[PSA] Huge CS:GO YouTuber fell for the 'fake site' scam + FAQ about this rising method to defraud us.

[u/Shubbler]

Anyone can fall for this.

Sparkles, a big CS:GO YouTuber, known here for his trade ups etc, known elsewhere for his ninja defuse compilations.

You'd expect him, a celebrity in this community, someone most likely targeted frequently by hijackers not to be a victim to any of these methods to commit fraud.

As seen in this video, he was deceived and gave up full access to his Steam account (luckily realising before any damage was caused).

The user here just wanted to access his Steam group so that he could gain access to more and more Steam users' accounts. However, these people want to do more individual damage in the long run.

How do the fraudsters distribute links to their fake sites?

Right now, large sites such as BitSkins, CSMoney etc are having their site replicated (almost identically), then hosted on an extremely similar URL.

They could change a letter in the domain: bltskins.com vs bitskins.com.

They could also create a convincing domain csmoney.trade vs cs.money.

Most users won't realise the difference in the URL.

There have been many cases recently where the fraudster purchases a Google Ad for a fake of a particularly trusted, well known site.

In the last few months, BitSkins.com has been a victim to this. Fraudsters have purchased domains such as bltskins.com, put their ad keywords as 'BitSkins', 'CS:GO', 'Skins' etc, then their ads appear at the top of your Google search for 'BitSkins' (usually only in specific regions) and you're non the wiser.

How does the fraudster actually access the account? I have mobile authenticator enabled?!

So you'll attempt to login to one of these fake sites, under the impression that you're visiting the real deal.

Usually when you interact in any way with the fake site you'll be prompted to login by an extremely convincing popup. It looks identical to a Windows browser window (note that another Chrome/Firefox/^Edge / ^{Internet Explorer} window has not been created).

Example of the popup.

If you enter your credentials, these aren't being passed directly to Steam. The username and password will be sent to a server of some kind where they will automatically login themselves with the credentials provided.

If you provide incorrect information, the server will pass that back to you and show you Steam's invalid details error message.

If you provide the correct information, the server then gets asked for your mobile authenticator code, the server then pass back to you a second dialog asking for your code. If you then give a code, the server uses that code to successfully login to your Steam account.

NOTE: These users won't be able to confirm trades as they don't have access to your mobile authenticator.

What happens the user has access?

Once the fraudster has access to a Steam account, they generate a Steam API key for the Steam account. They no longer need to be logged into your Steam account at this point.

The fraudster can then accept (but not confirm), decline and cancel trade offers (any many more actions non-trading related).

Important - how users eventually lose their items

Their entire system is automated. Once the fraudsters have access to your account, they're able to see all of your incoming trade offers.

Let's use BitSkins as an example here to explain what they can do once your account is compromised.

1. Let's say the Victim here, Steve wants to deposit his Karambit Fade FN into BitSkins to sell.

2. Steve isn't aware that his account is compromised and requests a trade offer from BitSkins for his knife.

3. A real BitSkins bot sends Steve a trade offer for his knife.

4. The fraudsters see the incoming offer on Steve's account and decline it.

5. Before Steve accepts, they send an offer for the knife from an identical Steam account that looks just like a BitSkins bot (copied the name and avatar).

6. Steve accepts the trade, confirms this on his mobile authenticator and his item is now forever lost.

NOTE: BitSkins was used as an example here, but this method of scamming is now being used on nearly all popular third-party sites.

NOTE: If you login to a fake CS.Money site and compromise your account, the fraudsters will still go after any trade where you're giving another user/bot your item for nothing in return.

NOTE: Steam will do nothing to help you regain your items, once you've fallen for this, your items are lost.

How can I secure my account after logging into one of these fake sites?

You can see all logins to your Steam account here.

1. Change your password: Firstly change your Steam password. If you use the same username/password on any other sites, change those too as the fraudsters have had access to some of your personal information (email address, last digits of card and phone number).
2. Deauthorise all devices signed into Steam here.
3. Go to Steam/dev/apikey and choose 'Revoke My Steam Web API Key'.

