{ "schema": "phishdestroy.reading-edition.v2", "schema_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/article.schema.json", "object_type": "Dated article reading edition with PDF digest", "id": "investigation_part2", "language": "en", "title": "Account access & accountability — The Steam Dossier", "author": "PhishDestroy Team", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2", "source_file": "steam_dossier/investigation_part2.html", "source_html_sha256": "7d709cf58a2018b98dd8e0d25ec4605f4612b114a4304e0b285880ab92105678", "exported_at": "2026-10-18T11:58:30.589Z", "edition_date": "2026-10-18", "scope": { "text": "Authored discussion and analytical tables from the current source HTML. Interactive controls and navigation are omitted; interactive datasets remain linked.", "omissions": [], "evidence_status": "The signature authenticates this publication, not the truth or authenticity of third-party evidence." }, "pdf": { "filename": "investigation_part2.pdf", "url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/investigation_part2.pdf", "sha256": "fb1afbae5259c3b56c4817aa639b3fbf8e6bf239821738be72f17d20ab542678", "bytes": 284709, "pages": 9 }, "integrity": { "signed_object": "investigation_part2.content.json", "signature_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/investigation_part2.content.json.asc", "checksum_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/investigation_part2.content.json.sha256", "format": "ASCII-armored detached OpenPGP", "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01", "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt", "scope": "Exact UTF-8 JSON bytes, including content and the PDF SHA-256. No cryptographic PDF document signature is asserted." }, "license": { "identifier": "CC0-1.0", "application": "Authored material only; third-party material retains its own rights.", "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json", "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb" }, "content": { "text": "Contents · Live article\n\nTHE STEAM DOSSIER / II\n\nPart II — Account Access, Outsourced Support & Enforcement\n\nPublic automation. Outsourced support. The people left counting the cost.\n\nBegin this subsection\nEXHIBIT 01 / LIVE SHADOW MARKET SURVEILLANCE550,000+\n\nSteam accounts actively on sale on FSB Market (an anonymized label; the original name is withheld here)\nat this very moment\n\n550,000+ LIVE INVENTORY · 231,829 IN HISTORICAL SCRAPED CORPUS (198,320 STEALER LOGS)\n\nThe primary underground clearinghouse for hijacked Steam accounts, FSB Market (associated names withheld), authenticates both buyers and sellers using Valve's official Steam OpenID (openid.realm = https://FSB Market). At any given minute, over half a million stolen and compromised accounts (stealer logs from RedLine/Lumma, phishing captures, credential stuffing) are actively listed for pennies ($0.50–$2.00). Neither FSB Market nor the associated forum is blocked by Valve's Link Filter. This is the industrial reservoir supplying the 63.06% paid bot accounts that Valve bans without assisting the victim.\n\nLive Intel: Shadow Market Monitoring (550k+ Live) ↗ · Open capture record ↗ · Open Link Filter trace ↗550K+ LIVE\n\n01 / AN ECOSYSTEM WITH AUTHORS\n\nAutomation has a paper trail.\n\nNamed projects. Published capabilities. Trace a tool to its documentation, then inspect the collected developer relationships.\n\n252REPOSITORIES COLLECTED\n3,320GITHUB PROFILES\n4,214PROFILE–REPOSITORY PAIRS\nValve infrastructure Community libraries Reusable applications\nLines show documented integrations or dependencies. Select a node to follow its evidence.\nWhat the developer graph establishes\n\nThe graph maps published contributor and forker relationships between named projects and GitHub profiles. These are public records — repository forks, contribution lists, profile associations. The question is what the paper trail of published capabilities and developer relationships requires Valve to answer, not what this investigation invented. Source hashes are saved in the map provenance.\n\nExplore the full network ↗Repository source data ↓\n\n02 / DIFFERENT CREDENTIALS. DIFFERENT POWERS.\n\nWhich key are we talking about?\n\nPlaying a game does not require the player to issue a personal Web API key. That is the distinction at the centre of this inquiry.\n\n01 / USER ACCOUNT\nPersonal Web API key\nsteamcommunity.com/dev/apikey\n\nIssued from a user account for permitted API calls. Key creation, visibility, revocation and abuse detection are account-security questions.