Steam account security

The steps that actually close the ways a Steam account gets taken — in the order worth doing them.

Last verified August 2026 8 steps · about 5 minutes Steam Guard

What an attacker gets with your Steam account

Games Library Friends List Playtime Inventory Real Name Profile Info

How Steam accounts are taken

Trade Scams
Phishing Links
Fake Giveaways
Api Key Theft

Already lost the account? Start Steam account recovery → — go there first. Nothing on this page recovers an account that’s already gone.

The checklist

critical

Enable Steam Guard

Steam Guard adds 2FA protection via email or mobile app

Steam’s own instructions
high

Use Steam Mobile Authenticator

Mobile authenticator provides better security than email codes
high

Check API Key Status

Revoke any unauthorized API keys at store.steampowered.com/dev/apikey
medium

Review Trade URL

Regenerate trade URL if you suspect it was leaked
medium

Check Login History

Review authorized devices and deauthorize unknown ones
low

Review Family Library Sharing

Remove any unauthorized accounts from family sharing
medium

Configure Privacy Settings

Set game details, friends list, and inventory to private
low

Check Community Ban Status

Ensure no unexpected bans from compromised behavior

What this guide can’t do

Every step above hardens the account from here on. None of them touch the data that has already leaked — the email, password and phone number sitting in someone else’s breach dump, which is where most Steam takeovers actually start. You can’t unleak a breach. You can find out what’s in there and take away what it’s worth.

See what’s already exposed — free scan

Checks 13.1B+ leaked records. No card, no account to look.