Enable Steam Guard two-factor authentication

Steam Guard is an additional level of security that can be applied to your Steam account. When Steam Guard is enabled on your account, anyone attempting to login to your Steam account from an unrecognized computer must provide additional authorization. A special access code will be sent to your contact email address, and this code must be entered into Steam before your login is complete. Steam Guard security is also available through the Steam app on your smartphone, by using the Steam Guard Mobile Authenticator.

Steam Guard: How to set up a Steam Guard Mobile Authenticator

Steam Friends

Anyone can attempt to add you

It's good to keep in mind that the users who add you may not be people you have chatted with before. Users can add you to their Friends list if they find your profile by searching for your in-game name or your account's contact e-mail address.

Be aware that users can change their profile name displayed in Friends at any time.

Account Phishing

Attempting to trick other users into providing password information is commonly called "phishing" - unfortunately, some individuals are using deceptive Steam Friends names to request password information from other users. Steam Support does not use the Friends network to contact users, nor will we request CD Key or credit card purchase information unless you have contacted us for assistance by using the Steam Support System.

If you receive a link from another user, especially one claiming free access to Steam content, use extreme caution! All official Steam logins are directed to the www.steampowered.com, store.steampowered.com, steamcommunity.com, or help.steampowered.com domains. If you suspect a site asking for your login information is not an official Steam site, do not enter any information on the site and disregard it.

Things to Watch Out For

Account hijackers have several common methods of attack, most of which rely upon misinformation or deception. Your account cannot be stolen if you follow these recommendations and refrain from sharing your account.

Watch out for these activities:

Requests for login and password information

Deny requests for login and password information from other users. Do not share your account login information with anyone. No reputable gaming group will ask for your login information to join, and game server administrators do not need your Steam account information.

Unsolicited messages from "Steam Support" (Phishing Scams)

Ignore unsolicited messages from "Steam Support" unless the message originates from the help.steampowered.com domain.

Malicious programs in downloads

Hacks are another very common source of malicious programs. It is common for executable ( .EXE ) files, Windows screensaver ( .SCR ) files, dynamic link libraries ( .DLL ) files, and batch ( .BAT ) files being offered as parts of "mods" to contain malicious software designed to steal Steam account login information.

Examples of hijacking attempts

A list of common scams can be found here.

General Security Recommendations

It is a good idea to maintain the security of your system in the following ways:

Select a Strong Password

A strong password is a necessary first step toward ensuring the security of your account. Your password should meet all of the minimum requirements listed below:

• Use at least 6 characters
• Use a combination of uppercase and lowercase letters.
• Include at least one number within the password
• Do not use a name, a word that could be found in the dictionary, or a series of letters as it appears on the keyboard ("qwerty" and "12345" are not secure passwords)

Use unique passwords

Make sure you are using a different password for your Steam account and your contact e-mail address.

Keep the email address tied to your Steam account secure

Hijackers often target email accounts to access your other online accounts, including Steam. It's a good idea to select a strong password, enable two-factor, and follow the security recommendation of your email provider. If you suspect that your email account is hijacked, update the password immediately.

Steam will inform you of security changes made to your account via email. Make sure you monitor your email account linked with Steam and follow up if you receive any notifications related to unexpected security changes.

Scan your computer

Regularly scan your computer for viruses, key loggers, spyware, and other malicious code with a virus scan utility that has the most recent virus definitions.

Avoid insecure computers

Avoid accessing your Steam Account from internet cafes or shared computers - if you must use an internet cafe or shared computer, make sure it has been scanned for viruses, trojans, and keyloggers.

Always log out of your account on shared machines

If the machine you use to access Steam has multiple users, be sure to fully Exit (log out of) Steam when you are done using the machine (if the "Remember Password" option is checked or if Steam is minimized to the Windows system tray but not fully Exited another user may be able to access your account).