[ Staff PSA ] -- Steam Accounts Being Phished, SG Accounts Vulnerable

I think it's mainly because most people when they get a message through Steam from a friend they're not processing it with spepticism. Our first thought is probably never, 'is this a bot sending me this message?'

Of course, greed (for a free game) and the subsequent haste doesn't help either.

What surprises me now, is that I thought Steam itself even puts a big warning around any links in chat to try and help prevent these attacks. It's like the phenomenon of stickied threads being the most likely to be ignored. Once people are used to something common they block it out as noise. I do that with certain roadsigns even.

You don't need to be sharp as long as you are cynical. I haven't managed to see even one believable fraud attempt yet and I'm very skeptical there ever will be one, but I guess some people believe ads are true as well.

If you follow a protocol of verifying what you are doing you at least shouldn't fall for these fake sites.

one of the best Tzaars ever seen

:P

An astonishingly high number of people think rape victims deserved it because of their vesture. As long as there's a malicious act, there will be someone blaming the victim and not the perpetrator. It's a sad thing.

"Checking their steam comments board as well may reveal the current state of the account also."
I noticed on several of these accounts as part of the take-over it hides all this information (leaving just the name and avatar on top), maybe because people were warning each other like this?
One of those Steam privacy functions that handidly benefits people who take over accounts like this :/

I had one too, named Eva with a hot girl on profile pic, but previous names were from CSGO free Items and such. Instant block.

"why should all this fall under valve's responsibility?"
cause its allways the responsibility of someone else ;)

I still find it strange that the mobile authenticator and Phonenumber can be deleted that easily without any extra Securitycode. That is the part where valve should take responsibility and change it to something better.

I do agree that the biggest part lies with us. Somehow we still fall for the free games. it's greed ain't it.

Why should it fall under Valve's responsibility? Because a company is responsible for the security and safety of its users, period. By going off of your question / statement alone, one could then argue, why have two step authentication, why have SSL certificates, why should the company have any checks in place? Why? Because it is good practice, especially if you want to keep a confident client base.

I already stated what else they should do, verify with the user that the changes they are making are authorized. You couldn't put a hole in that, so you didn't argue that point. The other points, yes I can see how there could be ways for events to fall through the security checks, like the scenarios you brought forth.

If a company wants to simply tell a user that their information has been changed and to contact support if it was not authorized, they better well have a much better turn around time than 25 hours (in my case). Within that time frame, there could be quite a bit of damage to the account.

You cannot trust end users to be savvy, smart, or to do anything that does not require explicit interaction. Even myself, who is very computer and internet savvy, can have a "brain-fart" and not do the due-diligence that is required.

By having in an extra step to state to verify your changes, it would have mainly kept this scam from sweeping across the Valve user base. It is a simple extra step, and I doubt any user would complain about having to click a confirmation link in an email rather than lose control of their account. Other companies have this extra step, even some with the inclusion of having a two-factor authentication, and it works quite well.

Edit: Additionally, just so you know I'm not just here here to complain about policies and not take any action. I did bring up everything I stated in this thread with Valve directly within my support ticket. That's really the only place my ideas or suggestions really matter, because it will be up to them to decide to change policies and adjust the quality of security for their customers.

Edit 2: I do agree with you on the auth change!!

Lost nothing. Luckily the removal of the authenticator initiates a 14 day cool down on trades, etc.

Reported the account to Valve, but I won't be holding my breath that they actually do anything about it.

The thing that makes me shake my head is that the fact that my account has always connected from AU and then a sudden change of password and removal of the authenticator from a Russian connection is not enough to trigger an automatic lock. It's my own stupid fault that it happened and the fact I was hung over and half asleep is no excuse.

thanks again, we all owe you a lot :)

I got it from the first one :D so I wonder who "gave" that to him

around 42 hours

Just one ticket got my account back. Still following up on the Steam wallet ballance
Make sure you provide all the information they ask for, otherwise it will take longer, as they will need to ask you questions.

Looks good...no Steambucks gone, cards all still appear to be there, etc. Game count is slightly lower, but I think that they restore from logs, so it probably dropped all of my free games. If that's the worst that happened, all is well.

I've been logging in to check my credit card for weird activity (because they could have charged it for Steambucks and then bought things as gifts), but there was nothing there. Not sure if someone was just trying to prove something or what.

Regardless, if this had been someone trying to steal things, they would have had 1.5 days to clear things out of my account before Steam did anything about it. Their support is just not acceptable for a company of their size and income. If you're going to be the market leader, you need to act like it.

I will say that the support person that I got (via message in the ticket only) was nice and knew what they were doing, so that's good. But it's just terrible that I can't jump on the phone and alert someone right away to stop the problem before it gets worse. This could have been completely solved in an hour or two, and instead it's still going on as they slog through this one email-based ticket at a time.

Happy to be back, in any case. :)

About 36 hours :(

And that was after hitting them on Twitter and Facebook to pressure them about 10 times

they probably wanted to sell my inventory stuff, but because they had to remove steam guard, there is a 14 day trade/market restriction :)

Ow, and apparently I was added to a blacklist yesterday x)

Damn those scammers xD