# Steam Support: Replies, Recovery & Refusals — The Steam Dossier

Canonical: https://phishdestroy.io/steam_dossier/support_canned_refusals
Language: en
Attribution: PhishDestroy Team
Reading edition: 18 October 2026.

Evidence file S-01 / Steam Support Updated 18 October 2026

 

## After the loss. *Read the reply.*

 

Recovery decisions, restoration refusals and closed requests. Put the support wording beside the reported outcome, then follow it back to the source.

 

**9,051** 

collected rows · 17 October 2026

 

2,961

Tier A response material

6,090

Tier B incident reports

 

The collector’s tiers describe the material supplied. Rows are not unique victims or independently authenticated tickets.

 

01 / A new entry in the recovery record 

## The authenticator was removed. The request was disputed.

A ticket image published on 13 October 2026 adds a concrete sequence to the dossier’s question: who can reset the safeguards, and what evidence do they accept?

 

The published exchange first asks for a registered CD key. After the requester says they did not retain one, a support reply says ownership has been verified and the authenticator removed.

 

> “I've removed the authenticator from your account.”

 

A later message challenges the request: This request was not made by me, my login was hacked. It asks support not to change the email address and to explain how a third party could remove two-factor authentication.

 

[Published account & ticket ↗](https://www.reddit.com/r/SteamScams/comments/1x4vyuk/)  [Read the support-access investigation →](https://phishdestroy.io/steam_dossier/#insider-threat)

 

[![The authenticator was removed. The request was disputed. — detail from the published support image](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/recovery-2026.webp)](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/recovery-2026.png) 

**Published ticket image.**  Account, payment and staff identifiers were already covered in the supplied image. The full image preserves those redactions.

 

1. 29 Sep · 2:43pm**Removal requested** 
  
  The requester describes a changed phone and a missing recovery code.
2. 29 Sep · 6:27pm**A CD key is requested** 
  
  Support asks for the registered key and an image of it.
3. 30 Sep · 6:50am**Authenticator removed** 
  
  After a reassessment, support says ownership was verified.
4. 30 Sep · 12:24pm**The request is challenged** 
  
  A later message says the request was unauthorized.

 

The poster identifies the first requester as an attacker. The image records the exchange, but does not authenticate the participants or reveal checks performed outside it. It does not establish staff complicity or a completed inventory theft. A  [related cross-post](https://www.reddit.com/r/SteamScams/comments/1x4bm11/)  is also present in Tier B; it is not an additional victim. Times above are those shown in the image, with no timezone specified.

 

02 / The response and its limits 

## What the reply actually records.

Six ticket images have been read for these selected examples. Each full capture remains available. Their wording supports specific observations; the surrounding allegations need their own evidence.

 

[![A reported theft. An economic reason for refusal. — detail from the published support image](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/restoration-policy-reply.webp)](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/restoration-policy-reply.png) 

**Published ticket image.**  The preview isolates the support reply. The full capture also includes the player's request.

Dota 2 · published 14 July 2020 

### A reported theft. An economic reason for refusal.

The player reports losing items after changing their password and following support guidance. The reply acknowledges removal without permission, refuses restoration, and invokes duplication, scarcity and the item economy.

> “Steam Support does not restore scammed, lost, or stolen items for any reason.”

This is a published reply image. It does not establish the attack vector, the inventory value, or whether the account-security advice was followed successfully.

[Read the source publication ↗](https://www.reddit.com/r/DotA2/comments/hr5csj/)

 

[![The substituted trade is described in the reply. — detail from the published support image](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/trade-substitution-reply.webp)](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/trade-substitution-reply.png) 

**Published ticket image.**  The preview crops the Steam desktop frame. The full capture is available for context.

CS:GO · capture displays 23 April 2020 

### The substituted trade is described in the reply.

Support describes a compromiser observing and cancelling a trade offer, copying the intended partner's profile and sending a replacement offer. The same exchange refuses item restoration.

> “Unfortunately, we do not restore items in accordance with Steam's Item Restoration Policy.”

The visible account describes trade substitution. This image alone does not prove that an API key, rather than another form of account access, enabled it. The date comes from the capture, not a verified publication timestamp.