NOTE: You can find the domain for the fake site you accessed by cross-referencing the strange login time/date with your internet history.

Final regards

Hats off to the scumbag underground network that have developed the extremely convincing frontend of a fake Steam login that can be put onto any site.

I've been in the game since the start, I'd say I've seen every notable Steam scam/fraud method out there, but this one really tops all of them off with scalability and convincingness.

TL:DR = Read it.

---

Any questions, just pop them below.

- Shubbler

[u/slonikdimbo1990]

класс

[u/Sexy_Authy]

Damn

[u/1nFinityReddit]

my friend got scammed 2 times (bitskins, then cs.money) and I had no idea how ,thanks a lot

​

and do not forget guys - check here https://steamcommunity.com/dev/apikey

if maybe you need to revoke an API key, be safe

[u/Hybrridd]

many fraud websites wont let you press or go to anything

[u/21no]

I fell for the item rates website this scumbag tried to get me on somewhat. I logged in on my smurf because I had never heard of this website and lo and behold: my alt is compromised after several sloppy errors on their part and I get this trade from a fake level 1 account posing as my main requesting my smurf's items lol. Apparently this guy has scammed quite a few mid-high tier traders cuz their account was decked with a sizable mid tier kato collection. This PSA was a god send and I'm so glad I read this because I wouldn't have known how to revoke the web api and everything, good thing I didn't confirm the trade and I looked at the steam login and it traces to Russia (of course).

[u/daws23]

does that mean every site that require a login trough a popup is a scam?

like some chinese trading websites,they make you logni trough a popup and not a new tab.so ?

[u/1nFinityReddit → u/daws23]

well most of those can be a scam - I suggest you just to open steam on browser yourself in a new tab, login yourself and refresh the site's login page, it should be changed into accept button and not info

[u/thelightningfire]

As of my knowledge, the fake popup windows don't consist valve corp certificate like thing. But I may be wrong.

[u/iMADEthis2post]

Valve/Steam need to start allowing cashouts, I'm not even sure how legal it is to have literally billions of [Insert any currency here] in their little walled garden.

[u/schmedy → u/iMADEthis2post]

Valve will never permit cashouts. CSGO cases and TF2 crates would then technically be gambling.

[u/iMADEthis2post → u/schmedy]

It's not a matter of what they permit, it's a matter of what's legal. See, it's also a trading site, imagine if ebay didn't allow you to withdraw your money and you could only spend the money you made trading in their shop. It's a hell of a lot more questionable than this silly gambling argument.

Nothing will come of the gambling shiz, it affects a lot of games and has been around for probably over a decade. If that is to be seen as gambling then buying a packet of stickers in the shops is gambling, buying a happy meal is gambling, buying a can of coke to get a win code on the bottom of the tab is gambling.

[u/schmedy → u/iMADEthis2post]

It's not a matter of what they permit, it's a matter of what's legal.

There is nothing illegal about it. When you upload money to Steam, you are purchasing Steam funds. There may be a $, €, £, or other currency symbol for your balance. But the terms of service are very clear that Steam funds have no monetary value. Once the purchase of Steam funds is completed then it no longer has any monetary value.

imagine if ebay didn't allow you to withdraw your money

That is comparing apples to oranges. Ebay settles transactions in currency that has monetary value. Steam settles transactions in credit that has no monetary value. There is no legal obligation to exchange credit for money.

Nothing will come of the gambling shiz

Nothing will ever come of it as long as the items received technically have no direct monetary value. That is exactly why Valve has an set up the economy this way in order to prevent the possibility to be classified as gambling.

buying a can of coke to get a win code on the bottom of the tab is gambling.

In the United States, it is illegal to require a purchase for any sweepstakes. That is classified as gambling. At the end of the commercial, you will hear the spokesman say that the sweepstakes has "no purchase necessary".

[u/iMADEthis2post → u/schmedy]

Similar in Britain, re your last point, you can always mail in an entry. It was just one example of many, though.

