{
  "reviewed_on": "2026-09-20",
  "records": [
    {
      "source_file": "steam_support_tickets_MEGA.json",
      "source_row_one_based": 276,
      "collection_sha256": "82cd7fecb1efd1862e176ac6548f25369295765f511eb01dac2bf4693050f89d",
      "date_utc": "2024-07-14",
      "url": "https://www.reddit.com/r/cs2/comments/1e38jo4/stealing_accounts_and_removing_vac_bans_a_new/",
      "title": "Stealing Accounts and Removing VAC Bans: A New Level of Fraud",
      "text": "\nHello, friends! Today I will tell you a story related to account thefts. The information is taken from the Mzkshow channel.\n\nMzkshow delved into this story back in January of this year and has been closely following its developments ever since. Earlier, he released several series of videos in which it was discovered that Steam support staff were involved in the theft of skins.\n\nMzkshow briefly recounted everything in his video, and the subsequent post will be from his perspective:\n\nIn January of this year, I was contacted by a good friend of mine who always helps me out. Thanks to him, we managed to figure out the story with the Steam employees, for which I'm immensely grateful. He wrote the following: he provided a link to an account and said that the story would be exactly like that of the popular RU-community streamer \"evelone.\" This account was hacked 3 months ago, when it already had a VAC block in CS for more than a year. The true owner tried to recover the account but was asked for a key. In general, the usual. However, someone knew this key and managed to restore the account with such skins.\n\nhttps://ibb.co/jzPKSpB\n\nBut with a VAC ban. I then looked at this account and unfortunately didn't record anything. However, the next day my friend wrote to me again and said that the account's inventory was made private and that soon the VAC would 100% disappear, followed by the skins.\n\nMy reaction was skeptical. It all sounded insane, as lifting a VAC ban and stealing skins is a whole new level of fraud.\n\nThis is not like what I showed you a year ago. Back then, they were just stealing accounts. But lifting a ban and extracting skins is over the top. Let me remind you what we discovered a year ago: there are people who work in cahoots with Steam support staff. The fraudster first finds an abandoned account with a large inventory or an account with a ban that also has a large inventory. Then, they inform their accomplice working in support. After that, the employee reviews all the information about the account, which looks like this.\n\nhttps://ibb.co/9sKtVGK\n\nAfter that, he relays the information back, and then the account is restored through a regular support ticket as they have all the necessary data. Why did I consider this a \"next level\" theft? As far as I know, an ordinary support employee cannot lift a ban in any game. This means it must be done by someone in a much higher position. But let's discuss this in more detail a bit later.\n\nSo, I saved the ID and said I would keep an eye on this account. Just in case, I recorded what it looked like on January 11th.\n\nhttps://ibb.co/s3DkPGs\n\nDays, weeks, and months go by. From time to time, I check on the account, but nothing happens. However, on June 6th, while checking the account again, I notice that the inventory is open and it is empty—there’s nothing in it.\n\nhttps://ibb.co/N96Gn37\n\nI become curious about when exactly the skins were extracted. I go to check inventory changes on Price Empire and find that on May 18th, the account still had skins, but on May 19th, they were gone.\n\nThis account had skins worth approximately $50,000. Yes, the skins alone are worth $26,000, but due to stickers, patterns, and other factors, their real value exceeds $50,000.\n\nhttps://ibb.co/SVnG0j9\n\nhttps://ibb.co/wW42Cwc\n\nSo, the account with the ban was stolen around October 2023, and only in May 2024 were all the skins extracted from it. At the time of the skin extraction, the account still had a ban in CS. If you log into the account now, the ban is still present, but the skins are gone. So, the skins were extracted somehow, bypassing the ban.\n\nhttps://ibb.co/hCf156N\n\nNext, I checked this account using the Steam ID and noticed something strange: it shows that the VAC ban was lifted, but the profile still displays a Game ban.\n\nhttps://ibb.co/KFC7bwb\n\nBut that's not all the oddities.\n\nJust in case, I speculated that maybe the support team removed all the skins. I’ve already shown you that this can happen, but in such cases, they usually remove graffiti and sometimes even medals.\n\nhttps://ibb.co/0249pK1\n\nThe account still has graffiti and medals, which partly disproves my theory. So, the skins were indeed stolen from an account that has a ban in CS. This is incredible.