How to avoid CS2 skin scams in 2026

6 min read · Updated 2026-06-20 · By Mārtiņš Ozols

Phishing, fake middlemen, API hijacks. The five scams that drained the most inventories last year and the one-minute checklist that blocks all of them.

Scammers don't break Steam — they break you. Every major theft we see comes down to a handful of patterns.

1. Phishing clones Fake sites copy the visual design pixel-perfect but live on a typo domain (csgofloat[.]net, skinporf[.]com). Always bookmark the real URL — never click links from Discord, Reddit DMs, or Steam chat.

2. API key hijack Some "marketplaces" ask for your Steam API key. Once they have it, they can hijack outgoing trade offers and replace the recipient. Only use API keys with sites you've independently verified.

3. Fake middleman Someone joins your trade and pretends to be a vouched middleman. Real middlemen never DM you first.

4. Friend impersonation Hacked friend account sends a "quick favor" link. Treat any sudden trade request from a friend as suspicious until verified over voice.

5. Misclick on inventory ordering Scammers swap a $5 lookalike for your $500 skin during a trade. Always check the float and pattern, not just the name.

The 60-second checklist - Domain is bookmarked, not clicked - 2FA on Steam + email - API key only with platforms in our catalog - Every trade screenshot reviewed before clicking Confirm