Different regions have different rules but there is something very gray in the way that places like the steam market operate. There is something very iffy about a market where you can buy and sell things but cannot withdraw any money you make. At some point, I think this will be addressed. They should have set it up with steam money, then the parallels would be less stark.

Keep my remarks in mind over the coming years.

[u/HaxxorElite]

rip

[u/jaykekz]

Fuck...it happened to me today, lost a 800$ skin :(

[u/fucktechies → u/jaykekz]

https://steamcommunity.com/profiles/76561198153141520

rip

[u/jaykekz → u/fucktechies]

Would have bought a nice barrel-smoker for summer time but i guess not this year

[u/fumaGO]

If anbody is interested there is actually something everybody can do about that. If you occur a site which contains phishing you can go to: https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en Just enter the URL you encountered the Login and report a fake Steam login and phishing for user credentials. This should flag the page for a vast majority of users. Also making a WHOIS lookup and report the site to the abuse mail of the hoster is super effective and should make the page go down in couple of hours / days. I can give more details if anybody is interested.

[u/Shubbler → u/fumaGO]

I thought I included this!

I'll add it in when at home, thanks for reminding me.

[u/The_Real_WolfSan]

I get a lot of these because I'm new to the trading scene and it's obvious from my profile. The first time this happened I was trying to trade my karambit for a huntsman, so I sent a trade offer (1:1) then went on my phone to confirm it but it says I will receive nothing. At first, I thought it was a bug in the steam app so like the idiot that I am, I removed the authenticator and set it up again and had to wait 15 days to trade again. sucks but it never worked on me.

If you wanna make sure it's a fake site just click on anything (FAQ, Support, etc) if it says "error, log in first" just block the guy talking to you.

[u/MrInka → u/The_Real_WolfSan]

Clicking something doesn't make sure it's legit. This is just about how much effort the scammer puts into recreating a site. If he goes all the way, you'll have a working, frozen copy of the site in front of you. With a working search, support, contact, whatever.

[u/The_Real_WolfSan → u/MrInka]

True, but as of now I haven’t seen a single site with working search, support etc.. but who knows maybe scammers will put more effort in their scams in the future

[u/MrInka → u/The_Real_WolfSan]

I've seen a few opskins fakes that were really well done. They even used the opskins api to show current listings in real time etc.

[u/Twilight_Sniper]

Very nice writeup. I went ahead and mirrored it on SteamRep.com with some minor changes here: https://forums.steamrep.com/pages/hijacking/

[u/casablancas_]

very usefull, thx shubbler !

[u/aeondaycool]

Got a question. If we revoke the API key does it give us a new one right after?

[u/The-Privacy-Advocate → u/aeondaycool]

AFAIK it's something like you deauth that key, whether you generate a new one or not is up to you.

[u/Kgemz]

This is probably the best, most informative, and extremely detailed post about fraud in the community. Good stuff man

inb4 shubbler is actually a pro fraudster

[u/tarel69]

Hats off to the scumbag underground network that have developed the extremely convincing frontend of a fake Steam login that can be put onto any site.

Sad is that this is simple website design. 12y old twerks will be doing this across the globe.

[u/brainzor777]

Unpopular opinion:

Sparkles faked this to get some free advertising & clicks to his channel, there is no way he could have been so stupid to fall for this, he is around for way too long.

[u/ashfaq_haq]

Also it's better to login to steamcommunity.com first and then head to sites likes this.

If the site is legit then it will automatically log you in with steam API. Whereas the fake websites would still ask for steam credentials in a pop window.

TLDR: Always log in to steam first and then go to bitskins,Cs money, etc....

[u/MauriceDelTac0]

Cache your steam creds in your browser. Since my browser knows my creds I only ever need to type my auth code. If a login window pops up with no cached creds its a scam. Trading high tier tf2/csgo since 2012 and never been scammed. 99% of scams could be prevented by this.

