# Three games. Unequal protection. Canonical: https://phishdestroy.io/steam_dossier/three-games-and-security Language: en Author: Agent Nadia Publisher: PhishDestroy Published: 11 October 2026 THREE GAMES / VALUE / SECURITY / ENFORCEMENT REVIEWED 11 OCT 2026 · UTC THE DEFENCE NAMES ALL THREE. Valve must answer for every game it puts behind its defence. The New York response brings CS2, Dota 2 and Team Fortress 2 into one account of value, security and consumer rights. The documented controls do not cover them equally. Follow the gap between the statement, the protection available to a victim and the power Valve exercises over the same assets. [Compare the protection ↓](https://phishdestroy.io/steam_dossier/three-games-and-security#protection-scope) [Read the Canadian record ↗](https://phishdestroy.io/steam_dossier/three-games-and-security#canadian-order) VALVE’S WORDS / VALVE’S POLICY **3** games addressed in the public defence [Read the response ↗](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5) **1** game supported by trade reversal [Read the policy ↗](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD) **CS2** 7-day reversal **Dota 2** No completed-trade reversal **TF2** No completed-trade reversal The comparison is specific: inclusion in Valve’s defence versus support for reversing a completed Trade Protected trade. [2019 / VALVE’S OWN REMEDY **The TF2 crate failure** Freeze, restore, refund: a designed exception. **↗**](https://phishdestroy.io/steam_dossier/three-games-and-security#tf2-remedy) [2019 / VALVE’S FRAUD ADMISSION **The key Valve stopped** An item used to move monetary value. **↗**](https://phishdestroy.io/steam_dossier/three-games-and-security#key-change) [2024 / ONTARIO COURT ORDER **The Pleterski account trail** Five accounts and a documented disclosure. **↗**](https://phishdestroy.io/steam_dossier/three-games-and-security#canadian-order) [2022–2025 / REPORTED LOSSES **The user left with the bill** Wallet purchases and a disputed recovery. **↗**](https://phishdestroy.io/steam_dossier/three-games-and-security#victim-records) 01 EXISTING LAW / A GLOBAL PLATFORM ## A New York case. A system used worldwide. A greeting addressed to New Yorkers does not confine the economic mechanism to New York. Valve operates the account, inventory and transfer infrastructure across territories. The question is how existing law applies to the transactions it offers. THE FILED CLAIM ### All three games are in the complaint. The 25 February 2026 filing expressly examines TF2 and Dota 2 alongside Counter-Strike. Paragraphs 67–74 describe their paid random-item mechanisms. Naming all three in the response therefore creates a responsibility to explain protection in each. [E38](https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf) THE LEGAL QUESTION ### Does the existing prohibition apply? NYAG invokes existing New York law and seeks an injunction, consumer financial relief, disgorgement and a penalty. Valve’s preference for future legislation does not decide that dispute. The requested relief is set out on PDF pages 50–51. [E38](https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf) THE WIDER CONSEQUENCE The case tests a mechanism used across Steam: paid random outcomes, transferable items, outside liquidity and the issuer’s control. The consequences matter wherever that mechanism operates. Valve should explain which product and infrastructure changes it would make, which users would receive protection and how it would apply those changes across its games and markets. STEAM CHINA / VALVE’S PUBLISHED PARTNERSHIP ### Territorial adaptation is already part of Valve’s business. Valve’s Steamworks documentation identifies Perfect World as the partner for an onshore Steam China. It requires government approval before a game is published there and an ISBN displayed on the product page. Valve can therefore describe regional partners, approval requirements and a distinct product configuration when that is how it enters a market. [E110](https://partner.steamgames.com/doc/store/china?l=english) The comparison sharpens the New York question: Valve has already configured a separate product for another territory, so it must identify the protections it can extend here, the alternatives it rejected and the cost it accepted. The [Russian funding-provider record](https://phishdestroy.io/steam_dossier/money-and-enforcement.html#regional-funding) raises a separate demand for intermediaries, territorial controls and the transactions they process. [THE IMPLEMENTATION RECORD **Netherlands. Belgium. France. Germany.** Valve has already changed container access by territory ↗](https://phishdestroy.io/steam_dossier/privacy-and-enforcement.html#regional-control) ONE STATE / A WORLDWIDE PRODUCT ### The address line does not define the system. Valve writes to New York players of CS2, Dota 2 and Team Fortress 2. The account system, trading infrastructure and commercial incentives reach across those communities and borders. PhishDestroy’s question is broader than the letter’s local audience: how does Valve justify the same machinery wherever it operates? A ruling in one jurisdiction has its own legal scope, but the product facts it examines are facts about Valve’s system. Valve should explain the consequences for that system and its users, rather than reduce the dispute to the preferences of one state. The demand is for accountability under the applicable rules—not a special law written around Steam’s business model. 02 THE SCOPE OMITTED FROM THE REASSURANCE ## Who can actually get the items back? A completed-trade reversal and a delay before delivery do different jobs. A platform-wide defence should identify which remedy each player receives. THREE GAMES IN THE DEFENCE PROTECTION SCOPE · 11 OCT 2026 01 / NAMED IN VALVE’S RESPONSE ### Counter-Strike 2 **7 days** Completed-trade reversal Reversal Yes · 7 days After delivery Immediate delivery; protected items cannot move again during the window. Before delivery CS2 is excluded from the old hold / escrow system. 02 / NAMED IN VALVE’S RESPONSE ### Dota 2 **No reversal** Completed-trade reversal Reversal Not supported After delivery General account, trade and item restrictions still apply. Before delivery The general policy can hold delivery for up to 15 days depending on authenticator conditions. A hold delays delivery; it does not reverse a completed transfer. 