A Steam account with a CS2 inventory is worth stealing, and Valve's policy is that Steam Support doesn't restore items that leave an account. The one exception is trade protection, which lets you reverse your own CS2 trades from the last seven days. This checklist covers the settings worth getting right once and the habits that keep the account yours.
The quick version
| Check | Where | When |
|---|---|---|
| Mobile Authenticator on | Steam Mobile app, Steam Guard tab | Once, then keep it |
| Recovery code saved | App, Steam Guard, gear icon | Once |
| Backup codes printed | Account Details, Manage Steam Guard | Once, and after using them |
| Phone number added | Account Details, Contact Info | Once |
| Email account secured | Your email provider | Once, then review |
| Authorized devices | Account settings, Authorized Devices | Every few months, and after any scare |
| API key | steamcommunity.com/dev/apikey | After signing in anywhere new |
1. Turn on the Steam Guard Mobile Authenticator
The authenticator in the Steam Mobile app generates a sign-in code that changes every 30 seconds and can only be used once. It also lets you approve sign-ins by notification or QR code, and it's where you confirm trades and Market listings. Without it, Steam falls back to email codes and email confirmations, Market listings can be held for up to 15 days, and signing in on a new device blocks trading from it for a week.
Valve supports iOS 13 or later and Android 5 or later, and an account can only use one authenticator at a time. Our guide to Steam Guard and trade holds covers the waiting periods in detail.
2. Save your way back in
Losing your phone shouldn't mean losing the account.
- Phone number. Adding one lets you reset your password and move the authenticator by SMS. Valve doesn't accept VoIP numbers.
- Recovery code. In the app, open Steam Guard, tap the gear icon, then Recovery Code. Write it down somewhere safe.
- Backup codes. Under Account Details, choose Manage Steam Guard, then Get Backup Codes. Valve recommends printing them rather than saving them on your computer, and not taking a screenshot. Steam emails you whenever new codes are generated or one is used.
When you change phones, move the authenticator instead of removing it. Moving it costs two days of trading; removing it costs fifteen.
3. Lock down your email
Valve points out that hijackers often target the email account to get into everything linked to it, Steam included. Give your email its own strong password and turn on its two-factor authentication. Steam emails you about security changes on your account, so read those messages and act on any you didn't expect.
4. Use a unique password
Valve asks that your Steam password be different from your email password, and it shouldn't be used anywhere else either. Valve's published minimum (six characters, mixed case and a number) is a floor, not a target: a long random password kept in a password manager is much harder to guess.
Note the difference between changing and resetting. Changing your password from Steam's settings creates no restriction. Resetting a forgotten password through the help site blocks trading and the Market for five days.
5. Review your devices
Steam's Authorized Devices page lists everything signed in to your account. If you see anything you don't recognise, Valve's advice is to use Sign out everywhere. Always sign out fully on shared or café computers. In the Steam client's Security settings you can also tell Steam not to save your credentials on a computer.
6. Check for an API key you didn't create
Open steamcommunity.com/dev/apikey. If a key is listed that you didn't register, someone has had access to your account. Revoke it, then work through step 8. Our article on the API key scam explains how attackers use one.
7. Treat links, codes and downloads with suspicion
Official Steam sign-ins only happen on www.steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com. Never type your password or authenticator codes anywhere else, and never give anyone an SMS recovery code. Steam Support won't ask for them, and Valve employees never contact you through Steam Chat or Discord.
Malware is the other route in. Valve warns it can be disguised as cheats, pirated games, fake demos or betas, voice software and inventory managers, and that some of it is built to slip past antivirus. Only install software from its official source. Our guide to spotting phishing sites covers fake login pages.
The same thinking applies to sites you trade on. CS2Sell, for example, offers authenticator-app two-factor authentication in the security settings of your account, and it's worth turning on wherever it's available.
8. If something looks wrong
Work through Valve's steps for a suspected compromise:
- Review Authorized Devices and use Sign out everywhere.
- Change your Steam password from a device you trust.
- Check your email account and change its password if there's any doubt.
- Scan your computer for malware, including browser extensions.
- Revoke any API key you didn't create.
Then check your Trade History. CS2 items that left in trades during the last seven days can be pulled back with a trade reversal, at the cost of a 30-day trading and Market cooldown; our guide to Steam trade protection explains the trade-offs.
If you've lost access completely, Valve says you can always recover the account through Steam Support, even if someone changed its email, password and phone number. Start from the sign-in help on help.steampowered.com; if self-recovery fails, Steam Support will verify the account is yours, so be ready to provide proof of ownership. Never pay anyone who claims to be holding your account.
Sources
- Account Security Recommendations — Steam Support
- Steam Guard Mobile Authenticator — Steam Support
- Recovering a Stolen or Hijacked Steam Account — Steam Support
- Steam Item Restoration Policy — Steam Support
- Trading and Market Restrictions — Steam Support
- Fake verification pages are stealing Steam accounts from players — Malwarebytes