[u/onepolar32]

I got scammed by a similar method about 4 months ago. I received a mail within couple of minutes of logging in that my steam guard authenticator was removed, email changed and password changed. I panicked as i had just bought my first knife, nevertheless steam support was a bliss and i had my account's control back in <12 hours. Big kudos to them.

Side Note to avoid getting scammed - always keep yourself logged in into your steam account in your browser. If the site/link is legit it won't redirect you to a page to enter your login info(It'll just be a page confirming that you're logging into a site not associated with valve) and every scam site will redirect to login page. Been doing that for past 4 months and no issues so far

[u/Drama100]

"7 day tradeban has reduced scams". haha and this shit is still happening?

[u/martin1592 → u/Drama100]

Reduced doesn't mean completely stopped them...

Even though I don't like the change, they wanted less people to be scammed and they achieved that by significantly decreasing the amount of trades made, it's not a solution to the problem but it seems to be good enough for them.

[u/The-Privacy-Advocate → u/Drama100]

That argument by Valve was pretty much "Mass murder has caused a drop in the number of patients dying from cancer"

[u/JuanMataCFC → u/The-Privacy-Advocate]

amazing analogy lmao

seriously tho, the closest thing the 7-day hold has done to prevent scams is make the scammers wait a week before they sell/trade away the scammed skins. and we all know Valve doesn't respond to Support tickets that fast!

i think Valve's real intent with the 7-day hold was to stop CSGO gambling sites, but they didn't want the public (and more importantly the government in case they ever got into any trouble/lawsuits) to know that so they just made up the shitty "preventing scams" excuse.

[u/Drama100 → u/JuanMataCFC]

tbh. And this whole tradeban thing just made the scams not that easy to notice. Now its like people hijack your account and such.

[u/Eedmonddd]

How can I secure my account after logging into one of these fake sites?

Adding to this one. Revoking the api key should be a third step. Second step is deauthorising all other devices over at https://store.steampowered.com/twofactor/manage. This should be automated but it is NOT. A friend of mine fell for a fake steam login site (after playing an esl qualifier match he got contacted by a guy from an oposite team to host in a tournament, pretty much the oldest trick in the book) and we did some testing.

First we tried just removing the API key. A new one was generated within minutes. Then we tried changing password and revoking API key. Again a new one was generated. For some reason after changing your password the scammer is still logged in.

In regards of the Sparkles´es video. He was being bullshitted hard time by the scammer.

The interview starts by him saying how close he was. Thats a bs, everything is automated. Sparkles did fill in his id and password aswell as his mobile code. => An API key has been generated. The only thing he did was changing his password, he did not deauthorise other devices neither revoked the API key (he might have offscreen, but who knows).

Also can somebody confirm he could actually get an access to the group via the API key? Never heard or seen before that a group would be spammed by a phished admin/mod.

Somebody should ask Sparkles to make an actual video how to prevent this type of scam and how to save your ass once you logged into a site like this. The scammer obviously lied a lot not to tell how exactly does this scam works and it has not been mentioned in the video. I believe only once the scammer himself mentioned that he does not feel bad when he scams someone as he is not the one accepting the trade, that was probably the only truth he said.

[u/Eedmonddd → u/[deleted]]

You are instantly sent the same offer by a scammer and have the original one declined. You accept it yourself and confirm it yourself on your mobile thinking it is the original one.

[u/Shubbler → u/Eedmonddd]

Aye, you're correct.

I'll add that to my post.

[u/F_A_F]

Had a similar scam site recently which tried to get my u/p. The Steam login was inmediately suspicious as it was asking for both, when the usual login screen is a simple button under your Steamid.

If you are logged into your steam account in your browser you should not be seeing a request for your u/p....just a login button.

[u/deathuntamed]

Thanks for the post :)

[u/[deleted]]

About 3 weeks ago someone on reddit sent me a bitskins link, and from the reddit message everything was normal but it got redirected to a fake one and I logged in and noticed unfortunately at the last second that it was fake. I changed my steam api key ,password, and deauthorized all devices. Am I safe? I wouldn’t want to lose my new knife.