\n\nI continued to monitor the account and the skins. As of today, the skins haven’t appeared anywhere; the data parsers haven’t updated any information. This means they were transferred to a private account and haven't been sold yet. Also, on July 2nd, I noticed that the account's inventory was hidden.\n\nhttps://ibb.co/3Y7V747\n\nThe reason for this is unknown. What's more surprising is that the people who stole the account crafted a few badges and leveled up the Steam account. The account looked like it was at level 32 in January, and now it is at level 35. The badges were crafted on June 29th, just a few days ago. The reason behind these actions is unclear.\n\nhttps://ibb.co/mBZpz5w\nhttps://ibb.co/FHvkwTL\n\nMy assumption: the skins were stolen, and then the account was sold. It would make more sense to entirely delete the account to cover all tracks, which could also happen soon. Perhaps someone has reached a new level in skin theft. I don't exclude that this might have happened before, but I only noticed it now.\n\nMost likely, this is not the end of the story. I will continue to monitor all the skins, and sooner or later they should appear somewhere, allowing us to gather much more information. Let's go back to the fact that the skins were stolen from an account that had a ban in CS.\n\nAs I mentioned, an ordinary support employee cannot lift a ban. But technically, it seems the ban wasn't actually lifted because, in the January log, the account had been banned for 681 days, and now it shows 857 days of the ban. So, the ban wasn’t lifted, but if you check through steamid, it says the ban is possible. This indicator could have been there in January — honestly, I don't remember, and unfortunately, I didn’t record this.\n\nIt turns out that perhaps the ban wasn't lifted, but the skins were extracted despite the ban. But again, who could do this? Clearly, it must be someone who is in some way connected to Steam. There’s no other way to accomplish this. Initially, tell me, who would go through the trouble of stealing an account with a decent inventory but banned in CS? These skins are worthless when there's a ban in CS. So, initially, the account was restored through customer support just to extract the skins. That’s all I have for now, but I’m sure this story isn’t over.\n\nThis is the first time I’ve personally witnessed skins being moved from an account banned by VAC or Overwatch, which is a complete shock to me. What do you think about this, and have you ever encountered something like this? Share your thoughts in the comments. And if you have proof of similar cases, please get in touch with me and support this post with an upvote. Good luck to everyone, and see you soon\n\nVideo:\nhttps://youtu.be/HQqMzO7ddyg?si=TA9XuM6G3lI9bT_s",
      "text_sha256": "d7316775a7f662f88fabb49cd7231afbb837fa2bcd3dc119d345d21562b143f7",
      "source_type": "Reddit retelling of Mzkshow investigation; allegations attributed to that source"
    },
    {
      "source_file": "steam_support_corruption_MEGA.json",
      "source_row_one_based": 54,
      "collection_sha256": "8c727e266fe894f40a667ef369f9d08fcdbba8eddc4e8fb1dc8a4392d0ca026a",
      "date_utc": "2024-12-02",
      "url": "https://www.reddit.com/r/cs2/comments/1h53qp3/steam_support_is_stealing_accounts_again/",
      "title": "Steam support is stealing accounts again.",
      "text": "Hello everyone, friends! Do you remember the post about the support employee who supposedly stole skins? (https://www.reddit.com/r/cs2/comments/1e38jo4/stealing\\_accounts\\_and\\_removing\\_vac\\_bans\\_a\\_new/)  \nWell, it has happened again. The information is taken from the Mzkshow channel. I'm going to share this from the perspective of mzkshow.\n\nMore than a hundred people have reached out to me, claiming that their accounts were stolen by a support staff member. But, of course, in absolutely all cases, that wasn’t true. Each time we began to investigate these stories, it turned out that the person had their email hacked or logged in somewhere they shouldn’t have. Basically, it was just ordinary scamming. The only exception was the case of the account theft of Evelone (a popular Russian-speaking streamer).\n\nBut two months ago, a person wrote to me claiming that their account had been stolen. This was essentially the first time there was a legitimate reason to suspect a support employee. I will tell you about it today.\n\nPlease support this post with an upvote.\n\nAlright, let’s get started.\n\nOn October 2nd, Matvey wrote to me, saying that his account had been stolen, and that it happened with the help of technical support. The inventory on the account was valued at $13,000.\n\n[Matvey:  Hi,  My account, which had $13k on it, was just stolen.  Let me know if you're interested.  Profile link:  Here's the link, they immediately hid it. The account was personal.  It's definitely not a stealer because I don’t download anything on my PC.  There were no unauthorized sessions in my email.  