Steam account security
The steps that actually close the ways a Steam account gets taken — in the order worth doing them.
What an attacker gets with your Steam account
Has Steam itself been breached?
No. Steam does not appear anywhere in Have I Been Pwned’s catalogue of 1,027 known leaks.
That is about Steam the company. Your own email address can still be sitting in a leak from somewhere else entirely — a shop, a forum, an old account you have forgotten. That is the part worth checking, and it is free.
If the account is already gone
Steam takes about 24-72 hours to answer a recovery request. Start it before you do anything else on this page — nothing here gets back an account somebody else is holding.
- Visit Steam Support — Go to help.steampowered.com
- Select "I can't sign in" — Choose the account recovery option
- Provide Account Details — Enter email, phone, or username associated with account
- Verify Ownership — Provide proof like payment receipts, CD keys, or previous passwords
- Wait for Response — Steam Support typically responds within 24-48 hours
- Secure Account — Once recovered, immediately enable Steam Guard and change password
Have these ready before you start. Steam will ask for them, and the request stalls without them:
- Credit card used for purchases (last 4 digits)
- Physical game CD keys registered to account
- Previous passwords or email addresses
- PayPal transaction IDs
- Old screenshots showing account ownership
How Steam accounts are taken
- Trade Scams
- Phishing Links
- Fake Giveaways
- Api Key Theft
Already lost the account? Start Steam account recovery → — go there first. Nothing on this page recovers an account that’s already gone.
The checklist
- critical
-
high
Use Steam Mobile AuthenticatorMobile authenticator provides better security than email codes
-
high
Check API Key StatusRevoke any unauthorized API keys at store.steampowered.com/dev/apikey
-
medium
Review Trade URLRegenerate trade URL if you suspect it was leaked
-
medium
Check Login HistoryReview authorized devices and deauthorize unknown ones
-
low
Review Family Library SharingRemove any unauthorized accounts from family sharing
-
medium
Configure Privacy SettingsSet game details, friends list, and inventory to private
-
low
Check Community Ban StatusEnsure no unexpected bans from compromised behavior
What this guide can’t do
Every step above hardens the account from here on. None of them touch the data that has already leaked — the email, password and phone number sitting in someone else’s breach dump, which is where most Steam takeovers actually start. You can’t unleak a breach. You can find out what’s in there and take away what it’s worth.
Checks 13.1B+ leaked records. No card, no account to look.