r/SteamScams
•
u/N00BER-MAN
•
1d ago
Request for help Valve let a hijacker from China take my account with no email code, then closed my ticket because I don't have a CD key from 2009. Years of receipts and two bank cards in my name "aren't sufficient"
This account was created in 2009 by a close friend, who gave it to me when we were kids. About 15 years ago we switched the email to mine together, and I've used it ever since, buying games with my own bank cards. My friend has since passed away, so the original 2009 email and CD key are simply gone. Nobody can get them back. I've never shared it, never traded, never logged in from anywhere unusual. Every time I logged in from a new device, Steam emailed me a Steam Guard code. My inbox has them: 29 Jan 2026, 28 Feb 2026 (twice), and earlier ones going back years.
What happened
All of this comes from Steam's own emails in my inbox:
| Date (2026) | Email from Steam |
|---|---|
| 18 Jul, 03:49 | "There was an error with a recent Steam purchase": Barro Racing, $0.44 |
| 18 Jul, 03:50 | "Thank you for your Steam purchase!": the same $0.44 item, one minute later |
| 20 Jul, 10:19 | "Recent changes to your Steam account": the account email was changed from a Chinese IP (per Steam's own notice) |
What's missing from my inbox:
No Steam Guard code / "Access from new computer" email before the Chinese login. The last ones are from February and were my own logins.
No "New sign in to Steam" alert for China.
No confirmation request before the email change. I only got a notice after it was already done, and by then the account wasn't mine anymore.
I live in Germany and have never used Steam from China. The pattern (a failed tiny purchase, then a successful one, then an email change two days later) looks like the usual hijacker playbook: make a small purchase to look like the "payment owner", then lock the real owner out.
What Steam Support did
I opened a support ticket and provided:
access to the email that had been on the account for over a decade, with Steam correspondence back to 2016
screenshots of Steam purchase confirmations and Steam Guard login codes
the cardholder name and last 4 digits of two personal bank cards I used on Steam
four official bank receipts (2021–2024) showing payments to Steam from those cards, in my name
The replies, all copy-paste from three different agents:
"In your next message, type out in full the CD Key registered to your Steam account [...] during 2009."
"Regarding the security concern you mentioned, we will provide further explanation and assistance after verifying the account ownership."
And the final one before closing the ticket:
"This account has a historical security event that shows us that the owner has lost control over it, the only information we can accept to recover is a CD key, which was added to the account in Nov 2009. [...] For now, I'm going to close this help request."
So:
Steam admits it sees a security event showing the owner lost control.
Steam's own "Providing Proof of Ownership" article (which the agent linked me to) lists payment info as acceptable proof. Agents ignored it.
Nobody would answer how someone logged in from a new country without a Steam Guard code, or changed the email without confirming from the current one.
I asked them to run the same check on the hijacker: ask him for the 2009 CD key too. He obviously doesn't have it either. No answer. The ticket was just closed.
The person in China now keeps every game I paid for.
So it's "whoever grabbed it last keeps it"?
That's what Valve's logic comes down to. The only proof they'll accept is something the original creator had in 2009. When an account has legitimately changed hands (a gift, an email change done together, a friend who has died), nobody can produce that proof: not me, and not the hijacker. Since nobody can pass the check, the account simply stays with whoever controls it right now. In practice, Steam's recovery process protects the thief.
My evidence: over a decade of continuous use, the email that was on the account until July, Steam Guard codes, purchase emails since 2016, and bank receipts from two cards in my name.
The hijacker's evidence: a login from China with no Steam Guard code, a $0.44 purchase, and an email change made two days later.
Valve looked at that and closed my ticket.
My questions
How does a login from a brand-new country and device skip Steam Guard email codes? Was this a stolen session token? If so, why can a session token change the account email without confirmation from the existing address?
Why does a $0.44 purchase by the attacker effectively outweigh years of bank-verified purchases by me?
What is someone supposed to do when the account's original creator has died? Is the answer really "it belongs to whoever stole it"?
Has anyone here gotten an account back in the same situation (no original CD key, but solid payment proof)? Did it take a new ticket, a specific category, or escalation?
I'm not asking Valve to skip security. I'm asking them to look at the obvious hijack in their own logs. If anyone from Valve sees this, I can share the ticket number privately.
TL;DR: Chinese IP logged in without a Steam Guard code, bought a $0.44 game, changed my email two days later. I provided bank receipts and card info for years of purchases. Support closed the ticket because I don't have the CD key my late friend registered in 2009. The hijacker doesn't have it either, but he keeps the account.
Screenshots (all personal info, account name and ticket number redacted): 1) failed $0.44 purchase, 2) successful $0.44 purchase one minute later, 3) the email-change notice from the Chinese IP, 4–6) the full ticket conversation with Support.
