API-scam is the most prominent type of scam. CS.MONEY prepared a detailed guide on what is API scam, how to protect yourself from it, and what to do if you were scammed?
How does API scam work?
You have just made a profitable trade, so you open your inventory… and it is empty. There is nothing. Everything is lost. It happened to you. You didn’t give your username and password to anyone, you used Steam Guard, but… you’ve been scammed. How could this happen? It was the API scam.
Do you think you are safe from it? Every day hundreds of scammed users contact us. “I didn’t visit any roulette sites, it’s impossible”, you say. And now you’ve lost your Glock-18 | Water Elemental and the knife you’ve been so long saving up for.
API scam is one of the most dangerous types of scams. Have you heard of it? The API key allows you to cancel and accept trades, as well as transfer them to your account. You have just made a trade, you open your inventory – and it is empty. Why? A scammer has got access to the API key, now he accepts and sends trades instead of you. Want to be 100% safe in just a couple of minutes? Scroll to the end of the article.
How do we lose the API key?
S1mple lost a few knives and he knows about scammers much more than an ordinary CS:GO player. How does this happen? And how did you lose your Glock-18| Water Elemental in a minute? We bet the African grid (FT) on the fact that you have played on some roulette site, you won «Dragonlor» and you, like any self-respecting citizen, of course, believed.
Or just found the csmoney website in a search engine, did not notice a couple of extra letters in the link and gave them all your data.
Do you see any differences between these two sites? We don’t see either. But on the website to your right, you will be scammed. Scam sites are similar to CS.MONEY not only by address but also by appearance. You will see a «regular» site where you look at skins, choose a float… but all you see is a hoax.
When you go to a fake site and log in to your Steam account, you get to a scammer’s trap. Clicking on the “Login using Steam” button opens a fake login window.
Don’t believe your eyes: the fake site will look like the original. You see a window asking you to enter the Steam Guard code, enter the code and get an error message. It is at this moment that your username and password will not be received by Steam, but by a scammer. You gave him everything yourself. Steam Guard did not protect you.
What will happen next? A fraudster logs into your account and at any time everything can be taken from you without your notice.
You’ve been at suspicious sites already, but nothing happened? It’s too early to rejoice – a scammer automatically keeps track of all your exchange offers. And as soon as you exchange your AK47 | Redline, the bot will cancel the trade, copy the avatar and nickname of the second exchange participant, and… your skins are sent to the scammer.
Let’s say you decide to exchange your Hyper Beast collection for a new knife. And at the most important moment, when you checked and confirmed the trade with the bot, all your skins are sent to the scammer.
Are you used to checking profiles when trading? In the new, fake exchange offer, almost all the details will match. The same skins, the same avatar and nickname… there’s just no knife that the bot should give you. You confirm the exchange, and all your skins go to the scammer, and in return you get… nothing.
How to protect against API scam?
Bad news: the scammer will not return your skins. Steam too. Unfortunately, the police are unlikely to be able to help. You voluntarily gave all your treasures. We’ll have to say goodbye to skins.
But we made instructions that can protect you from such an outcome. Three simple steps are enough to prevent anyone from stealing your skins!
- Check the availability of the API key at https://steamcommunity.com/dev/apikey. If the «Domain» field is empty, then you are safe. If not, then you risk losing your skins.
- Install the Antiscam extension for the browser.
3. Remember CS.MONEY address and always check your address bar.
Have you been scammed already? There’s the instruction for you
1. Change your password in the account settings on Steam. 
2. Log out from the Steam account on all devices. The button is here – http://store.steampowered.com/twofactor/manage
3. Revoke the API key generated by the scammer. You can do this at https://steamcommunity.com/dev/apikey. No need to generate a new key.
4. Change your trade link. You can do this here https://steamcommunity.com/id/me/tradeoffers/privacy#trade_offer_access_url
5. Install the Antiscam extension for the browser.
4 main safety rules
- Fake bots can’t copy Steam level, groups, etc. Therefore, you should always check the following:
– Is the bot in our Steam group https://steamcommunity.com/groups/CSMONEY-BOTS
– Bot level. All our bots are at least level 25
– Bot status. All our bots are offline for over a year - Don’t use any phone apps that farm Steam cards, browser extensions, cheats, etc.
- Do not log in to sites for which unknown people send links to you on Steam
- To access our site type the address https://cs.money with your hands in the browser bar or follow the links from our social networks.
