Safety

How to Spot a Phishing Link Before It Costs You

Posted by

reload

A phishing link is a link designed to trick you into handing over something you should keep private, such as your Steam login details or Steam Guard codes. Around CS2 skins, these links are a tool scammers use to take over accounts and empty inventories. This guide shows you where they turn up, the warning signs to check before you click, and what to do if you think you have already been caught.

What a phishing link is trying to do

Phishing takes its name from fishing: the scammer casts out bait and waits for someone to bite. The link usually leads to a page that imitates something you trust, such as a Steam sign-in screen or a trading page. Once you are there, it aims to get one of the following:

Your login details. Typing your username and password into a fake page hands them straight to the scammer.
Your Steam Guard code. Some fake pages ask for the code from your authenticator as well, so they can use it straight away.
Access for an API key scam. Once logged in, scammers can use a Steam Web API key on your account to watch and cancel your real trade offers and send look-alike offers instead.

Where phishing links show up

Phishing links rarely arrive on their own. They usually come wrapped in a story that gives you a reason to click:

Messages in Steam chat or other chat apps, often from strangers but sometimes from a friend whose account has already been taken over.
Fake “verification” requests claiming your account, a trade or a purchase must be checked before it can go ahead.
Offers that are too good to be true, such as a rare item at a suspiciously low price or a trader who suddenly wants to add something extra.
Impersonation of support staff, with a message claiming there is a problem with your account that you must fix by following a link.
Comments and profile posts encouraging you to look at a “deal” or a “screenshot” hosted somewhere else.

Red flags to check before you click

In the link itself

Look-alike spelling. Read the address letter by letter. Scam links often swap, add or remove a single character, or use a letter that looks almost identical to the real one.
Extra words. A familiar name with an additional word or hyphen attached is a different address, however official it looks.
Hidden destinations. Shortened links and buttons can hide where you are really going. If you cannot see the destination clearly, do not trust it.
Unexpected context. Even a link that looks right deserves suspicion if it arrived out of the blue from someone you were not expecting to hear from.

On the page

Fake login windows. Some fake sign-in windows are drawn inside a web page to look like a separate browser window, complete with a convincing address bar. Legitimate sites — ReloadSkins included — may offer “Sign in through Steam”, but the login itself always happens on Steam’s own website, in a real browser window that shows Steam’s official address in its address bar. A fake window drawn inside the page cannot be dragged outside the browser, and its “address bar” is just part of the picture.
Requests for codes. A page asking for your Steam Guard code when you did not start a sign-in yourself is a major warning sign.
Countdowns and threats. Timers, warnings that your account will be locked, or claims that a deal is about to vanish are designed to rush you.
Details that feel off. Odd wording, blurry logos or buttons that do not quite work are all worth noticing.

Safer habits that beat phishing

The best defence is to make clicking unfamiliar links unnecessary in the first place. Build these into your routine:

Go direct. Instead of following a link, open the official Steam app or reach the site yourself using a bookmark you saved earlier.
Check with the sender another way. If a friend sends a strange link, ask them about it outside that conversation before you click.
Keep Steam Guard Mobile Authenticator enabled. It adds protection to your account, and without it, Steam can hold trades for up to 15 days.
Confirm trades only in the official Steam mobile app. Check the other party and every item before you approve anything.
Use a password manager. A good one only offers to fill in your password on the site it was saved for, so if it stays silent on a page claiming to be Steam, take that as a warning.

These habits work best alongside solid account settings. For the wider checklist, see our guide on how to secure your Steam account.

What to do if you have already clicked

If you closed the page without entering anything, the risk is much lower, but stay alert for follow-up messages. If you did type in your details or a code, act quickly:

Change your Steam password using the official app or a page you opened yourself, and change it anywhere else you used the same password.
Check the API key page in your Steam account settings and revoke any key you did not create.
Create a new Trade URL in your Trade Offers settings so the old link stops working.
Review pending trades and confirmations in the official Steam mobile app, and decline anything you do not recognise.
Warn your friends if messages were sent from your account, so they do not trust anything that appeared to come from you.

If a ReloadSkins order is affected, for example a delivery offer was cancelled or an unexpected offer arrived, contact our support team with your order ID, a short description and screenshots. ReloadSkins will never ask you for your Steam password or Steam Guard codes.

Key takeaways

Phishing links aim to capture your login details, Steam Guard codes or enough access to run an API key scam.
Read every address carefully and be suspicious of unexpected links in chats, even from friends.
Only enter your Steam login on Steam’s own website in a genuine browser window; when in doubt, go direct through the official app or a bookmark instead.
If you entered your details, change your password, revoke unknown API keys, create a new Trade URL and review your trades.

To see exactly how scammers use a stolen login once they have one, read our guide to API key scams.