03 / NAMED IN VALVE’S RESPONSE ### Team Fortress 2 **No reversal** Completed-trade reversal Reversal Not supported After delivery General account, trade and item restrictions still apply. Before delivery The general policy can hold delivery for up to 15 days depending on authenticator conditions. A hold delays delivery; it does not reverse a completed transfer. TWO CONTROLS. TWO DIFFERENT MOMENTS. ### A hold delays delivery. A reversal returns a completed trade. **Counter-Strike 2** Completed-trade protection No old-style escrow **7 days** Eligible trades can be reversed **Dota 2 / Team Fortress 2** General before-delivery hold **Up to 15 days** Depending on authenticator conditions No completed-trade reversal The general hold policy and CS2’s completed-trade protection operate on different sides of delivery. [E103 Holds](https://help.steampowered.com/en/faqs/view/34A1-EA3F-83ED-54AB) [E32 Reversal](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD) The Trade Protection FAQ names CS2 as the only supported game. Reversal undoes all protected trades from the preceding seven days and imposes a 30-day trade and Market cooldown on the initiator. Counterparties do not receive that cooldown merely because another person reversed. [E32](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD) THE ACCOUNTABILITY GAP **Dota 2 and TF2 users appear in the defence. They do not receive the reversal it invokes.** Valve should publish the reason for the difference, the rollout timetable and the theft losses left outside the remedy. 02 AUG **2019** TEAM FORTRESS 2 THE REMEDY VALVE DESIGNED ### When rarity broke, Valve designed a remedy. A July 2019 bug made some crates produce an Unusual hat on every opening. Valve fixed it the following morning and locked the affected hats. Its announced remedy made the first affected hat per account tradable, kept additional ones locked, restored qualifying deleted hats and offered eligible refunds for hats, crates and keys. The 16 August update confirmed the selective release. [E107](https://www.teamfortress.com/post.php?id=53025) 1. 01 **Identify** Locate the hats created by the crate bug. 2. 02 **Control** Release the first affected hat; keep additional hats locked. 3. 03 **Restore / refund** Restore qualifying deleted hats and offer eligible refunds. **That is active administration of scarcity and consumer remedies.** Put the same specificity into the theft policy: identify the affected item, the available intervention, the reason for refusal and who bears the loss. THE PLAYER’S COLLECTION ### A collection is more than its resale price. Items can serve as an appearance, a remembered collection and an exchange instrument at the same time. Preserved Dota testimony describes cosmetics as support for the game and a refused restoration. This is an account of personal loss beyond the case-opening transaction. [E102](https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-support-records.json) PERSONAL ATTACHMENT / ITEM CIRCULATION The Dota cases show an inventory functioning as a personal collection: attached to a hero, a period of play and the player’s own history. A lower resale price does not make its theft a minor loss. Some players describe leaving after losing that collection. Their experience belongs in Valve’s security account alongside the price of the stolen items. CS2’s outside markets and gambling services assign another role to highly liquid items: a repeatedly transferred store of exchange value. Dota Arcanas and TF2 keys also have specific trading roles, but a game-wide slogan about “cosmetics” hides these differences. Our question is why Valve addresses all three communities together while offering different recovery mechanisms and leaving each community’s losses unaccounted for. PHISHDESTROY’S COMPARISON / THREE DIFFERENT ITEM ROLES #### Attachment. Circulation. Recovery. Choose a game to follow the role highlighted in this investigation. This is a qualitative comparison of the cases and instruments discussed below. CS2 / SELECTED LIQUID SKINS 01 / THE PLAYER **A favourite appearance.** A skin can become part of the player’s loadout and identity. 02 / THE OUTSIDE ECONOMY **A circulating instrument.** Selected liquid skins are priced, transferred and used for settlement by outside markets and gambling services. 03 / THE REMEDY **Protected trades.** CS2 has the trade-reversal route described in Valve’s Trade Protection FAQ. Market and Wallet losses have other rules. [E32 Trade Protection](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD) · [Outside settlement record ↗](https://phishdestroy.io/steam_dossier/trade-tracking.html) DOTA 2 / THE PERSONAL COLLECTION 01 / THE PLAYER **A hero. A history.** Victim accounts centre on a collection attached to a hero, a style and years of play. 02 / THE OUTSIDE ECONOMY **Item-specific liquidity.** Arcanas and other transferable items have trading roles. Price alone does not account for the personal loss. 03 / THE REMEDY **Outside CS2’s reversal.** The FAQ’s supported-game scope leaves Dota outside that recovery route. Valve should explain its protection and restoration policy. [E102 Preserved Dota testimony](https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-support-records.json) · [E32 Supported-game scope](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD) TF2 / THE KEY AND THE COLLECTION 01 / THE PLAYER **A collected identity.** Cosmetic appearance and rarity remain part of what the player values. 02 / THE OUTSIDE ECONOMY **A tradable key.** The Mann Co. Supply Crate Key is documented as tradable and marketable. Follow its role after the CS:GO key restriction. 03 / THE REMEDY **A different intervention.** Valve designed a selective remedy for the 2019 issuance bug. Theft recovery and CS2’s trade reversal need their own explanation. [E81 TF2 key](https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key) · [E107 Issuance-bug remedy](https://www.teamfortress.com/post.php?id=53025) PhishDestroy’s comparison of attachment, circulation and recovery. THE INVESTIGATION’S COMPARISON ### A favourite item and a circulating chip have different roles. The Dota testimony shows a collection becoming personal through its connection to a hero, a style and years of play. Losing it can remove part of the reason to return to the game. The significance of that loss is not captured by a cheap item’s market price. The victim reports belong beside the financial ledger, because the harm includes the relationship with the game. In the CS2 services examined by this investigation, selected liquid skins function as exchange instruments: deposited, priced, wagered, transferred and resold. Their usefulness to the surrounding business depends on movement. A player keeping a favourite skin indefinitely contributes differently from a player repeatedly circulating value through trades, markets and gambling services. PhishDestroy’s criticism is that this circulation has become a commercial dependency around CS2. Outside platforms recruit and monetise the movement of Steam-issued items, while the player carries the risk of theft, restrictions and failed recovery. The “purely cosmetic” description leaves this economic machinery out of the explanation. Dota Arcanas and TF2 keys require their own item-level analysis. Their trading roles do not erase the personal significance of another player’s collection. Addressing all three communities creates a duty to explain each game’s losses and remedies, rather than borrow a CS2 protection feature as reassurance for everyone. [Follow the transaction