\n\n02 / GAME BACKEND\nPublisher Web API key\n\nSteamworks partners use publisher credentials for supported backend operations, including game-related services. A player’s personal key is a different credential.\n\n03 / IDENTITY & SESSION\nOpenID / session tokens\n\nOpenID confirms identity to a website. A Steam session or refresh token has a different purpose. These mechanisms should not be presented as one interchangeable “API key”.\n\nValve documents both user and publisher Web API keys. The entire Web API is therefore not separate from Steamworks. API key documentation ↗ archived 2026-09-15 ↗ · Game-session authentication ↗ archived 2026-08-29 ↗\n\nDOCUMENTED BY THE TOOL’S AUTHOR / MARCH 2024\n\nAutomation can use more than an API key.\n\nTrade Offer Manager’s wiki describes using a session access token for parts of the Web API when no separate API key exists. It also records mobile confirmation for key creation from late 2023. The maintainer calls token use this way unsupported by Valve; this is a dated documentation claim, not a live bypass test.\n\nInspect the maintainer’s explanation ↗ archived 2026-09-24 ↗\n\nTHE HUMAN SIDE / AN ILLUSTRATIVE PHISHING PATH\n\nStill playing. Already exposed.\n\nA message from a friend. A request to vote. A “thank you” page. To the player, the task is finished. A compromised session can outlast that moment.\n\nON THE PLAYER’S SCREEN\n\nA FRIEND’S ACCOUNT\n\nOUT OF SIGHT\n\nSilent session token capture\n\nAccount security is the issue before any item is sold.\n\nThe player did not set out to create an automation credential or delegate control. Returning to a game is not evidence that the account is safe. Valve holds the session logs, the API key creation record, and the device correlation data. The victim does not. That asymmetry is the accountability problem.\n\nSession access and credential types\n\nAn API key and a logged-in session are separate credentials with different capabilities. Revoking a key does not terminate an active session. Valve’s own documentation describes both; Valve holds the logs that would show which credential was active at the time of any disputed action. The demand is disclosure of that record — not an inference the investigation has invented. Maintainer documentation on token handling ↗ archived 2026-09-24 ↗ · Valve key documentation ↗ archived 2026-09-15 ↗\n\n03 / THE OFFICIAL MARKET HAS A CEILING\n\nThe item can be rare. The limit stays.\n\nA price above the listing cap cannot be realised through one Community Market listing at that full price.\n\nILLUSTRATIVE ASKING PRICE$5,000\n$100$20,000\n\nAn illustration of the published limit, not a valuation or recommendation to trade.\n\nLISTING CAP≈ $1,800\nWALLET CAP≈ $2,000\n\nWallet funds cannot be withdrawn to a bank account. These constraints create the demand that third-party skin markets fill: a demand the listing and wallet caps produce, while Valve's own rules prohibit commercial operators from meeting it.\n\nSteam’s market limits ↗ archived 2026-09-21 ↗\n\n04 / INSIDE THE SUPPORT BOUNDARY\n\nEntrusted with data. Accountable for access.\n\nValve’s privacy policy expressly provides for sharing personal data with third-party support providers, as necessary for support.\n\nTHE PLAYERAccount & evidence\nVALVERecovery process\nSUPPORT PROVIDERDelegated access\n\nPrivacy Policy §5.2 ↗ · Valve's own policy authorises third-party support access. The open questions are: what permissions were granted, what audit trails exist, and what happened when access was allegedly abused.\n\n2015\nThe scale was public\n\nValve acknowledged widespread account theft and described protective measures.\n\nValve publication ↗ archived 2026-08-09 ↗\n2015\nValve outsourced the desk — and said so\n\nValve keeps a small in-house Steam Support Leadership team and stated it \"hired a couple different companies\" to handle support (Erik Johnson, Valve, to Kotaku); its privacy policy § 5.2 authorises those third parties' access to user data. Which contractor holds account-recovery access, Valve has never disclosed — community discussion names vendors such as Concentrix, but none is Valve-confirmed. The outsourced desk was in place years before either admission below.\n\nKotaku: Valve on its support ↗ archived 2025-07-11 ↗\n2023\nThe first admission\n\nValve's CS:GO team accepts responsibility in writing for an account compromised through its own help-request process, and reverses the trades.\n\nOpen the outsourcing case ↓\n2025\nThe second admission\n\n33 months later, Steam Support writes that a technician \"failed to follow our process which resulted in your account restored to someone else.