How to enable Steam Guard and set up the Steam Mobile Authenticator

Email Steam Guard is what most accounts start with: a sign-in from an unrecognized device needs a code from your inbox. If it was switched off, the Steam client brings it back under Settings, the Security tab, Manage Steam Guard.

The catch is where that code goes. Steam lists a compromised email as the first way Steam Guard accounts get stolen, and rates smartphone codes as its best level of account security. Whichever you pick, never run with no Steam Guard at all: Steam blocks trading and the Community Market until it has been on for 15 days.

Not according to anything Steam publishes. Steam Support’s FAQ says an account can only be on one authenticator, the Steam Mobile App, at a time, and none of its help pages describe adding Steam Guard to Google Authenticator, Microsoft Authenticator, Authy or another code app. For Steam, the codes stay in the Steam Mobile App, which is also where you confirm trades.

Be wary of tools that promise to copy Steam Guard into another app or onto your PC. Steam warns that malware aimed at Steam can be disguised as gaming utilities such as mod and inventory managers, and says Steam Support will never ask for any of your codes.

Until the authenticator has protected the account for at least 7 days, Steam holds outgoing items for up to 15 days, including trades and listings made in the first week after you add it. So set it up well before a trade that matters. The hold gives you time to change your password and cancel a trade you did not make; cancelling one adds a 7-day trading cooldown that Steam Support cannot remove.

Counter-Strike 2 items are the exception: Steam never holds them and makes them Trade Protected for 7 days instead. Restrictions are a separate thing. They stop trading or Market use outright, and Steam Support cannot lift them:

Keeping your number? Install the Steam Mobile App on the new phone, sign in, and choose Move Authenticator on the Steam Guard tab, confirming with the current authenticator. If the old phone is already gone, pick “I no longer have access to my authenticator” when asked to confirm the sign-in, and Steam moves it with a text to your number.

Changing numbers too? Steam’s advice is to remove the authenticator on the old phone first (Steam Guard page, gear icon, Remove Authenticator), sign out, and factory reset the phone before it leaves your hands. Removal costs 15 days of trading against 2 for a transfer, so transfer whenever you can.

Without the phone, removal can start from Account Details, under Security & Devices, in a browser. If there is no number on the account either, the R-code is what takes the authenticator off.

Do this while everything works. These are the details people end up hunting for on the day the phone breaks or the email stops arriving. LoginScout keeps them on one encrypted card per Steam account, with the R-code and backup codes in its notes, while the Steam Guard codes themselves stay in the Steam Mobile App.