mechanism ↗](https://phishdestroy.io/steam_dossier/gambling-system.html) · [Follow the outside settlement services ↗](https://phishdestroy.io/steam_dossier/trade-tracking.html) 03 THE ISSUER’S ADMISSION / THE COURT’S ORDER ## The monetary function was already on the record. VALVE / KEY CHANGE **28 OCT 2019** ### Valve stopped newly purchased CS:GO keys from circulating. Valve said fraud networks were using keys to liquidate proceeds and believed nearly all purchased keys subsequently traded or sold were fraud-sourced. It made new in-game key purchases non-tradable and non-marketable. Existing keys retained those functions. [E94](https://blog.counter-strike.net/2019/10/26113/) Valve’s own explanation identifies a monetary use for game items and a restriction the issuer could impose. The distinction between existing keys and new purchases also shows how precisely it could change the trading function. TF2’s Mann Co. Supply Crate Key remains a documented tradable and marketable instrument. After Valve restricted new CS:GO keys in 2019, what monitoring followed the other liquid instruments on its own platform? Publish the cross-game review, the services identified and the restrictions actually applied. The issuer cannot end its explanation at the boundary between two games. [E81](https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key) 08 JUN 2018 OPSKINS / A NAMED TARGET AND A DEADLINE ### Valve could direct enforcement at the operator. After ExpressTrade launched, Valve said it violated the Subscriber Agreement and enabled avoidance of Valve’s policies. The company published a demand to stop and announced that OPSkins’ Steam accounts would be locked by 21 June. [E108](https://blog.counter-strike.net/expresstrade/) The record names a business, a practice and an account-level deadline. Apply that level of detail to the operators warned in 2016 and to the later P2P model: what was disabled, what reappeared and which business actually lost the ability to operate? [The transition to player-held inventory ↗](https://phishdestroy.io/steam_dossier/valve-and-enforcement.html#p2p-enforcement) ONTARIO / PLETERSKI & AP PRIVATE EQUITY ORDER + TRUSTEE’S REPORT THE CANADIAN ORDER TESTED VALVE’S CONTROL. ### Disclose the records. Freeze the accounts. 06 JUN 2024 The Ontario court ordered Steam to disclose account information and freeze the bankrupt’s accounts. 25 JUN 2024 The trustee records receiving login, account, inventory and trade histories for five accounts. **153+** skins in the trustee’s trade analysis **CAD 430,312** trustee’s estimated value The 11 July report concerns Aiden Pleterski and AP Private Equity. The trustee identifies more than 100 trades during bankruptcy and infers cryptocurrency settlement. The court order and the records subsequently supplied by Steam show that inventory, account histories and transfer restrictions can become concrete instruments of asset recovery. [E95](https://doanegrantthornton-docs.webpal.net/document-folder/viewer/docul8LWsxcWho7J/31250879551604896) [Order §§3–4 · PDF p. 12 ↗](https://doanegrantthornton-docs.webpal.net/document-folder/viewer/docul8LWsxcWho7J/31250879551604896#page=12) THE ENFORCEMENT DEMAND **Follow the item, identify the account, preserve the history and explain the restriction.** Those are concrete requests directed at the issuer and custodian of the record. The Canadian file gives the investigation a documented example to put beside Valve’s general statements about control. [THE SEPARATE TERRITORIAL QUESTION **Trace the regional funding intermediaries.** The MTS page, payment terms and records needed to assess sanctions exposure ↗](https://phishdestroy.io/steam_dossier/money-and-enforcement.html#regional-funding) AFTER THE 2019 KEY RESTRICTION ### The monetary function did not disappear with one restriction. Valve’s own 2019 explanation records fraud networks using CS:GO keys to liquidate proceeds. The company then changed what newly purchased keys could do. That admission is central to this investigation: the issuer knew that a game item could serve as a financial instrument and could intervene in its circulation. [E94](https://blog.counter-strike.net/2019/10/26113/) The next question follows the value into other instruments and services: pre-existing keys, TF2 keys, liquid skins, outside exchanges and cryptocurrency settlement. Our investigation asks what Valve monitored after the change, which routes it identified and how its controls followed the displaced activity. The Canadian asset-recovery file supplies a concrete account-and-inventory trail to place alongside that question. The payment chapters examine intermediaries, territorial restrictions and the movement from skins into platform balances, vouchers and cryptocurrency. The inquiry follows those documented mechanisms; it does not need an unrelated scandal to explain why the “cosmetic” label is economically inadequate. [E95](https://doanegrantthornton-docs.webpal.net/document-folder/viewer/docul8LWsxcWho7J/31250879551604896) [Follow the voucher route ↗](https://phishdestroy.io/steam_dossier/aml-data.html#gift-code-route) · [Follow custody and release control ↗](https://phishdestroy.io/steam_dossier/aml-data.html#wallet-custody) 04 KNOWN LOSSES / MEASURABLE RESPONSIBILITY ## A ban total cannot replace a security loss ledger. VALVE’S OWN HISTORICAL FIGURE **77,000** accounts hijacked and emptied per month In December 2015, Valve reported this scale and described organised theft aimed at experienced users as well as newcomers. It also recognised the monetary incentive created by item trading. This is a dated baseline, not a current monthly estimate or a cumulative count. [E96](https://store.steampowered.com/oldnews/19618) How much loss followed a known defect, and how long did Valve leave that defect in place? Answering requires the incident records, notice dates, fixes and remedies in Valve’s possession. Neither the 2015 figure nor the later million-account total — the March 2026 statement reporting over one million locked accounts [E14](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5) — supplies that breakdown. POSTED 07 JUL 2022 DOTA / WALLET LOSS REPORT ### 44 purchases. About US$500 lost. The author reports unauthorised purchases of low-value Dota items on 6 July and says support sent template replies. The disputed route is the Market and Wallet. [E102](https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-support-records.json) [Read the original account ↗](https://www.reddit.com/r/DotA2/comments/vt76ov/funds_stolen_through_steam_market_disappointed/) POSTED 09 MAY 2025 QUÉBEC / RECOVERY DISPUTE ### About US$10,000. A disputed support reset. The author reports that support reset credentials and removed protections in an earlier incident, followed by inventory theft and refusal to restore. The authenticated recovery decision sits in Valve’s support records; Valve should produce it. [E102](https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-support-records.json) [Read the original account ↗](https://www.reddit.com/r/legaladvice/comments/1kipjde/got_10k_stollen_from_steam_inventory_due_to_steam/) These are dated victim reports. The account and support logs that would settle them are held by Valve and belong in the disclosure demand. A standard warning about suspicious links does not resolve the specific transaction or recovery decision being disputed. 