Platform security hub

Steam account security

Steam accounts are targeted because they hold games, payment methods, and — for many players — years of progress. This page lists the official domains, the two-factor options, the recovery path, and the scams that most often cost Steam players their accounts.

Quick security checklist

Enable two-factor authentication. Steam Guard Mobile Authenticator (time-based codes) and Steam Guard email codes. Steam does not support passkeys or FIDO2 hardware keys — the mobile authenticator is the strongest option.
Only trust the official domains below for sign-in and support.
Save the recovery path before you need it — recovery is fastest when you already know the official process.
Learn the common scams listed below so you recognise them before they cost you the account.

Official domains

Only trust these domains for Steam sign-in and support. Lookalike domains are a common phishing trick.

steampowered.comsteamcommunity.com

Two-factor authentication

Supported — Steam Guard Mobile Authenticator (time-based codes) and Steam Guard email codes. Steam does not support passkeys or FIDO2 hardware keys — the mobile authenticator is the strongest option.

Account recovery

If your account is stolen, follow our verified, step-by-step guide:

Steam account recovery guide →

Official links

Account recovery ↗Steam Guard (2FA) ↗Sign in ↗

Known scam patterns

Fake item or trade offers that redirect to a login page
"Free gift card" or "free game" direct messages
Fake Steam Support messages asking for your password or Steam Guard code
Third-party trade sites that ask for your API key

Frequently asked

How do I avoid Steam phishing scams?

Only sign in on the official domains listed above. Steam will never ask for your password or two-factor codes over chat, email or DM. Any message claiming your account is "limited" or "deactivated" with a login link is phishing.

Is my Steam account at risk?

Account-takeover risk is highest when two-factor authentication is off, when you reuse a password, or when you click a fake login link. The single highest-impact fix is enabling 2FA and using a unique password.

What do I do if my Steam account is hacked?

Secure your email first, then follow the official Steam recovery guide. Never pay a third party to recover it — recovery is always free through Steam support.

Reviewed for accuracy; always confirm on the official Steam site. Capabilities not listed are not asserted here.