The Steam Trade That Looks Fine Until Your Skins Are Gone

By Kim Njuki October 17, 2026 Updated: October 17, 2026 4 min read

Of all the ways to lose skins in Counter-Strike 2, one keeps taking people by surprise because it looks, at the moment of confirmation, exactly like the trade they meant to make. It is called the API scam, and it does not brute-force your password. It waits for you to trade, then swaps the destination at the last second.

What actually happens

The mechanism is documented repeatedly and it is consistent across every account of it — this community guide, skin.land, CS.MONEY, and BitSkins all describe the same sequence:

1. You get phished into logging in on a fake Steam page — a "free skins" giveaway, a "tournament" you must join, a "skin checker," or a message from a fake admin.
2. The phished login gives the attacker your session. Their script creates a Steam Web API key on your account, which lets it monitor your trade offers.
3. The script does nothing until you try to trade. Then it cancels your real offer and instantly sends a new one from an account with the same name and avatar as the person you were trading with.
4. You confirm in Steam Guard without checking closely — one tap — and your skins go to the scammer.

The subtle part is that the fake offer often arrives through the API key, so it shows up in your confirmations looking legitimate. CS.MONEY puts the difference plainly: the scammer tracks only high-value trades, cancels the real one, and sends a nearly identical offer. If you accept, you get nothing and your items are gone.

Why you will not get the items back

This is the part people do not want to hear, so it is worth saying directly: Steam's stated policy is that lost items are not returned. The community guide and BitSkins both say the same thing — the skins are your responsibility once you confirm the trade. You can report the scammer's account and it may get banned, but the trade is not reversed. Steam's newer trade protection window can help if the items are still eligible, but it has limits and comes with restrictions. Prevention is the whole game here.

The checklist that stops it

Do these in order, and check the first one today:

• Check your API key page right now. Go to steamcommunity.com/dev/apikey. If a key exists that you did not create, revoke it immediately — that is the surest sign your account was already touched.
• Enable Steam Guard Mobile Authenticator, not email codes. It is the strongest option Steam offers, and it is what unlocks the trade-hold protection that slows this whole scam down. Note: Steam Guard is time-based codes and email codes — Steam does not support passkeys or hardware security keys, so the mobile authenticator is the ceiling, not the floor.
• Never log in to Steam through a link someone sent you. Log in at steamcommunity.com or the Steam client first. Steam's own guidance is that once you are logged in, a third-party site should not be asking for your credentials again.
• Check the trade before you confirm. Look at the profile level, account age, and whether it is actually your friend. CS.MONEY and Blix both suggest the same trick: add a cheap item to the trade so you have something concrete to compare against the offer that appears in your confirmation.
• Regenerate your trade URL if you have posted it publicly or used it on a site you do not fully trust.

If you think you have already been hit

Change your Steam password from a clean device, revoke the API key, deauthorise all other devices in Steam Guard settings, check your trade history, and regenerate your backup codes. Then secure the email account tied to Steam — it is the reset path, and an attacker who holds it can get back in regardless of what you just fixed.

Sources

• Steam Community — CS2: How to avoid being API scammed
• skin.land — What is a Steam API Scam?
• CS.MONEY — What's an API Scam?
• BitSkins — Steam Web API Key Scam
• Blix — What is an API Scam and how do I prevent it?
• Steam Support — Steam Guard
• Steam Support — Account Security Recommendations