01 / ACCOUNT AUTHORITY ### Keys and sessions Record the credential involved, its creation and use, confirmation prompts and the actions it authorised. The historical key-registration issue and the later session-token workflows must be tested separately. [Historical API-key record ↗](https://phishdestroy.io/steam_dossier/steam-access.html#key-history) 02 / ITEM MOVEMENT ### Trades and Market sales A substituted trade, a direct transfer and a Market purchase move value differently. Identify the receiving account, the confirmation event and the remedy applicable to that route. [The Market loss route ↗](https://phishdestroy.io/steam_dossier/money-and-enforcement.html#market-losses) 03 / CLIENT EXPOSURE ### Browser and recovery A malicious page, a renderer exploit and a support-mediated account reset need their own evidence. A single label such as “API scam” conceals the stage where protection failed. [The dated filter audit ↗](https://phishdestroy.io/steam_dossier/steam-access.html#link-filter) STEAMWEBHELPER / CEF / DESTINATION CHECKS ### Valve owns the protection delivered inside its client. DARKNAVY’s June 2024 research documents Steam’s embedded Chromium architecture and historical exploitation. It puts the browser security timeline directly into the accountability record: exposure, disclosure, patching and the consequences for users. [E47](https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/) Chromium documents Google-service and API integration choices; the CEF maintainer describes its upstream Safe Browsing default. Valve controls the configuration it ships. It should disclose its actual service connections, reputation checks, patching cadence and the reasons for excluding any available protection. [E104](https://www.chromium.org/developers/how-tos/api-keys/) [E97](https://www.magpcss.org/ceforum/viewtopic.php?f=7&t=20220) THE DISCLOSURE THAT WOULD SETTLE IT Publish the shipped CEF version, patch lag, sandbox settings, active reputation services and reproducible warning results across the client, overlay and Big Picture. Compare the same dated destinations and record which protection actually stopped the visit. The dossier’s embedded-browser investigation places the user’s actual protection on the record. A failed warning in a captured build is a concrete failure to address. Valve controls the shipped configuration and should disclose which services it enables, which it excludes, how quickly it patches and what those choices mean for users exposed to malicious destinations. [Read the wider browser investigation ↗](https://phishdestroy.io/steam_dossier/) VAC / KERNEL ACCESS / PLATFORM STRATEGY ### Valve chooses the architecture. Users bear the consequences. THE COMPARISON VALVE MUST ANSWER ### Kernel-level protection is already deployed. Riot documents Vanguard’s kernel-mode driver. FACEIT describes a kernel driver, client and server SDK for protected CS2 matches, with Windows-only availability. These are deployed approaches to protecting competitive play. Microsoft documents the driver-signing and compatibility requirements that govern this route. [E109](https://support.faceit.com/hc/en-us/articles/9394666828188-What-is-FACEIT-Anti-cheat-and-how-does-it-work) [E99](https://support.riotgames.com/en-us/riot/performance/what-is-vanguard) [E98](https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/distributing-a-driver-package) VALVE’S RESPONSIBILITY TO ITS USERS ### Explain the gaps. Account for the damage. Valve must account for cheats that survive its protections, the time they remain active, the matches they affect and the users left without an effective remedy. Detection coverage, response times, erroneous bans and appeal outcomes belong in that account. A technical strategy is judged by the protection it delivers to players. Valve’s own Steamworks guidance recommends authoritative servers and explains how game-ban systems should communicate with affected users. That gives Valve a standard against which its implementation and treatment of users can be examined. Publish how the layers work together, where coverage fails and how those failures are remedied. [E106](https://partner.steamgames.com/doc/features/anticheat) **PhishDestroy’s criticism is directed at Valve’s priorities.** SteamOS, Proton and control over its browser and anti-cheat stack serve Valve’s platform strategy. Corporate independence does not discharge its responsibility for security. When users face cheating, inventory theft or ineffective recovery, Valve owes an account of the protection it shipped, the alternatives it rejected and the consequences it accepted. The relevant configuration and decision records are in Valve’s hands; producing them is part of accountability. THE QUESTION TO VALVE What protection did your architecture leave missing, who carried the cost, and what have you changed to prevent the same harm recurring? PHISHDESTROY’S ARCHITECTURAL CRITICISM ### Corporate independence has a cost paid by the user. We read the browser and anti-cheat decisions together. Steam embeds a browser whose protection depends on the shipped version, services, sandbox and updates. Competitive play depends on a protection architecture that can detect and interrupt the cheats players actually face. Valve chooses both implementations and controls the account and inventory that become exposed when protection fails. Control of the platform and independence from other technology companies carry exceptional weight in those choices: integrating browser reputation services raises a relationship with Google; deploying a Windows kernel driver brings signing, testing and compatibility obligations in Microsoft’s ecosystem. SteamOS, Linux and Proton also form part of Valve’s platform strategy. [E104](https://www.chromium.org/developers/how-tos/api-keys/) [E98](https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/distributing-a-driver-package) That corporate preference is the object of our criticism. When Valve rejects, delays or weakens an available protection to preserve autonomy, users bear the consequence through compromised accounts, missing inventories and matches affected by cheating — the failed warning in the captured build is that consequence on record. Calling the trade-off privacy does not account for that cost. Valve should disclose the decision, the alternative considered, the protection lost and the remedy offered to the people affected. The browser and VAC therefore belong in the same accountability question: whose independence did the architecture protect, and whose security remained