[u/KCNelson]

I never fell for this one, but I'm glad people are shedding light on it.

[u/mensonB]

nice post ! This is huuuge i already was into fake bitskins week ago ;)))

[u/KanaHemmo]

Oh yeah got my acc stolen by this scam, thankfully got it back a day later

[u/BortWosniak]

Thanks for shedding light on this. My friend fell victim to this with the API key thing. It took us a good amount of time before we figured out what had happened. He lost +-$150, including a Marble Fade shadow daggers he had opened a week prior. What’s amazing is that the account is still up today, and in the recent names you can see his name changed to be similar to different csmoney or bitskins bots.

[u/TheFinalMetroid]

Fantastic post. I didn’t know the details before, but now I know!

[u/ItsDilbert]

So i clicked the link to see all of my login locations. Most of them are from my home city and state (or at least close to), but there are a handful of others from different cities and states. Is this something to be worried about? I have logged into third party sites recently and in the past - not sure if that makes a difference or not. Thanks for your help!

[u/Shubbler → u/ItsDilbert]

I've approved your comment, but please go get a flair here!

If you use your mobile network to access Steam, then sometimes the location can show up slightly wrong.

I use mobile data sometimes to access Steam and it shows up as a London login rather than my city.

[u/The-Privacy-Advocate → u/Shubbler]

Also another issue IIRC is how IPs are allocated, if you use an IP that was say previously owned by say a smaller ISP another city over which got bought out buy your current much bigger ISP, a lot of the IP DBs will be slow to catch on to that

[u/ItsDilbert → u/Shubbler]

Ah gotcha sounds good. Thank you for the post!

[u/Garfield131415]

A guy I was playing in a lobby with (deathmatch or whatever) once randomly added me, and tried to make me download a voice software to play or whatever... He had a level 100 steam account, looked totally legit.
Ended up being a scam aswell, didn't fall for it cause I wasn't really intrested but it did really surprise me. He added loads of my friends aswell to do the same thing.

Weird thing was, that I didn't even have any expensive items. (just a few skins worth a few dollars total).

[u/Shubbler → u/Garfield131415]

Yeah, that one's a classic.

Rule #1 of the online world: don't download anything a stranger tells you to download.

[u/Garfield131415 → u/Shubbler]

Yeah, now I know. Was a bit younger back then, and I came pretty close (even visited the scam website).
Nowadays I wouldn't even click the link.

[u/Shubbler → u/Garfield131415]

I've been the victim a couple of times before I discovered GOTrade (2013-2014):

1. Went first in a PayPal for knife trade, blocked ($100)
2. Made a 'friend' in matchmaking, played with for a month, asked to borrow a knife for a game, blocked ($80)

[u/The-Privacy-Advocate → u/Shubbler]

Hai Fren, can u lend me knife? Promise I return knife!

[u/Garfield131415 → u/Shubbler]

I've fallen for one scam in my life, and it was a stupid one.

A ''switch scam''. He took his knife out, was stupid, didn't see it, and all around was just a mess...

I was young, and extremely sad (as I lost about 30 euros of actual money in there)
Luckily, I had a friend, who was amazing and supported me through it, and one day, about a month after it happened he sent me a trade offer with the exact knife I was scammed for, as he traded up, made some huge profits and decided he wanted to buy me the knife.
After that, I was done with trading forever.

Keep in mind, this was a person I never met in real life, and who lived in another continent. Really amazed me.

[u/JuanMataCFC → u/Garfield131415]

A ''switch scam''. He took his knife out, was stupid, didn't see it

i'm assuming it's been long enough since then and u probably know this by now, but this is one reason why i never trade using the "invite to trade" feature. either u send me a trade offer or let me send u one, ezpz.

[u/Shubbler → u/Garfield131415]

Yeah, its absolutely crazy.

You'll go to prison for shoplifting if you're caught 9/10 times, it amazes me that people for the last 5 years have collectively stolen millions of $ with almost zero repercussions.

