can only claim by logging in | Bait for one of the above |
| A stranger sent you the link, especially with a story about voting, a tournament, or a prize | Classic phishing route |
| A "middleman" or "escrow admin" contacts you to hold items | Valve's Recommended Trading Practices say to avoid middlemen entirely |
| You are asked to send your items first and get paid or receive items later | No mechanism forces the other side to follow through |
| The domain is days or weeks old, or a lookalike of a known name with one letter changed | Clone site |
| No company name, no legal pages, no way to contact a human | Nothing to hold accountable |
| Pressure: countdown timers, "offer expires", "your account will be banned unless" | Valve lists pressure and threats as the mark of a con |
Nothing on that list is about how the site looks. Looks can be copied in an afternoon. Behavior is harder to fake.
How do you check a site before you log in with Steam?
Here is the checklist. It takes about two minutes the first time and is much faster once you know what you are looking at.
- Look at the address bar, not the page. Read the full domain. Watch for extra words, swapped letters, and unusual endings. A padlock only means the connection is encrypted, not that the site is honest. Scammers get padlocks too.
- Click "Sign in through Steam" and stop. Before you type anything, read the new tab's address. The real page is on steamcommunity.com. Valve's Account Security Recommendations list the only official login domains: steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com. If the login page is anywhere else, close it. Our guide on fake Steam login pages shows what the fakes look like.
- Find the company. Real marketplaces name a legal entity and a country, and usually have terms, a privacy policy, and a support address. A missing "about" section is a bad sign.
- Search the name plus "withdrawal" and "scam". You are looking for people describing real cash-outs and real problems, on sites the marketplace does not control. A wall of five-star reviews with no detail is worth nothing.
- Check how you found it. A link from a friend's account, a Steam comment, a Discord DM, or a YouTube description is a weaker starting point than a site you found through our marketplace pages, where each listing shows what we verified and when.
- Look for the API key ask. Any page, popup, or "setup step" that mentions your Steam Web API key is a stop. Real marketplaces work from your trade URL and the Steam login. Read Steam API key scams to see why this one is so common.
If it passes all six, it is worth a small first trade. Sell one cheap item and withdraw before you move anything valuable.
How do scam sites actually take your skins?
There are really only four mechanisms. Every scam site uses one or more of them.
1. Fake Steam login. The site's "Sign in through Steam" button opens a page that looks exactly like Steam's, but is hosted by the scammer. You type your username, password and Steam Guard code. They now log in as you. The real Steam login never gives a third-party site your password, which is why the fake one has to imitate it.
2. API key harvesting. The site walks you through creating a Steam Web API key and pasting it in, or it uses a stolen login to create one for you. With that key, a script can watch your incoming trade offers, cancel the real one, and send you a copy from a lookalike account. Valve describes this on its trade redirection page, and notes the API key is not even required if the scammer already controls your account or computer.
3. Trade redirection. You are about to send your item to a marketplace bot. A hijacker who has access to your account cancels that offer and creates a new one to an account with the same name and avatar. If you confirm the new offer on your phone without reading it, the item goes to them. Valve's page on this scam says the fix is simple: "Always use all the information in the confirmation window in your Steam Mobile Authenticator to double check the trade you're confirming is the trade you intend to complete."
4. Plain trust scams. You send first. The site or person never sends back. Or a "middleman" holds both sides' items and keeps them. Valve's Recommended Trading Practices cover these: do not trade for money, do not trade for nothing expecting a later trade, do not lend items, avoid middlemen.
Notice that mechanisms 1 through 3 all need you to either type credentials somewhere you should not, or confirm a trade without reading it. Those are the two habits to fix.
What should a legit site never ask for?
A real marketplace needs exactly two things from you to trade: a Steam login through Steam's own page, and your trade URL. It may also need identity documents to pay you, which is a legal requirement in many places and only comes up at withdrawal.
A real site never needs:
- Your Steam password
- Your Steam Guard code or your authenticator recovery code
- Your Steam Web API key
- Remote access to your computer, or for you to install a "trading helper" program
- You to send items first as a "test" or "verification"
- You to reverse a trade so they can "re-send" it
That last one is newer. Since July 2025, CS2 items received in a trade are locked for 7 days and the sender can reverse all recent trades, per Valve's Trade Protected Items FAQ. Some scammers now try to talk victims into reversing trades or claim Steam requires it. Nobody from Steam will ever ask you to do this in chat. Read trade protection and reversals explained for how the feature really works.
Also, the site does not need to message you on Discord. Valve's Scam FAQ says anyone talking to you about your account or items through Discord, Steam Chat or any system other than the Steam Support site "does not represent Steam and should be blocked." Marketplaces with real support use a ticket system on their own domain.
What do you do if you already logged in to a scam site?
Act in this order. Speed matters, but order matters more.
- Change your Steam password from a clean device. If you typed your password on a fake page, treat it as stolen.
- Sign out everywhere. Go to your Steam account's authorized devices and use the "sign out everywhere" option, as Valve's security page recommends.
- Check your email and phone number on the account. If either changed, recover the account through Steam Support first.
- Revoke your API key. Go to steamcommunity.com/dev/apikey. If a key exists that you did not create, or you created one for the site, revoke it.
- Scan for malware. Valve's security page warns that malware aimed at Steam often hides in cheats, cracked software and "inventory managers", and may wait until your account is worth robbing.
- Check your Trade History. Look for trades you did not make. If there are any from the last 7 days, you can reverse them yourself. It undoes every recent trade and gives you a 30-day trade and market cooldown, but it gets the items back.
- Report the accounts involved. Use "Report Player" on their Steam profiles. Valve's reporting guide says a community report is faster and more useful than a support ticket.
If nothing was taken, you still do steps 1 through 5. The scammer may be waiting for your inventory to be worth more.
Our full recovery checklist is in how to secure your Steam account.
How do you check a trade offer before you confirm it?
This is the habit that beats trade redirection and most bot impersonation. Do it every single time, including with sites you trust.
When the confirmation appears in the Steam Mobile app, read all of it:
- The account you are trading with. Check the name, the avatar, and the account details Steam shows. Two accounts can share a name and avatar. They cannot share an account age, Steam level, or the length of time you have been friends, which Valve's trading practices page points out the offer shows.
- The items leaving your inventory. Count them. Match them to what the site said it would take.
- The items coming in. For a sale, this is usually nothing, which is fine. For a trade, hover each one and check the wear, float and stickers match.
- Timing. If a marketplace offer arrives when you did not just click "sell", or a second offer appears right after the first was cancelled, stop and check the site.
If anything is off, decline it and check the site in a fresh tab. An honest marketplace will just send it again.
The trade hold calculator is useful here too: if an item shows as locked and a site claims it can trade it now, the site is wrong or lying.
Which warning signs matter most?
If you remember nothing else from this page, remember three things.
The login domain. Every credential theft starts with a login page that is not Steam's. Read the address bar before you type.
The API key ask. No honest trading site needs it. Any mention is a stop.
The confirmation screen. Read the whole thing, every time. It is the one place where a redirected trade is visible before the item is gone.
Everything else on this page, the domain age, the reviews, the company details, the pressure tactics, is about spotting a scam site early. Those three habits are about not losing your items even if you end up on one.