[Read the source publication ↗](https://www.reddit.com/r/csgo/comments/g6detw/sometimes_in_life_a_bystander_is_no_less_than_a/)

 

[![Unauthorized use acknowledged. The request closed. — detail from the published support image](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/market-request-closed.webp)](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/market-request-closed.png) 

**Published ticket image.**  The full image includes the reply and the closed-request notice.

Community Market · published 21 January 2025 

### Unauthorized use acknowledged. The request closed.

A reply dated 20 January acknowledges that the account was used without permission, says Market activity cannot be reversed, directs the user to report through the Community, and announces closure of the request. A closed-request notice is visible below it.

> “Since there's not much more that I can say or do to be of help with this particular issue, I am going to close this help request.”

The image supports the wording and closure shown. It does not establish the value lost or the mechanism of unauthorized access. This Market reply predates the current CS2 Trade Protection system.

[Read the source publication ↗](https://www.reddit.com/r/steamsupport/comments/1i6dsqy/)

 

[![Items removed. The account unlocked with a warning. — detail from the published support image](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/market-removal-and-unlock.webp)](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/market-removal-and-unlock.png) 

**Published ticket image.**  The complete supplied reply is shown.

Market enforcement · published 8 September 2025 

### Items removed. The account unlocked with a warning.

The reply alleges that inflated-price sales involved fraudulent funds. It records the removal of items, games and Wallet funds, refuses their restoration, and says the account has been unlocked with a final warning.

> “We have removed items and games added to the account since these transactions as well as any remaining fraudulent wallet funds.”

This is a recorded enforcement action and a partial resolution, not evidence that the fraud allegation was correct. It should not be counted as a simple refusal to help.

[Read the source publication ↗](https://www.reddit.com/r/steamsupport/comments/1nb9vig/)

 

Repeated restoration wording 

> “does not restore scammed, lost, or stolen items”

22 Tier A report rows · 18 source groups, including one local reference without a public URL

 [Inspect the matching rows →](https://phishdestroy.io/steam_dossier/support_canned_refusals.html?phrase=restoration#support-browser)

 

Repeated closure wording 

> “I am going to close this help request”

6 Tier A report rows · 6 normalized source URLs

 [Inspect the matching rows →](https://phishdestroy.io/steam_dossier/support_canned_refusals.html?phrase=closure#support-browser)

 

These are literal phrase matches in the collected support-text field, after normalizing whitespace and case. Policy pages, login text and search snippets are excluded from these counts. Repeated wording establishes reuse of language; it does not by itself establish that a bot handled a request.

 

03 / Keep the differences in the record 

## Restoration, deletion and reversal are different decisions.

The collection includes positive outcomes and statements of discretion. Counting every row as a refusal would erase that evidence.

 

Team Fortress 2 · reply displays 2 September 

### Deleted items: a reply describes discretion.

> “We consider item restorations requests on a case-by-case basis”

In response to a question about deleted items, support describes case-by-case consideration and a typical 14-day window. The reply says support cannot explain the reason for the policy.

This concerns deleted items, not items transferred to another account. It is a statement about possible consideration, not proof that this player received a restoration. The supplied record does not establish the year.

[Source publication ↗](https://www.reddit.com/r/tf2/comments/167wf9h/steam_support_do_actually_restore_deleted_items/)  [Inspect the full image ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/deleted-item-exception.png)

![Selected reply discussing case-by-case restoration of deleted items](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/images/deleted-item-exception.webp)

Selected detail. The full image and its source remain linked above.

 

CS:GO · published 29 September 2015 

### The collection also records a restoration.

> “We have made an exception to our item restoration policy in this case”

The poster reports that a VAC ban was removed and items returned after an account compromise. The text quotes a support reply describing an exception to the restoration policy and reversal of actions taken during the compromise.

This is a quotation in a public post, not a ticket image inspected here. It describes a historical exception and does not establish a current entitlement or the frequency of restorations.

[Source publication ↗](https://www.reddit.com/r/GlobalOffensive/comments/3mtm0u/)

 

**Read older replies against the current product.** 

Steam’s  [item-restoration policy](https://help.steampowered.com/en/faqs/view/3B6E-B322-2400-8D24)  and its  [Trade Protection rules](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD)  cover different mechanisms. The latter currently provides a seven-day reversal window for eligible CS2 trades. It should not be generalized to Community Market transactions, TF2 deleted items, every game, or older screenshots. See the dossier’s  [comparison of protection across three games →](https://phishdestroy.io/steam_dossier/three-games-and-security.html)

 

04 / Source register 

## Search the collection. Open the source.

Start with Tier A report rows, or switch to Tier B and the policy material. Grouping combines repeated source URLs without pretending they are independent cases.