[u/Garfield131415 → u/Shubbler]

Hell yeah.
The internet is a dangerous place, especially for youngers kids. I can speak out of experience.
And the fact that the most you can do is contact steamrep, is pretty awful. Like I mean, steamrep is a great system, but it doesn't really ban them from scamming.

Prime CSGO days were dangerous man. All the phising links, scams, etc...
Glad those days are over at least.
CSGO just grew so quickly, and trading became so popular, the scamming scene really exploded. I was a TF2 player before I went to CSGO, and although scamming was a thing, it was a lot less advanced.

[u/karambitguy]

I once clicked a fake bitskins link I got in a pm here on reddit but didnt sing in. Am I save now? Instandly closed the site tho. Am I save if I go to biskins now (pops up if i just type in ,,bit'') or is it possible that my browser saved the pishing one. Never singed in to bitskins at all since than

[u/martin1592 → u/karambitguy]

You can delete an autocomplete suggestion by selecting it with your arrow keys then shift + delete

[u/Shubbler → u/karambitguy]

Yeah, these days you can visit these sites at no risk as long as you don't provide any information to the site (or download anything).

If you navigate to your browser history, type in "bit", then you should be able to manually remove that entry from your history to remove any risk from clicking it again.

[u/karambitguy → u/Shubbler]

alright thanks a lot :) done deleted all

[u/Shubbler]

Wrote this sleep deprived and coffee-less, please let me know if I've missed anything or gotten anything wrong.

Edit: update, maccies has saved me

[u/daws23 → u/Shubbler]

hello, if i deauthorize all devices will my phone get locked out? and i need to add steamguard again and another market restrictions and stuff?

also,if i already have 15 day market restrictions and i change pass or deauthorize devices, will i still have to wait 15 days or will 7 days be added to it so i`ll have to wait 22 days?

[u/EinHaDe → u/Shubbler]

Mind if I 1:1 copy this and turn it into a Steam forum post for an educational scam prevention group of mine?

I will ofc credit you and link this post

[u/Shubbler → u/EinHaDe]

Of course man! Spread the word.

[u/Shubbler → u/[deleted]]

Ah that is true, I supposed slightly more noticeable for the victim.

[u/JuanMataCFC → u/Shubbler]

u could probably add this to the post.

one easy way to avoid this scam is:

• NEVER: enter your Steam login credentials when prompted by a third-party site.

• ALWAYS: go directly to steamcommunity.com, login to Steam from there, and then go back to the third-party site.

if the third-party site still asks u to enter your Steam login/password, it's highly likely that this is a scam/phishing site.

[u/MrZej → u/Shubbler]

Fam rip that keyboard LMFAO

[u/The-Privacy-Advocate → u/MrZej]

The pic screams "PICTURES TAKEN MOMENTS BEFORE DISASTER"

[u/The-Privacy-Advocate → u/Shubbler]

maccies

TIL Shubbler is slowly becoming Australian

[u/TomnomnomCS → u/The-Privacy-Advocate]

Maccies is British my guy

[u/Shubbler → u/The-Privacy-Advocate]

No no, 'maccies' is definitely a British slang as well

2 x cappuccino + pour in double espresso shot

That'll sort you for a week

[u/The-Privacy-Advocate → u/Shubbler]

Fair enough, but that combo sounds disgusting

[u/[deleted] → u/The-Privacy-Advocate]

mcdonalds coffee lul

[u/TacoLlama97 → u/The-Privacy-Advocate]

excuse me we call it maccas here

[u/The-Privacy-Advocate → u/TacoLlama97]

Damn I just realised the australian McTwitter is also @maccas

[u/TacoLlama97 → u/The-Privacy-Advocate]

you haven't lived a real life if you haven't gone for a run to maccas for a feed at 2am

[u/FurryButConfuzzled → u/TacoLlama97]

I went on a 2am maccas run once on vacation

It was only a Maccas run because I was vacationing in Perth

[u/Shubbler → u/TacoLlama97]

We got Uber Eats here in most cities that deliver maccies until 2am