exposed? THE LOSS LEDGER ### How many accounts, how many inventories, how many years? Valve should publish the history of the credential and session pathways abused to take inventories: when each mechanism became known, when it changed, what replaced it and how many users lost value before an effective fix. API-key theft, stolen browser sessions and token-return pathways need their own dates and loss records. A new interface or a large ban announcement does not repay a stolen inventory. The measure is the loss prevented, the access abuse stopped and the remedy delivered. [Inspect the access mechanisms ↗](https://phishdestroy.io/steam_dossier/steam-access.html) · [Inspect the extension’s remote commands ↗](https://phishdestroy.io/steam_dossier/csgofast-sih.html#control) 05 REVENUE BEFORE THE BAN / LOSSES AFTER IT ## Count what the farm pays. Then count what enforcement stops. Valve’s CS2 documentation connects Prime status with weekly item rewards. That creates an economic question about paid access, item issuance and repeat account purchases. Answer it with a purchase cohort and transaction ledger. [E100](https://help.steampowered.com/en/faqs/view/4D81-BB44-4F5C-9B6B) The farm’s economics depend on how little hardware time each running instance consumes. Reducing rendering load and sharing resources increases the number of accounts a given setup can sustain. Microsoft documents GPU resource sharing across virtual machines. Valve should explain which signals it uses to identify such automation, which controls interrupt it and how long the farm continues earning before intervention. [E105](https://learn.microsoft.com/en-us/windows-hardware/drivers/display/gpu-paravirtualization) EXPLORE THE THREE-MONTH PAYBACK SCENARIO EDITABLE SCENARIO · PHISHDESTROY’S RESEARCH BENCHMARK Use one currency throughout. The starting values are illustrative assumptions, not current prices or expected returns. Accounts with a new paid entitlement **1000** Entitlement cost per account Paid amount; exclude resold-account prices. **15** Allocated setup cost per account **3** Weekly receipts per account Realised cash after fees; not a Wallet balance. **1.5** Weekly operating cost per account Power, hosting and labour allocation. **0.25** ILLUSTRATIVE RESULT / CURRENCY UNITS Simple break-even **14.4 weeks** Gross entitlement spending 15,000.00 Weekly net per account 1.25 Net needed for 13-week recovery 1.38 After 13 weeks: 90.3% of the initial entitlement and setup cost recovered. Weeks = (entitlement + setup) ÷ (weekly receipts − weekly cost). This simple scenario excludes bans, replacement purchases, price changes and time without earnings. Gross spending is not Valve’s recognised net revenue: taxes, refunds and the purchase channel must be reconciled. A Steam ban count supplies none of these inputs. POPULATION **Which accounts?** Newly purchased entitlements, legacy access, stolen accounts and ordinary users need separate cohorts. RECEIPTS **What did Valve receive?** Reconcile entitlement receipts, case purchases and internal Market fees. External trade value is a separate flow. ENFORCEMENT **What changed after the ban?** Track inventory restrictions, replacement accounts, continued operations and successful appeals. THE UNCLASSIFIED POPULATION ### Which half of a ten-million economy did the lock hit? The population behind the ban count was never classified. Of roughly ten million accounts in this economy, about half sit above the $5 “non-limited” threshold — the tier that unlocks the Market and the Web API. [E66](https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A) Valve has never said how many of the locked million came from that half, or why “commercial use” is the charge applied to accounts whose only commerce was playing. The classification records are Valve’s to produce: the limited and non-limited split of the locked accounts, the qualifying spend behind each, and the clause actually invoked. Publish them, and the ban count becomes an account of who was stopped — not a number over an unexamined population. THE INCENTIVE TEST **Valve’s receipts and the farm’s continued operation belong in the same account.** Match entitlement purchases, item issuance, Market fees, restrictions and replacement accounts over time. That would show the commercial benefit accumulated before a ban and whether enforcement actually stopped the operation. WHO COLLECTS BEFORE THE BAN? ### The farm’s payback period is also a revenue question. PhishDestroy’s working benchmark is a farm designed to recover its setup cost in roughly three months. The calculator above makes the inputs visible: account entitlements, recurring costs, sale proceeds and losses from restrictions. A farm’s purchase and replacement cycle can generate revenue for Valve before enforcement arrives. That is the relationship this investigation asks Valve to explain. Publish what these accounts paid, when the activity was recognised, what value was returned and whether the same operation resumed under replacement accounts. The scale of a ban announcement should lead to that ledger. THE REVENUE BEFORE THE BAN / AN ILLUSTRATED AUDIT ROUTE #### Follow the receipt through the cycle. The model shows the records to join. The payback calculator above provides the editable arithmetic. 01 / PAID ACCESS ##### The first receipt precedes enforcement. The scenario begins with newly purchased entitlements for the farm’s accounts. The payment and the account cohort are the first entries to reconcile. Purchase date · account cohort · entitlement · receipt · refund 02 / ITEM REWARDS ##### Paid eligibility leads to item issuance. Valve’s CS2 documentation connects Prime status with weekly item rewards. Follow what the eligible accounts receive, when the activity is recognised and which protection interrupts it. Eligible account · reward date · issued item · activity record 03 / SALE AND PROCEEDS ##### Follow the item into realised value. The farm’s receipts depend on the route and fees. An internal Steam Market transaction and an outside cash sale leave different ledgers. Reconcile the reward, transfer, sale and money actually received. Item identifier · transfer · venue · sale proceeds · retained fees 04 / BAN OR REPLACEMENT ##### Did the intervention end the business cycle? A restriction changes the account’s access. The investigation asks whether the same operation continues, replaces its accounts or loses the ability to earn. Follow purchases and losses after the intervention. Restriction date · retained inventory · replacement account · later receipts Manual stage selection stays available when motion is off. Stage 1 of 4: Paid access. LOW RENDERING LOAD / MANY ACCOUNTS ### The farm is a business relationship before it is a ban statistic. The model examined by PhishDestroy reduces rendering work through minimal settings and small output dimensions, then distributes available resources across many running clients. The business calculation starts with the accounts sustained by that setup and the rewards they can realise. Those inputs belong in the farm’s economics alongside electricity, hosting, equipment and replacement costs. Our criticism is the incentive relationship: the farm seeks recurring item proceeds; Valve can receive payments for access, replacement accounts and internal transactions. Enforcement that periodically removes accounts can coexist with a purchase-and-replacement cycle. The investigation asks whether intervention disrupts that cycle or leaves it commercially viable. A roughly three-month recovery target is the author’s working benchmark, exposed through the editable scenario above. To turn the headline ban count into an account of responsibility, Valve should publish the associated purchases, restrictions, retained fees, surviving operators and repeated registrations. How much did the system receive before the operation was stopped—and was it actually stopped? 