TL;DR: Someone got into my email and asked Steam Support to remove my Mobile Authenticator. Support asked for a CD key as proof of ownership; he refused. A second agent then “re-evaluated” the case and removed my authenticator and phone number anyway. The attacker’s next request was to change my account email. I only kept my account because I happened to secure my inbox at that exact moment. I warned Support immediately and asked how this was possible – no reply in 12 days.
The image shows the full ticket in order, with personal data redacted.
Before you say “secure your email”
You’re right, and that part is on me: my email had a weak password and no 2FA. I’ve fixed that.
But a compromised email is exactly the scenario the Mobile Authenticator exists for. If Steam Guard can be removed by anyone who gets into your inbox, it isn’t really a second factor.
And Steam Support clearly didn’t consider the details the attacker provided enough either – otherwise they wouldn’t have asked for a CD key. The problem is that this requirement was dropped as soon as the attacker refused.
Timeline (times as shown in the ticket)
Sep 29, 2:43 pm – Attacker opens a ticket (“My two-factor device is lost or broken”), claiming he switched phones and has no recovery code. He provides my username, first email, phone number, PayPal account holder, a PayPal invoice ID, PayPal address and a file called paypal.jpg. (image, top)
Sep 29, 6:27 pm – Support asks for a CD key registered to the account to verify ownership. (image, top)
Sep 29, 10:00 pm – Attacker refuses: he never saved CD keys and “already provided everything”. (image, middle)
Sep 30, 6:50 am – A different agent replies that he “re-evaluated the account”, verified ownership, and removed the authenticator and the phone number from my account. (image, middle)
Sep 30, ~10:00 am – Completely by coincidence, I change my email password and lock the attacker out of my inbox.
Sep 30, 10:30 am – Now locked out, the attacker claims his email “bugged” and asks Support to change the account email to a new Outlook address. (image, middle)
Sep 30, 12:24 pm – 1:06 pm – I reply in the same ticket: this wasn’t me, do not change the email, how can a third party remove my 2FA, and what was in paypal.jpg? (image, bottom)
Since then: no reply. 12 days and counting.
Why this matters for every Steam user
- The details accepted as proof can be found in an inbox. Username, PayPal holder, invoice ID and address all show up in purchase receipts and account emails.
- The one proof that usually isn’t in your inbox – a CD key – was requested, refused, and then simply dropped.
- Authenticator removed, phone number removed, then an email change request. That’s a textbook account takeover, and nothing in the process seemed to flag it.
- When the real owner reported it, nobody responded. If I hadn’t changed my email password by pure chance, I’d have lost the account with no way back.
What I’d like to know
- Is this the intended verification process, or did one agent make a mistake?
- Has anyone experienced something similar?
- Is there any way to require stronger verification before your authenticator can be removed?
What you can do now
Learn from my mistake: protect your email with 2FA (authenticator app, not SMS) and a unique password. Right now your email seems to be the real key to your Steam account – authenticator or not.
My account is safe now. This isn’t a support request. I’m sharing it so others are aware and hopefully Valve looks into this process.