Steam Account Hacked? How to Recover It and Save Items

Your Steam password stopped working, or an email arrived saying the account's email address was changed. Maybe a friend asked why you sent them a strange link, or your inventory looks emptier than it did last night.

The short answer: do things in the order Steam itself gives. Clean the computer, take back your email, then recover the Steam account through help.steampowered.com. After that, move fast on any trades still on hold, because that is the only way to keep items that are about to leave.

This guide covers the recovery flow, what counts as proof of ownership, how trade holds work in your favour, Steam Guard code problems, and the scams that follow a Steam takeover.

Last checked: 29 September 2026.

#What Should You Do First If Your Steam Account Is Hacked?

Steam's account stolen page sets the order: scan your computer for viruses, key loggers and spyware, then change your email password, and only then reset the Steam password. The reason is simple. If malware is still on the PC or the attacker still has your inbox, they can take the account again or interfere with Steam Support. Once both are clean, go to help.steampowered.com, choose "Help, I can't sign in" and follow the steps. Steam says you can contact its support for recovery even if someone changed the email, password and phone number. Nobody outside Steam, including AwareXone, can restore a Steam account for you.

#How Steam Accounts Usually Get Taken

Knowing how the attacker got in tells you what to fix. Steam's Steam Guard FAQ lists the common routes, and each needs a different repair.

On that last row: Steam says it will never ask for your Steam Guard files, and someone holding your .SSFN file plus your username and password can sign in without touching your email.

#Step by Step: Recovering a Stolen Steam Account

1. Run a full virus and spyware scan on every computer you use for Steam. Steam's security recommendations warn that some malware is built to avoid common antivirus and may wait until your Steam Wallet has funds, so remove anything you installed recently from a chat link.
2. Secure your email: new password, two-step verification on, and check forwarding rules and recovery options you did not set. Our guide to taking back a hacked Gmail walks through that part.
3. Go to Steam's login help and choose "Help, I can't sign in". Follow the prompts to reset the password.
4. When the search asks for an email, enter yours. Steam's page on recovering a stolen account says the system wants your email address, not the account's current one, and will offer other options if the email was changed.
5. If self-recovery stalls, open a Steam Support ticket from the same site. Include every account name and email address you may have used, plus proof of ownership.
6. Once you are back in, open "Authorized Devices" and choose "Sign out everywhere", then check the email, phone and Steam Guard settings on the account.

#What Counts as Proof of Ownership?

When self-recovery does not work, Steam Support checks that the account is yours. Its proof of ownership page says this is done with payment information previously used on the account, or retail product codes activated through Steam. What you send depends on how you paid.

• Card purchases: the card type, the name on the card, the billing address, city and postcode, and the last four digits only. Steam says not to send the full card number.
• PayPal: the full name and billing address on the PayPal account, plus a screenshot of a Steam purchase in PayPal that shows the invoice ID.
• Physical game keys: a photo of the key with your Support ticket number written below it in permanent ink.
• Digital activation codes: a screenshot of the page or email where you received the code, with the code visible.
• Steam Wallet codes: a photo of the receipt or card with your ticket number written below the code.

All of this goes into the ticket on help.steampowered.com and nowhere else. Anyone asking for your card details or receipts in a chat window is collecting them for fraud, not recovery.

#Can You Stop Items Leaving Your Inventory?

Sometimes, if you act while the transfer is still on hold. Steam's trade and market holds page says that if your account has not had a Steam Guard Mobile Authenticator for at least the last 7 days, items leaving it are held for up to 15 days. That window exists so an owner can change the password and cancel pending trades or Market listings before a thief gets the items.

1. Recover the account and change the password first, so the attacker cannot simply start new trades.
2. Open your trade offers and Market listings and look for anything on hold that you did not create.
3. Cancel each one. Steam says it will then assume you intercepted a hijacker and apply a 7 day trading cooldown, which Steam Support cannot remove.
4. Check again over the next days in case a listing was created shortly before you got back in.

#Trade and Market Restrictions After You Get Back In

Expect some limits once the account is yours again. Steam's trading and Market restrictions page explains several that a recovery can trigger, and says Steam Support cannot change any of them, whatever the circumstances.

Steam says the hold after adding an authenticator protects you if an attacker ever adds their own, so those waits work in your favour even when they feel slow.