06 COLLECTIBLES / PRECEDENTS / COMMUNITY ## Labubu, CS2 charms and Valve’s chosen analogy. EARLY 2024 ### Lisa dates her collecting interest to early 2024. In an interview published on 8 November 2024, Lisa looks back at her interest in blind boxes and rare collectibles earlier that year. [E112](https://www.vanityfair.com/video/watch/vf-secret-obsessions-lisa) The original April post — the first-person collecting record behind the 8 November 2024 interview — remains a separately sought primary source. 02 OCT 2024 ### Valve introduces the Armory and weapon charms. The official release describes paid passes, play-earned credits and item redemption. It places another cosmetic product inside Valve’s monetisation architecture. [E101](https://store.steampowered.com/news/posts/?appgroupname=Counter-Strike%3A+Global+Offensive&appids=730&enddate=1728000977&feed=steam_community_announcements) 11 MAR 2026 ### Valve invokes Labubu in its public defence. The statement compares mystery boxes with physical collectibles. Valve issues the item, sets the paid sequence, executes the transfers and can stop the holder from using the market. The collectible comparison erases every one of those issuer powers. [E14](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5) Valve chose a collectible associated with a recent, highly commercial collecting boom. Put that choice beside the sequence: Lisa dates her collecting interest to early 2024; Valve introduces CS2 weapon charms on 2 October 2024; Valve invokes Labubu in its 11 March 2026 defence. PhishDestroy’s argument is that the analogy makes paid random outcomes feel like familiar collecting while directing attention away from Steam’s liquid item economy and the issuer’s control. The commercial role of appearance is also visible in the [seven-Major inspect dataset ↗](https://phishdestroy.io/steam_dossier/major_skins/) . THE COMMERCIAL SCALE OF THE COMPARISON ### THE MONSTERS revenue POP MART annual report · RMB billions · scale 0–15 2024 **3.04 billion RMB** 2025 **14.16 billion RMB** Company-reported revenue for the full IP that includes Labubu, not resale turnover or Labubu alone. These figures show the commercial scale of the collectible market that Valve chose for its analogy. [E111](https://www1.hkexnews.hk/listedco/listconews/sehk/2026/0421/2026042100394.pdf) STEAM’S OWN TRANSFER ECONOMY ### Read the actual transfer architecture. The useful comparison with FIFA is the architecture of value. Steam combines transferable inventory, an internal Market and outside sale routes. Valve created and administers the transfer infrastructure on which that liquidity depends. A judgment about EA’s implementation cannot answer questions about Valve’s own system. Valve’s regional response in the Netherlands belongs at the centre of that comparison: when the obligation changes, the platform can change access. [E89](https://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/) [Follow the regional-control record ↗](https://phishdestroy.io/steam_dossier/privacy-and-enforcement.html#regional-control) THE COMMUNITY’S SECURITY PROBLEM ### Players ask for protection. In the community material examined by PhishDestroy, the appeal to privacy repeatedly meets ridicule and complaints about cheating, fraud and the security of inventories. Valve’s defence fails to answer the problem those players experience: a platform with extensive records and commercial control that still leaves them exposed. Their demand is effective protection and a remedy after loss. **The statement and the research record** Valve published the response on 11 March 2026. Its choice of audience, collectible analogy and privacy argument are the subjects of this analysis. The investigation treats the publication as the company’s position. The broader dossier brings together support records, community discussions, reviews, technical material and commercial data. Those streams are used to examine how Valve’s public account compares with its users’ experience. The source archive preserves the dated records behind each part of that examination. THE AUTHOR’S ECONOMIC COMPARISON ### Steam’s exchange architecture is the issue. PhishDestroy compares Steam’s liquid item economy with an exchange: the issuer creates the asset, defines its permissions, supplies the transfer infrastructure and records the internal market, while outside venues supply cash trading and gambling settlement. This is why we reject FIFA as a substitute explanation for Valve’s system. The relevant questions are liquidity, conversion, custody, control and the paid random transaction. Valve’s API, trading functions and Market were created by Valve. Outside operators commercialise access to that infrastructure. Our criticism is directed at the platform that supplies and administers it, and at an enforcement account that counts restricted accounts while leaving the surrounding business capabilities unexplained. [Follow the ledger and item routes ↗](https://phishdestroy.io/steam_dossier/gambling-system.html) · [Follow Steam access ↗](https://phishdestroy.io/steam_dossier/steam-access.html) 07 THE RECORD VALVE SHOULD PRODUCE ## Turn the defence into an auditable account. 1. 01 ### Protection by game and route. Publish theft losses, reversals, refusals and the reason Dota 2 and TF2 remain outside Trade Protection. Separate trades, Market purchases, gifts and recovery incidents. 2. 02 ### The post-2019 fraud trace. Identify the financial instruments monitored after new CS:GO keys stopped circulating, the flows displaced and the interventions that followed. 3. 03 ### Notice, fix, exposure and remedy. For each security failure, provide the first notice, affected builds, exploitation evidence, patch date, affected population and compensation or restoration outcome. 4. 04 ### The money behind account enforcement. Reconcile the relevant account cohorts with entitlement receipts, item issuance, fees, restrictions, repeat purchases and operator survival. 5. 