\" Same channel. Same outcome.\n\nDexerto, 14 Nov 2025 ↗\n\nCASE FILE / HFB & THE OUTSOURCING ALLEGATIONS\n\nThe way in was Steam Support itself. Valve said so in writing.\n\nIn the support reply reproduced by Dexerto, Valve's CS:GO team accepts responsibility for an account compromised through the help-request process — its own channel, not a phishing page and not the user. The items were recovered and the trades reversed, which is the remedy Valve tells other victims does not exist. HFB's inventory was reported at $2,000,000+ on the day and $3,000,000+ in the follow-up; Qkss lost $1,000,000+ the same way and got nothing.\n\nSUPPORT REPLY / REPRODUCED BY DEXERTO · 21 FEB 2023\n“compromised through a support help request, for which the CS:GO team takes responsibility”\nRead the reporting and reproduced message ↗ archived 2025-08-18 ↗\n01 / WHAT VALVE ADMITTED\nIts own support channel was the way in\n\nThe reply covers the compromised account and the reversal of its trades. Valve reversed them — so the trades were reversible. The original authenticated ticket is not in this collection.\n\n02 / WHAT THE SACKINGS DID NOT FIX\nThe same door opened again in November 2025\n\nThe contractor dismissed its entire Steam-support staff — reported by Mzkshow via Dexerto, not a Valve personnel statement. Thirty-three months later Steam Support wrote to another collector that \"a support technician that handled the help request failed to follow our process which resulted in your account restored to someone else.\" Valve's own sentence, about the same channel.\n\nThe second admission, 14 Nov 2025 ↗\n03 / WHAT IS OPEN\nValve has never named the contractor\n\nNeither the contractor nor the location is established by these sources. That is not a hole in the reporting — it is a disclosure Valve has not made about who held access to user accounts.\n\nContemporary account of the case ↗\n\nThree questions Valve has not answered: who could override account recovery, what the access audit found, and what changed afterwards.\n\nLater allegations in the preserved support archive\n\nTwo 2024 Reddit posts relay further Mzkshow investigations — a July 2024 VAC-ban removal case and a December 2024 $13,000 inventory case. These are separately reported incidents. The accountability question in each is identical: who had override access, what did the audit find, and what changed.\n\n14 July 2024 · reported recovery / VAC-ban case ↗2 December 2024 · reported $13,000 inventory case ↗ archived 2025-08-05 ↗Two preserved posts, source rows & hashes ↓\n\n05 / FOLLOW THE LOSS\n\nEvery amount needs a case.\n\nTen cases, June 2022 to March 2026. Every amount is the figure its named source published — $6,300,000, $2,000,000+, $1,000,000+, ≈$320,000, ≈$300,000, and down to €288. Valve holds the transaction log, the session record and the support audit trail for each one, and has produced none of them.\n\nAttribution and amounts remain as reported by each source. Valve holds the transaction logs, session records and support audit trail for every one of these cases. Produce them. A preserved Reddit post does not settle the question — Valve's own records do.\n\nTHE COLLECTION / AFTER CHECKING\n\n231,829 accounts on sale. Valve holds the logs for every one.\n354 → 201\nTrustpilot records\n\n153 duplicate rows removed. Individual review URLs were not preserved in the export.\n\n231,829\nSteam account listings\n\n33,509 classified as autoregistered; 198,320 under the collector’s stealer label. Listings are not completed sales.\n\nCollection audit ↓Search the source archive ↗", "headings": [ { "level": 1, "text": "Part II — Account Access, Outsourced Support & Enforcement", "anchor": "pd-investigation_part2--heading-1", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#part2-intro" }, { "level": 2, "text": "Automation has a paper trail.", "anchor": "pd-investigation_part2--heading-2", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#automation-map" }, { "level": 2, "text": "Which key are we talking about?", "anchor": "pd-investigation_part2--heading-3", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#api-distinction" }, { "level": 3, "text": "Personal Web API key", "anchor": "pd-investigation_part2--heading-4", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#api-distinction" }, { "level": 3, "text": "Publisher Web API key", "anchor": "pd-investigation_part2--heading-5", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#api-distinction" }, { "level": 3, "text": "OpenID / session tokens", "anchor": "pd-investigation_part2--heading-6", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#api-distinction" }, { "level": 3, "text": "Automation can use more than an API key.", "anchor": "pd-investigation_part2--heading-7", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#token-documentation-note" }, { "level": 2, "text": "Still playing. Already exposed.", "anchor": "pd-investigation_part2--heading-8", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#unseen-session" }, { "level": 3, "text": "Silent session token capture", "anchor": "pd-investigation_part2--session-hidden-title", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#session-hidden-title" }, { "level": 2, "text": "The item can be rare. The limit stays.", "anchor": "pd-investigation_part2--heading-10", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#market-ceiling" }, { "level": 2, "text": "Entrusted with data. Accountable for access.", "anchor": "pd-investigation_part2--heading-11", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#support-access" }, { "level": 3, "text": "The scale was public", "anchor": "pd-investigation_part2--heading-12", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#support-access" }, { "level": 3, "text": "Valve outsourced the desk — and said so", "anchor": "pd-investigation_part2--heading-13", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#support-access" }, { "level": 3, "text": "The first admission", "anchor": "pd-investigation_part2--heading-14", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#support-access" }, { "level": 3, "text": "The second admission", "anchor": "pd-investigation_part2--heading-15", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#support-access" }, { "level": 3, "text": "The way in was Steam Support itself. Valve said so in writing.", "anchor": "pd-investigation_part2--heading-16", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#outsourcing-case" }, { "level": 4, "text": "Its own support channel was the way in", "anchor": "pd-investigation_part2--heading-17", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#outsourcing-case" }, { "level": 4, "text": "The same door opened again in November 2025", "anchor": "pd-investigation_part2--heading-18", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#outsourcing-case" }, { "level": 4, "text": "Valve has never named the contractor", "anchor": "pd-investigation_part2--heading-19", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#outsourcing-case" }, { "level": 2, "text": "Every amount needs a case.", "anchor": "pd-investigation_part2--heading-20", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#loss-register" }, { "level": 2, "text": "231,829 accounts on sale. Valve holds the logs for every one.", "anchor": "pd-investigation_part2--heading-21", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#part2-sources" }, { "level": 3, "text": "Trustpilot records", "anchor": "pd-investigation_part2--heading-22", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#part2-sources" }, { "level": 3, "text": "Steam account listings", "anchor": "pd-investigation_part2--heading-23", "source_url": "https://phishdestroy.io/steam_dossier/investigation_part2#part2-sources" } ], "links": [ { "label": "Live article", "url": "https://phishdestroy.io/steam_dossier/investigation_part2" }, { "label": "Live Intel: Shadow Market Monitoring (550k+ Live) ↗", "url": "https://phishdestroy.io/live-intel/?category=steam" }, { "label": "Open capture record ↗", "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lzt.market.json" }, { "label": "Open Link Filter trace ↗", "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-evidence-lzt.json" }, { "label": "map provenance", "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/automation-map.json" }, { "label": "Explore the full network ↗", "url": "https://phishdestroy.io/steam_dossier/output_steam_network/network.html" }, { "label": "Repository source data ↓", "url": "https://phishdestroy.io/steam_dossier/output_steam_network/raw_data.json" }, { "label": "API key documentation ↗", "url": "https://partner.steamgames.com/doc/webapi_overview/auth" }, { "label": "archived 2026-09-15 ↗", "url": "https://web.archive.org/web/20260915025812/https://partner.steamgames.com/doc/webapi_overview/auth" }, { "label": "Game-session authentication ↗", "url": "https://partner.steamgames.com/doc/webapi/ISteamUserAuth" }, { "label": "archived 2026-08-29 ↗", "url": "https://web.archive.org/web/20260829124950/https://partner.steamgames.com/doc/webapi/ISteamUserAuth" }, { "label": "Inspect