It was stolen through technical support, if anything.  I’ve just submitted a ticket and am waiting for a response.](https://preview.redd.it/08yceoiglh4e1.png?width=1252&format=png&auto=webp&s=477e310a61dda947f60f680e3043584becc7b8d4)\n\nInitially, neither he nor I had any thoughts that any technical support employee could be involved in this.\n\nHowever, it was strange that when he submitted the first ticket for account recovery and provided all the evidence proving that it was his account (including the first activated key), the support team responded that another user had provided more data. How this is possible remains unclear.\n\nhttps://preview.redd.it/wqp98utylh4e1.png?width=707&format=png&auto=webp&s=4ab8be5dff7c08972e8b8897288e575c4d5aa9fc\n\nThen he submitted another ticket using the first email that was linked to the account. The response was the same.\n\nhttps://preview.redd.it/twh01kl1mh4e1.png?width=583&format=png&auto=webp&s=f2b569b01b55a75fa11462b438cae79dbf63d10b\n\nSo, look: Matvey has an email linked to the account, as well as the first email from the account from which he submitted two tickets. In these, he attaches receipts and the first key. Meanwhile, someone else provided more evidence, which seems suspicious. As a result, all his tickets began to be automatically closed.\n\nhttps://preview.redd.it/zr9c2ai6mh4e1.png?width=872&format=png&auto=webp&s=a1b6253ad93663b67196a6958aeb255a702ee7ad\n\nOverall, I don't see anything strange about this. To me, it looks like a typical ticket ban. However, I found out that Matvey was using someone else's email on the account and had been changing it. Nevertheless, as I already mentioned, he has access to both emails. Moreover, he moved to another country a month ago.\n\nRight after this, I immediately recall our investigation from three years ago and how an employee would choose which account to steal back then. The scheme looked as follows: they would hunt for accounts with large inventories, which were then filtered based on two criteria.\n\nThe first criterion was whether the account had been inactive for a long time. If the account fit this criterion, it was targeted. If it was active, the second criterion was checked: was the actual owner still using this account? This was verified, and if the account wasn't with its original owner, it was similarly targeted.\n\nIn this case, the email isn't original, and for the past month, there has been a significant change in the login location. It's easy to assume that the account was purchased.\n\nSo, this was the first red flag that something was off. It’s impossible for someone to provide absolutely all the data for an account, only to be told that someone else submitted more evidence. This is exactly how it played out back when support staff were stealing accounts.\n\nHowever, for now, these are only indirect pieces of evidence and mere speculation. From here, all that was left was to wait and see if the skins appeared anywhere.\n\nhttps://preview.redd.it/6lm7roxfmh4e1.png?width=868&format=png&auto=webp&s=ef00150be0ef54d40d32cc218cbddca7978da4f5\n\nThis is where a problem arose: on all websites that track skins, Matvey’s inventory was not displayed. Even in the history, it was impossible to view the float values of the skins.\n\nhttps://preview.redd.it/jr6a0ashmh4e1.png?width=882&format=png&auto=webp&s=2441ba7740c222a3d8f908f00189567668eac680\n\nBut fortunately, Matvey had purchased most of his skins on websites, and one of those still had an active session. In this regard, he was very lucky, as he still hasn’t been able to recover his account, and almost two months have passed. The session could have expired at any moment.\n\nApologies for the poor screenshots, but at that time, Matvey was away for a week, and we asked his girlfriend to keep an eye on all of this.\n\nhttps://preview.redd.it/8ihlnptlmh4e1.png?width=479&format=png&auto=webp&s=52d21853f56a19803416f97bfef340082344ca1f\n\nhttps://preview.redd.it/a58p3q6nmh4e1.png?width=480&format=png&auto=webp&s=25513fe7d7756ee7c1217750fef8e41361c5ce2b\n\nSo, we managed to gather some data about the skins. We kept waiting, and on October 27, it became visible on CS Float that the skins had been transferred to other accounts. Unfortunately, those accounts have been deleted.\n\nhttps://preview.redd.it/o3yde62smh4e1.png?width=873&format=png&auto=webp&s=fb5a45edb1b017790af4fbcf04401ef7f895deef\n\nhttps://preview.redd.it/fhry5yosmh4e1.png?width=869&format=png&auto=webp&s=8a44ed9fc77562e51c4b542f6d920909f775fb93\n\nWe only noticed this on October 27, even though the site itself parsed the skins on October 24. This is probably not that important. I took screenshots of Matvey’s skins on those accounts. All these skins indeed belong to Matvey, which can be verified through the skins' history. However, that’s not all—we still don’t know where the rest of the skins went.