05 ### The design decisions and their cost. Disclose browser protection settings, anti-cheat coverage and measured trade-offs. Make the decisions that affect user security open to independent examination. THE FINDING **The items have an economic function. Valve has operational control. Protection and accountability must match both.** The record now contains Valve’s own fraud admission, a court-directed account disclosure and a documented gap between the three games named in its defence. HOW PHISHDESTROY CONNECTS THE RECORD ### The investigation follows the same mechanism across datasets. Our approach brings together development material, other games, public reviews, community discussions, support experiences, court documents and the commercial services built around Steam. These are different views of the same system: what Valve issues, what it records, what outside operators do with that access and what happens to the person who loses an account or inventory. The review-incentive chapter adds a further acquisition layer. A giveaway recruits public reviews; those reviews help establish trust in an extension; the extension then requests access and operates inside Steam’s interface. The code case follows that access into registered account operations. The questions about protection and enforcement travel through the whole chain. [Review incentives and developer replies ↗](https://phishdestroy.io/steam_dossier/reviews-and-incentives.html) · [The SIH account-operation record ↗](https://phishdestroy.io/steam_dossier/csgofast-sih.html#control) 08 THE PUBLIC RECORD ## Inspect the evidence. 26 RECORDS Sources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers. **Research method and source status** Reviewed 11 October 2026 UTC. The game comparison uses the current Trade Protection FAQ and the separate general hold policy. The Canadian exhibit distinguishes the court’s order from the trustee’s account and valuation. Victim reports retain their original dates and source links. The farm model exposes its assumptions and arithmetic. Technical sources identify the documented architectures; the requested Steam-specific record includes the shipped configuration and observed protection. The New York exhibit is the February complaint, with its allegations and requested remedies attributed to the filing. ## Cited source records ### E100 · CS2 — Prime Status and Free to Play Publisher: Valve / Steam Support Date: Current FAQ · reviewed 11 Oct 2026 Reviewed: 11 October 2026 [Original record](https://help.steampowered.com/en/faqs/view/4D81-BB44-4F5C-9B6B) Prime purchase and eligibility for XP and weekly care packages. Record scope: Valve’s description of Prime eligibility and weekly rewards. Scenario inputs are exposed in the farm calculator. ### E101 · The Armory — announcement and release notes Publisher: Valve / Counter-Strike 2 Date: 2 Oct 2024 Reviewed: 11 October 2026 [Original record](https://store.steampowered.com/news/posts/?appgroupname=Counter-Strike%3A+Global+Offensive&appids=730&enddate=1728000977&feed=steam_community_announcements) Launch of the Armory and charms; passes, credits and item redemption. Record scope: Valve’s 2 October 2024 release announcement for the Armory, passes, credits and weapon charms. ### E102 · Selected support records — dated posts and source links Publisher: PhishDestroy / preserved public user testimony Date: 2021–2025 posts · 2026 collection Reviewed: 11 October 2026 [Original record](https://phishdestroy.io/steam_dossier/steam_tos_assets/selected-support-records.json) Preserved Dota restoration, Wallet-loss and Québec account-recovery reports, with original post links. Record scope: Preserved first-person reports with dates and original links: Dota restoration, Wallet losses and account recovery. ### E103 · Steam Trade and Market Holds Publisher: Valve / Steam Support Date: Current FAQ · reviewed 11 Oct 2026 Reviewed: 11 October 2026 [Original record](https://help.steampowered.com/en/faqs/view/34A1-EA3F-83ED-54AB) General pre-delivery holds, authenticator conditions and restrictions after cancellation. Record scope: A delivery hold differs from CS2’s reversal of completed protected trades. Item-specific restrictions also vary. ### E104 · API Keys Publisher: The Chromium Projects Date: Current documentation · reviewed 11 Oct 2026 Reviewed: 11 October 2026 [Original record](https://www.chromium.org/developers/how-tos/api-keys/) Google-service integration and API-key configuration for Chromium-derived products. Record scope: Chromium documentation of Google-service API keys and integration requirements. ### E105 · GPU paravirtualization Publisher: Microsoft Learn Date: Updated 7 Feb 2025 Reviewed: 11 October 2026 [Original record](https://learn.microsoft.com/en-us/windows-hardware/drivers/display/gpu-paravirtualization) WDDM architecture for shared GPU resources across virtual machines with host kernel-driver involvement. Record scope: Microsoft’s GPU-paravirtualisation architecture and sharing of physical resources across virtual machines. ### E106 · Anti-cheat and Game Bans Publisher: Valve / Steamworks Date: Current documentation · reviewed 11 Oct 2026 Reviewed: 11 October 2026 [Original record](https://partner.steamgames.com/doc/features/anticheat) Authoritative-server guidance and communication requirements concerning Game Bans. Record scope: Steamworks guidance on authoritative servers, anti-cheat and communicating game bans. ### E107 · Update on The Crate Depression of 2019 Publisher: Valve / Team Fortress 2 Date: 2 Aug 2019 · updated 16 Aug Reviewed: 11 October 2026 [Original record](https://www.teamfortress.com/post.php?id=53025) Valve’s response to guaranteed Unusual drops: trade locks, selective release, deleted-item restoration and refunds. Record scope: Valve’s announced remedy for the TF2 item-issuance incident and treatment of affected items. ### E108 · ExpressTrade — notice to OPSkins Publisher: Valve / Counter-Strike Date: 8 Jun 2018 Reviewed: 11 October 2026 [Original record](https://blog.counter-strike.net/expresstrade/) Valve’s demand to cease and announced deadline of 21 June for locking OPSkins Steam accounts. Record scope: Valve’s named enforcement target, prohibited practice and June 2018 account-lock deadline. ### E109 · What is FACEIT Anti-cheat and how does it work? Publisher: FACEIT Date: 29 Jun 2023 · updated 23 Oct 2025 Reviewed: 11 October 2026 [Original record](https://support.faceit.com/hc/en-us/articles/9394666828188-What-is-FACEIT-Anti-cheat-and-how-does-it-work) FACEIT describes an application, kernel-mode driver and server SDK for protected CS2 matches, and its Windows-only availability. Record scope: FACEIT’s account of its client, kernel driver, server integration and supported environment. ### E110 · Steam China Publisher: Valve / Steamworks Date: Current documentation · reviewed 11 Oct 2026 Reviewed: 11 October 2026 [Original record](https://partner.steamgames.com/doc/store/china?l=english) Valve identifies Perfect World as its onshore Steam China partner and government approval as a