Counter-Strike 2 account security: Steam Guard, Trade Protection, scams and VAC

Steam says Counter-Strike 2 is currently the only game with Trade Protected items. Traded CS2 items arrive immediately and you can equip them, but for 7 days they cannot be consumed, modified, traded on or moved into a Storage Unit. A yellow shield marks them in your inventory and the trade window. CS2 items are never put on trade holds, and they cannot share a trade with items from games without Trade Protection.

The point is a way back after a hijack. If someone takes over your account and trades your skins away, you can reverse trades with Trade Protected items from the last 7 days from your Trade History page. Steam asks you to make sure you control the account first.

Know the cost before you press it. Reversal is all or nothing, fair trades included. Your Market listings come back to your inventory, pending offers are cancelled, and your account cannot trade or use the Community Market for 30 days. Only the account that reverses gets that cooldown, and Steam Support cannot shorten it.

Steam Support calls it trade redirection; players call it the API scam. It only works once your account security is already broken, usually by a phishing page or malware. You set up a trade with someone you trust, the scammer cancels it, and a near-identical offer appears from an impersonation account they control. Confirm without reading and the skins are theirs.

A Steam Web API key lets scripts automate actions on its account, so Steam says never to share yours and to revoke it at steamcommunity.com/dev/apikey if a hijacker may have made one. Steam also notes a scammer with access to your account or PC can automate the switch without a key, so change your password and secure your email and PC as well.

Two habits beat it. Never send items for little or nothing in return: Steam says an unbalanced trade you never confirm cannot be redirected. And read the full confirmation in the Steam Mobile App every time. If your Steam profile suddenly shows a ban threat you did not write, a scammer has access; Steam Support never edits profiles to threaten bans.

Steam’s scam pages describe the patterns CS2 traders run into. Nearly all of them push you to move items or to sign in somewhere new.

Steam treats bans as part of the account, not the person. VAC bans are permanent and cannot be appealed, and any ban stays on an account regardless of who was playing at the time. If someone steals your account and cheats on it, the ban is yours, along with the loss of CS2 trading, store access and item drops.

Steam also warns that cheats can be disguised as harmless downloads to get other players banned, so be careful with scripts or custom skins and only download custom content from trusted sources. And since Prime can never be removed from an account, buy it on the account you plan to keep.

Siblings sharing a PC often share a phone number too. Steam allows that, but says accounts on one number may be treated as the same identity under the Steam Subscriber Agreement, and a VAC ban reaches every account on the number in games where the developer enables it. Valve also counts phone numbers among its Trust Factor signals. Give each player their own number where you can, and always their own email and password.

One Steam Mobile App can protect several accounts through Add an account in the blue drop-down on the Steam Guard page. Keep each account with the person who made it: Steam’s VAC FAQ says never to give out your password or share your account.

Collect this while the account is healthy; it is what Steam Support will ask about on a bad day. LoginScout keeps it on one encrypted card per Steam account, while the Steam Guard codes stay in the Steam Mobile App.