#Steam Guard Code Not Received or Not Working

Steam Guard sends a code to your email or shows one in the Steam Mobile app whenever you sign in from a device it does not recognise. When the code will not arrive, Steam's help pages suggest these checks:

• Email codes: check the inbox actually linked to Steam and its spam folder, add support@steampowered.com and noreply@steampowered.com to your contacts, then exit Steam and sign in again for a new code. Steam asks you to contact it if nothing arrives after 3 hours.
• Always type the newest code. Steam says older codes will not work.
• Authenticator codes: they change every 30 seconds and depend on your phone's clock, so set the time to automatic if codes are rejected.
• SMS codes: the Mobile Authenticator FAQ says texts can come from a 6 digit number, and Steam pauses SMS if too many were sent, so wait a few minutes to an hour. In some countries Steam may deliver the code through Telegram instead.
• Lost phone and no recovery code: Steam says you need Steam Support to remove the authenticator, with proof of ownership if you also lost the email.

If the attacker added their own authenticator or changed the phone number, that is a takeover rather than a code problem. Our guide on a hacker switching on their own two-factor explains why that situation needs the support ticket route. And if your phone suddenly shows "No service" at the same time, call your Malaysian carrier from another phone and ask whether your SIM was replaced; our SIM swap guide covers what to ask for.

#The Scams That Follow a Steam Takeover

A hacked Steam account is often used to hack the next one, so the message that caught you may now be going to your friends. The best known is the "I accidentally reported you" script. Steam's page on it says any claim that you were accidentally or falsely reported is a scam, and that Valve staff never talk to you about your account through any chat system, including Steam Chat and Discord.

• A friend or stranger says your account was reported and you must talk to a "Steam admin" on Discord.
• Your library is blocked by an alert telling you to contact an agent by chat. Steam says that alert comes from malware.
• Someone asks for your password, a code from email, SMS or the app, or tells you to change security settings.
• Someone demands a purchase or a Steam gift card code to "verify" you own the account.
• A trading site, giveaway or tournament asks you to sign in or install voice or anti-cheat software. Steam's Scam FAQ lists that as a malware trick.

The same scripts reach Malaysian players in Bahasa Malaysia and Chinese, for example a message claiming "akaun anda telah dilaporkan" (your account has been reported) or one about 账号被盗 (a stolen account). The language changes; the ask for a login, code or payment does not. Steam's security page says official logins only happen on steampowered.com, store.steampowered.com, steamcommunity.com and help.steampowered.com. If you already typed your details into a lookalike page, our guide on what to do after clicking a phishing link covers the clean-up.

#Report the Accounts Involved

Steam's guide to reporting a scammer, hijacker or phisher says a report from the offending profile works better than a support ticket. Open the profile, select the "..." button, choose "Report Player", pick the violation and add a short statement. If a friend's account was used to scam you, report it as hijacked; Steam says its moderators can lock that account until the owner recovers it. Report any Discord or other chat accounts through those apps too.

#Evidence to Keep While You Recover

• Screenshots of every Steam email about password, email, phone or Steam Guard changes, with dates.
• The chat, profile link and any site address the attacker used.
• Your account names, every email address you have used on Steam, and the phone number if one was added.
• Proof of ownership items: payment records, PayPal invoice IDs, product key cards or activation emails.
• A list of items and trades you did not make, with times.
• Any money paid to a scammer: bank transfer details, receipts and the account it went to.

#If You Lost Money in Malaysia

If you paid a fake agent, sent a gift card code or saw card charges you did not make, call your bank's 24-hour hotline or the National Scam Response Centre on 997 first. The NSRC's FAQ on the NFCC website says the 997 line runs from 8.00am to 8.00pm daily, including public holidays, and asks victims to make a police report at the nearest station as soon as possible after calling. It also warns that quick action reduces losses but there is no guarantee of getting money back.

Phishing sites and malware can be reported to CyberSecurity Malaysia's Cyber999 incident response centre through its online form, email or mobile app. Include the site address, times and any emails you received.

#Lock It Down Once You Are Back In

• Turn on the Steam Guard Mobile Authenticator. Steam calls it the best level of Steam account security, and after 7 days it also ends trade holds.
• Save your recovery code: in the Steam Mobile app, open the Steam Guard page, tap the gear icon and select "Recovery Code". Print backup codes from Manage Steam Guard; Steam advises not to screenshot them.
• Add a phone number, which Steam says makes recovery much easier.
• Use a different password for Steam and for your email, as Steam recommends.
• Never run programs that claim to fix, clean or optimise Steam, and never install software a stranger sends in chat.

#When a Case Review Makes Sense

Most Steam recoveries are done by the owner, through the Help Site, with the evidence above. Only Steam Support can return an account, and some accounts, or items, do not come back. A second pair of eyes helps when the same attacker also holds your email, Discord or social accounts, or when you are not sure which proof of ownership still exists. AwareXone, our recovery service, looks at the whole picture first and tells you plainly whether the official route is still open, and sometimes that you can finish it yourself. Our account security service explains how we work, and the Trust Center lists what we will never ask for, starting with your password and Steam Guard codes.

#Frequently Asked Questions