prerequisite for publishing games. Record scope: Official documentation of the Steam China publishing process, local partnership and approval requirements. ### E111 · Annual Report 2025 — revenue by IP Publisher: POP MART / HKEX Date: 21 Apr 2026 · 2024 and 2025 results Reviewed: 11 October 2026 [Original record](https://www1.hkexnews.hk/listedco/listconews/sehk/2026/0421/2026042100394.pdf) Printed page 27 reports THE MONSTERS revenue of RMB3,040,664,000 in 2024 and RMB14,161,064,000 in 2025. Record scope: Revenue for the whole IP that includes Labubu; resale turnover and Labubu-only figures are separate. The annual results measure the commercial scale of the collectible market Valve chose for its analogy. ### E112 · Lisa’s Secret Obsession with POP MART Publisher: Lisa / Vanity Fair interview Date: 8 Nov 2024 Reviewed: 11 October 2026 [Original record](https://www.vanityfair.com/video/watch/vf-secret-obsessions-lisa) First-person interview about collecting, rarity and blind boxes; Lisa dates her interest to early 2024. Record scope: Published on 8 November 2024, the interview supplies a first-person account of Lisa’s interest earlier that year. Read alongside the 2 October 2024 Armory release and Valve’s 11 March 2026 Labubu comparison. ### E14 · About the New York Attorney General lawsuit against Valve Publisher: Valve Date: 11 Mar 2026 Reviewed: 10 October 2026 [Original record](https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5) The public collectibles comparison, optional and cosmetic framing, transferability argument, account-ban total, privacy objections and legislative position. Record scope: Corporate public response dated 11 March 2026; linked alongside the filed complaint and the investigation’s analysis. ### E32 · Trade Protected Items Publisher: Valve / Steam Support Date: Live FAQ · feature introduced July 2025 Reviewed: 10 October 2026 [Original record](https://help.steampowered.com/en/faqs/view/365F-4BEE-2AE2-7BDD) Seven-day protection, reversal of eligible trades and the initiating account’s thirty-day trade and market cooldown. Record scope: The platform-defined reversal mechanism affecting delivery and outside operators’ balance-release timing. ### E38 · People of New York v. Valve Corporation — filed complaint Publisher: New York Attorney General / NYSCEF Date: 25 Feb 2026 Reviewed: 10 October 2026 [Original record](https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf) Court, filing date, index 450952/2026, allegations, statutory bases and requested remedies. Record scope: NYSCEF document 2; 52-page court-stamped complaint. Requested relief appears on PDF pages 50–51. ### E47 · Exploiting Steam: Usual and Unusual Ways in the CEF Framework Publisher: DARKNAVY Date: 27 Jun 2024 Reviewed: 10 October 2026 [Original record](https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/) Firsthand technical description of steamwebhelper and its Chromium Embedded Framework architecture. Record scope: Documents Steam’s embedded Chromium architecture and its exploitation history, dated June 2024. The shipped configuration, patch cadence and present protection of steamwebhelper are part of the record requested from Valve. ### E66 · Limited User Accounts Publisher: Valve / Steam Support Date: Live FAQ · reviewed 10 Oct 2026 Reviewed: 10 October 2026 [Original record](https://help.steampowered.com/en/faqs/view/71D3-35C2-AD96-AA3A) Qualifying $5 spending and specified restricted community features. Record scope: Steam’s published requirements for access to trading and the Community Market. ### E81 · TF2 — Mann Co. Supply Crate Key Publisher: Valve / Steam Community Market Date: Current official item listing Reviewed: 11 October 2026 [Original record](https://steamcommunity.com/market/listings/440/Mann%20Co.%20Supply%20Crate%20Key) The listing’s asset data marks the key as tradable and marketable; the item has a Steam Market order interface. Record scope: Steam’s item listing, showing the trading and Market attributes of the TF2 key. ### E89 · EA / FIFA-FUT — ECLI:NL:RVS:2022:690 Publisher: Raad van State Date: 9 Mar 2022 Reviewed: 11 October 2026 [Original record](https://www.raadvanstate.nl/uitspraken/@130150/202005769-1-a3/) The Council of State overturned the penalty against EA on the implementation-specific record before it. Record scope: The Council of State’s 9 March 2022 ruling on EA’s FIFA/FUT implementation. ### E94 · Key Change Publisher: Valve / Counter-Strike Date: 28 Oct 2019 Reviewed: 11 October 2026 [Original record](https://blog.counter-strike.net/2019/10/26113/) Valve attributed traded newly purchased keys to fraud flows and stopped new keys from being traded or sold on the Market. Record scope: Valve’s 28 October 2019 change applies to new key purchases; pre-existing keys retain their trading functions. ### E95 · Pleterski — supplement to the sixth trustee report and Steam Order Publisher: Ontario Superior Court / Grant Thornton Limited Date: 11 Jul 2024 · order 6 Jun 2024 Reviewed: 11 October 2026 [Original record](https://doanegrantthornton-docs.webpal.net/document-folder/viewer/docul8LWsxcWho7J/31250879551604896) Order §§3–4 and report §§20, 24–25 establish the disclosure and asset-tracing record. Record scope: Trustee report and court order in the Pleterski bankruptcy. Inventory values are the trustee’s estimates; cryptocurrency settlement is its inference. ### E96 · Security and Trading Publisher: Valve / Steam Date: 9 Dec 2015 Reviewed: 11 October 2026 [Original record](https://store.steampowered.com/oldnews/19618) Valve’s contemporary estimate of 77,000 hijacked and emptied accounts per month, and its account of the theft economy. Record scope: Valve’s estimate for the period covered by its historical account-security publication. ### E97 · Build without unrar — Safe Browsing default discussion Publisher: CEF / maintainer magreenblatt Date: 12 Mar 2025 Reviewed: 11 October 2026 [Original record](https://www.magpcss.org/ceforum/viewtopic.php?f=7&t=20220) A CEF maintainer states that Safe Browsing remains enabled by default and discusses custom builds. Record scope: CEF maintainer discussion of upstream defaults and build options. The Steam-specific configuration is a disclosure requested from Valve. ### E98 · Distributing a driver package Publisher: Microsoft Learn Date: Updated 15 Jan 2025 Reviewed: 11 October 2026 [Original record](https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/distributing-a-driver-package) HLK testing, WHQL signing and submitted driver binaries and INF files. Record scope: Microsoft documentation of testing, driver-package submission, signing and distribution requirements. ### E99 · What is Vanguard? Publisher: Riot Games Date: 2 Jun 2026 Reviewed: 11 October 2026 [Original record](https://support.riotgames.com/en-us/riot/performance/what-is-vanguard) Riot describes Vanguard’s client and kernel-mode driver. Record scope: Riot’s description of Vanguard’s client, kernel-mode driver and security model.