\n\nhttps://preview.redd.it/udlioduumh4e1.png?width=1848&format=png&auto=webp&s=fc3a40467009cba9984994bca8d161140f822502\n\nhttps://preview.redd.it/i5f87kpvmh4e1.png?width=1870&format=png&auto=webp&s=e77a8fc8c1861b133197f93db9646a111bda838f\n\nWe have no information about the float of these skins. Additionally, on November 5, I documented all of this. At the very least, on October 27, we noticed that the skins were transferred to already deleted accounts. It brings to mind a story from three years ago when accounts involved in thefts and the ones receiving stolen skins were being deleted. In this case, Matvey's account wasn’t deleted, only the first accounts that the skins were transferred to.\n\nI emphasize the importance of dates. To delete an account, a request must be submitted. Once approved, the account gets a community ban for 30 days, after which it is deleted. These accounts were already deleted on October 27, meaning the deletion request must have been approved no later than September 27. However, Matvey's account was hacked on October 2. Therefore, it would have been impossible to transfer the skins to these accounts since they were already under a community ban.\n\nhttps://ibb.co/ryWwQ6z\n\nSo how was the account deleted? A regular user can only delete an account through the standard process, which takes 30 days. At this point, I was already entirely convinced that a support team employee was involved because only someone in that role could immediately delete a Steam account. Otherwise, it would be impossible.\n\nYou might say that this is all nonsense and that Matvey fell victim to some basic scam, and the support team simply did a great job by deleting the scammers' accounts along with the skins. But I showed the recording from November 5, where you can see that, according to FT data, the skins were located on the deleted accounts. Twenty days have passed since then, and the skins have gradually spread across different accounts — in other words, they were sold.\n\nThis means that by October 27, when we noticed the account deletions, these skins were already on other accounts that CS Float cannot track. I even waited for this moment and sent friend requests to people who purchased these skins to potentially learn something. One of those people accepted my request and said that he bought these gloves on \\*\\*\\*\\*\\* Market.\n\nhttps://preview.redd.it/1up9y666nh4e1.png?width=828&format=png&auto=webp&s=fe2bcb85ef047c6e7b83aa189f0d1a71f5f1ac06\n\nWhat is \\*\\*\\*\\*\\* Market? I had never heard of such a site before, but it turned out to be some kind of P2P site. I also asked this person to send me a link to the account from which he received these gloves.\n\nhttps://preview.redd.it/if9we6hbnh4e1.png?width=561&format=png&auto=webp&s=0f98587edef3c8be8f896047d3dad28730626e8d\n\nHere is that account.\n\nhttps://preview.redd.it/jqq8d5kcnh4e1.png?width=850&format=png&auto=webp&s=98e81ceb188c10e12b44b38b7aa1abfd13fdf569\n\nI don’t know if this account is connected to the people who stole Matvey’s account, but somehow, at least one stolen skin ended up with them.\n\nAs you can understand, in the end, all of Matvey’s skins had already been sold. What do we have at the moment? Someone restored Matvey’s account by providing more evidence than the first activated key. This is undoubtedly surprising. Then Matvey's skins were transferred to several other accounts, which also distributed them further down the chain. After that, somehow, these accounts were instantly deleted — something that, I remind you, is impossible to do without the involvement of technical support staff.\n\nThe choice of targeting Matvey’s account is probably related to the fact that it had an unoriginal email linked to it, location changes, as well as an inventory worth $13,000. This seems quite logical. I am 100% sure that such actions are happening on a large scale, and this is not the first case. If you’ve encountered a similar situation where accounts to which skins were transferred were instantly deleted, please write to me with evidence. Perhaps, as we did three years ago, we can sort out in more detail who is behind this and how they’re doing it.\n\n[webword2012@ya.ru](mailto:webword2012@ya.ru) (if he doesn’t respond, try reaching out to me, and I’ll try to contact him).\n\nI am also interested in hearing your opinion: do you agree with me that technical support staff are clearly involved here, or do you think otherwise? If so, please share your arguments. That’s all from me. Good luck to everyone, and see you soon!\n\n[Video](https://www.youtube.com/watch?v=yIB9GLzUDIs&t=87s)",
      "text_sha256": "aef011f4adddab0d3209eac68c20520669ed4b4e9843ec2713b4f58a7759bd3f",
      "source_type": "Reddit retelling of Mzkshow investigation; allegations attributed to that source"
    }
  ],
  "scope": "Two distinct posts, not a count of independently verified insider-theft incidents."
}