 

Titles, summaries, tags and transcriptions are collection material. The selected readings above have an additional editorial note. The default view separates policy pages and obvious non-case material from report rows.

 

[Search all 9,051 collection rows, inspect source groups and download filtered records online.](https://phishdestroy.io/steam_dossier/support_canned_refusals#support-browser)

 

05 / Count what was supplied 

## A collection of records. Not a count of victims.

Collection dated 17 October 2026; integrated and counted on 18 October. The original archive is preserved with a SHA-256 fingerprint. Public reading files omit private contact details and credentials where detected.

 

**Tier A: 2,961 rows.**  The collector labels 2,375 as quoted text, 571 as screenshot material and 15 as template matches. Of these rows, 2,935 contain non-empty support text. These labels do not authenticate the reply or prove the accompanying allegation.

 

**Tier B: 6,090 rows.**  Reports and other incident material that did not qualify for the collector’s Tier A. A user’s description is not a quotation or admission by Valve.

 

- **8,252 distinct supplied source references; 7,965 normalized source groups**  across A+B. Grouping resolves relative Reddit links, removes tracking and language variants and normalizes thread URLs. Different URLs may still describe the same event.
- **9,030 rows have a public source URL.**  We resolved 44 relative Reddit paths. The other 21 rows cite local collection files and are explicitly marked as lacking a public source link; their paths are not published. These local references remain separate groups.
- **641 distinct image files**  were supplied. Six selected ticket images are reproduced here; other records retain links to their original publications.
- **223 policy-context rows, 20 login-page rows and 2 search-result rows**  are retained as context, outside the default report view. This is a limited source-type check, not a claim that every remaining row is relevant or verified.
- **5,727 Tier L leads are separate.**  They do not contribute to the 9,051-row total or the phrase counts. Reverse-image matches and search leads require verification and can repeat a single image.
- **Dates are not interchangeable.**  Register dates use valid supplied publication timestamps. A screenshot’s visible date or a ban expiry, including 2038 dates, is not silently treated as an incident date.

 

**Why these counts differ from the supplied inventory**

The delivered Tier A files contain 2,619 distinct values in the source field and 2,440 distinct non-empty support-text values. Its HTML exhibit file references 539 distinct image paths. The inventory text lists lower totals for these measures. Source fields include both web addresses and local references. This page uses counts recomputed from the delivered files, keeps their definitions explicit, and does not use either set as a count of independent cases.

 

Original collection tags · row counts, including context

| Topic | Tier A | Tier B |
| --- | --- | --- |
| Item restoration | 860 | 544 |
| Ban disputes | 834 | 609 |
| Account recovery | 507 | 724 |
| Reported theft | 378 | 3,158 |
| Closed or unanswered requests | 266 | 755 |
| Transaction reversals | 79 | 29 |
| API-key complaints | 22 | 220 |
| Authenticator removal | 15 | 51 |
| Total | 2,961 | 6,090 |

The tags are inherited from the collector. For example, a restoration tag can contain a policy page or an exception. Read the source and the selected annotations before drawing a conclusion.

 

### Take the record with you.

[All A+B rows · CSV ↓](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/records.csv)  [Reading dataset · JSON ↓](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/records.json)  [Counts & file hashes ↗](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/manifest.json)  [Tier L research leads · CSV ↓](https://phishdestroy.io/steam_dossier/steam_tos_assets/support-collection-2026-10-17/leads.csv)

The exports preserve source IDs, links, collector tiers and tags. They contain the public reading fields, not an unredacted copy of every scraped page. The earlier  [1,505-row support collection](https://phishdestroy.io/steam_dossier/VALVE_EVIDENCE_PACK/support_tickets_archive/MASTER_SUPPORT_EVIDENCE_DATABASE.json)  remains available as a separate historical file; the two totals are not added together.

Original archive SHA-256 54ae8632e3336df320b13cf5e8a09d50f428681563fdb15c810b8dd569b79b59