the maintainer’s explanation ↗", "url": "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens" }, { "label": "archived 2026-09-24 ↗", "url": "https://web.archive.org/web/20260924181824/https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens" }, { "label": "Maintainer documentation on token handling ↗", "url": "https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens" }, { "label": "archived 2026-09-24 ↗", "url": "https://web.archive.org/web/20260924181824/https://github.com/DoctorMcKay/node-steam-tradeoffer-manager/wiki/Access-Tokens" }, { "label": "Valve key documentation ↗", "url": "https://partner.steamgames.com/doc/webapi_overview/auth" }, { "label": "archived 2026-09-15 ↗", "url": "https://web.archive.org/web/20260915025812/https://partner.steamgames.com/doc/webapi_overview/auth" }, { "label": "Steam’s market limits ↗", "url": "https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B" }, { "label": "archived 2026-09-21 ↗", "url": "https://web.archive.org/web/20260921022227/https://help.steampowered.com/en/faqs/view/61F0-72B7-9A18-C70B" }, { "label": "Privacy Policy §5.2 ↗", "url": "https://store.steampowered.com/privacy_agreement/" }, { "label": "Valve publication ↗", "url": "https://store.steampowered.com/oldnews/19618" }, { "label": "archived 2026-08-09 ↗", "url": "https://web.archive.org/web/20260809125516/https://store.steampowered.com/oldnews/19618" }, { "label": "Kotaku: Valve on its support ↗", "url": "https://kotaku.com/valve-explains-why-steam-customer-service-is-still-terr-1736988223" }, { "label": "archived 2025-07-11 ↗", "url": "https://web.archive.org/web/20250711004653/https://kotaku.com/valve-explains-why-steam-customer-service-is-still-terr-1736988223" }, { "label": "Dexerto, 14 Nov 2025 ↗", "url": "https://www.dexerto.com/counter-strike-2/valve-saves-hacked-cs2-player-threatened-with-ransom-over-300000-of-rare-stickers-3283135/" }, { "label": "Read the reporting and reproduced message ↗", "url": "https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/" }, { "label": "archived 2025-08-18 ↗", "url": "https://web.archive.org/web/20250818113925/https://www.dexerto.com/csgo/csgo-skins-worth-millions-allegedly-stolen-with-help-from-steam-support-staff-2066939/" }, { "label": "The second admission, 14 Nov 2025 ↗", "url": "https://www.dexerto.com/counter-strike-2/valve-saves-hacked-cs2-player-threatened-with-ransom-over-300000-of-rare-stickers-3283135/" }, { "label": "Contemporary account of the case ↗", "url": "https://lis-skins.com/ru/blog/krupneisaia-mosenniceskaia-sxema-v-istorii-steam/" }, { "label": "14 July 2024 · reported recovery / VAC-ban case ↗", "url": "https://www.reddit.com/r/cs2/comments/1e38jo4/stealing_accounts_and_removing_vac_bans_a_new/" }, { "label": "2 December 2024 · reported $13,000 inventory case ↗", "url": "https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/" }, { "label": "archived 2025-08-05 ↗", "url": "https://web.archive.org/web/20250805141942/https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/" }, { "label": "Two preserved posts, source rows & hashes ↓", "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/outsourcing-archive-records.json" }, { "label": "Collection audit ↓", "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/part2-quality-review.json" }, { "label": "Search the source archive ↗", "url": "https://phishdestroy.io/steam_dossier/steam_evidence_archive" } ], "tables": [], "cited_source_ids": [] }, "resources": [ { "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/auth-route-audit/lzt.market.json", "sha256": "88687d3e26c42f6c2062884509ea9b9a6d65c48afcdfb70421b4d012b413847e", "bytes": 1424 }, { "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-evidence-lzt.json", "sha256": "d071715b8d6520c5fa419b1ed2b245a21b386a83bff7fac184b9918cadf2344a", "bytes": 1912 }, { "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/automation-map.json", "sha256": "922479e161faf44c9ad16683f061cab5c03e64f7d28189bb5b3d4368c7571fb9", "bytes": 12383 }, { "url": "https://phishdestroy.io/steam_dossier/output_steam_network/raw_data.json", "sha256": "3c0764f441b89c125554efa908f73d4d418073974eb39b0f35e989a1beadabc6", "bytes": 1701248 }, { "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/outsourcing-archive-records.json", "sha256": "a827850bb8c4708783d4e8135c6e58a544237375d9805e18ecd12ed594a7df6d", "bytes": 19771 }, { "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/part2-quality-review.json", "sha256": "adbf04384749ce9504f71619a2e65f4c5d8ebf273c9324c95d17e7730f25daee", "bytes": 2248 } ] }