How not to lose skins in a trade
Updated 8 November 2026
In short
Skins are often lost on fake sites and through a stolen Steam API key. Enter your details only on a site whose address you checked yourself, and check the recipient and the items in Steam Guard before you confirm.
The usual tricks
- A fake site. The page looks like a known market, but the address differs by a letter or two. The link often comes in a private message or is advertised as a giveaway.
- A trade swap. With your Steam API key, a scammer sees your trades, can cancel the real one and send a look-alike from an account with the same name and avatar.
- "Checking" or "valuing" your items. They ask you to send a skin for a while. It does not come back.
What to check before a deal
- The address in the browser bar. Use your own bookmark, not a link from a message.
- Steam sign-in must open on the real steamcommunity.com.
- In the trade window and in Steam Guard: what leaves, what arrives and who the recipient is.
- The recipient's join date and Steam level. They are shown in the trade window.
Should you give out your API key
Some real sites ask for it for direct deals, for example Face2Face on DMarket. Enter it only where you checked the address yourself. If you no longer trade directly, revoke it.
If your key may be stolen
The DMarket FAQ recommends the same steps.
- Revoke the key on the Steam API key page.
- In Steam Guard settings, sign out of all other devices.
- Create a new trade link in your Steam trade settings.
- Change your Steam password.