CS2 trading scams explained (and how not to get scammed)

The workhorse of skin theft is a website that looks like something a trader would use: a trading site, a gambling site with a free promo code, a tournament signup, a screenshot or inventory-value tool. It asks you to "sign in through Steam." The login page is a replica, and everything you type goes to the scammer.

The nastiest variant harvests your Steam Web API key. With it, scammers can watch your real trades, cancel a legitimate incoming offer, and instantly re-send an identical-looking offer from a bot account cloned to match the real one, so the trade you re-confirm sends your items to them. If you have ever logged into a dubious site: deactivate your API key in your Steam settings, change your password, and check your active sessions. As standing hygiene, treat any request to log in via a provided link as hostile, bookmark the real sites you use, and be suspicious of any trade partner who suddenly needs you to "verify" anything on an external site.

Scammers impersonate whoever you would trust: a server's verified middleman, a staff member, a well-known trader, or a "Steam admin" (the classic: an official-sounding account claims your items are flagged for fraud and must be handed over or duplicated for inspection; Steam staff never do this, ever). The disguise is usually a copied avatar and a name one character off from the real one.

The defense is mechanical, not intuitive: identify people by their profile permalink or long-form ID, never by display name and avatar, both of which are freely copyable. In a well-run server, verified middlemen carry an unmistakable role, are listed in a pinned directory, and never DM first. Anyone claiming a role should be checkable against that pinned list in seconds; anyone resisting that check has answered your question.

Some scams live inside the trade window itself: an item swapped at the last moment for a lookalike of a fraction of the value (same skin, different wear or pattern), an agreed two-part deal where the second offer never comes ("I will send the rest after"), or an overpayment story that ends with you refunding real value for a reversed or worthless payment.

Defense: read the final offer contents as the entire truth of the deal, regardless of what was said in chat. Verify the exact item, wear, and pattern in the offer window. Never do multi-stage deals on trust with strangers; that is precisely what middlemen exist for. If the deal changed shape at the last second for any reason, stop: renegotiation-at-confirmation is the tell.

Reputation is the trading world's currency, so scammers manufacture it: vouch-trading rings in small servers, screenshots of "completed trades" (trivially faked), and long-game accounts that trade honestly at low value until a big fish bites. Treat rep as strong only when it lives in a server whose rep channel has integrity rules (vouches only for completed trades, fake-vouch farming instantly bannable) and when it is proportionate: fifty small vouches do not underwrite a knife-tier trade. For high-value deals, the answer is not more rep reading, it is a verified middleman.

If you run a trading community, most of these scams need your server's stage to work, and structure takes the stage away: an allowlist for links (kills shape one), a pinned verified-middleman directory with a never-DMs-first rule (kills shape two), pinned trade-format rules that normalize checking offers (blunts shape three), and rep-channel integrity rules (blunts shape four). We wrote a full companion guide to moderating trading servers.

The last layer is the watching, because every shape above arrives as friendly, well-written messages that no keyword filter will ever flag. That is the layer our AI moderator Staffd covers (disclosure: we make it): it learns your server's structures and rules, reads conversations in context, and flags the pattern (the too-helpful newcomer, the almost-right link, the pressure tactics) to your staff before the trade completes, with a human making every call. Scams are a social-engineering problem; the defense has to understand the conversation, not just scan it.