Lock down your email and device before touching Steam
The first move is not Steam itself. If malware or a stolen session token is what let the attacker in, signing in again on the same device will simply hand your new password over too. Run a current security scan, remove any software you do not recognise and, where you can, do the next steps from a second device you trust.
Then secure the email address Steam uses for codes and resets. That mailbox is the master key — whoever controls it can reset almost everything downstream. Change its password, sign it out of every device, enable two-factor authentication on it and remove any recovery address or phone number you did not add yourself.
If you cannot sign in to that email at all, work through the email provider’s own recovery flow before going near Steam. Valve’s stolen-account guide is explicit about this order: a Steam recovery that lands in an inbox the attacker still owns solves nothing.
Open Steam’s stolen-account wizard directly
Go straight to Steam Support’s stolen-account wizard at help.steampowered.com. Do not open a link from a Discord stranger offering to help, do not pay anyone claiming to have a contact inside Valve and do not type recovery codes into any site except the official help domain. Impersonators are the second attack in this story; the first already happened.
The wizard asks for the account’s current or former login name and starts the identity checks it can automate. If the attacker has not yet overwritten every contact detail, this path can resolve in minutes: Valve verifies you against an email or phone it still trusts and lets you reset the password without a human review.
Work through each prompt deliberately. Every correct answer — the right previous login name, a real former email, a purchase you actually made — reduces the burden of proof that comes next.
If the attacker changed your email, phone and password
Keep going. Valve says in plain language that recovery is still available even when the email address, password and phone number on the account have all been changed. The wizard will route you to a path that bypasses the current contact details and sends the request to a Steam Support agent who evaluates ownership from the account’s history instead.
When the wizard asks for an email, enter one you used on the account at any point in the past — not the attacker’s replacement address. The same goes for prior login names, old phone numbers and old Steam Guard device serials. Steam keeps that history, and the more of it you can supply from your own records, the faster the human-review step moves.
This is also the point where a lot of people give up because the first automated answer is "we cannot verify you." Do not stop there. Continue to the support-request route the wizard offers and attach the ownership proof from the next section.
Gather the proof Valve actually looks at
Steam’s proof-of-ownership guide describes what counts. The single strongest piece of evidence is usually a purchase: the last four digits of a credit card used on the account, a PayPal transaction ID, a Steam Wallet code once redeemed on the account or a CD key for a retail game attached to the library. One clean receipt usually outweighs any number of guesses at old passwords.
If a purchase record is not available, assemble what you have: prior account email addresses, previous login names, approximate account-creation date, the country or state the account was created from, or screenshots of older emails Valve sent you. Each additional signal helps the agent confirm the account is yours.
Submit all of it through the official support ticket the wizard opens for you. Never post receipts, payment screenshots, ticket IDs or ticket-access links in a public forum or Discord server — that is exactly the material the next impersonator needs to intercept you.
Lock the account down the moment you get it back
Recovery is only half the job. The first time you sign back in, change the password to one you have not used elsewhere and work through Valve’s security recommendations in order. Enable the Steam Guard Mobile Authenticator on a device you control — the mobile authenticator is stronger than SMS Guard, which can be ported away from you by a motivated attacker.
Review Authorized Devices and revoke anything you do not recognise, including sessions on browsers or machines you have never used. Check active trade offers and Market listings and cancel the ones the attacker set up. Look for an API key you did not create and revoke it. Rotate any password you reused on another site.
Items are a separate conversation. Valve’s item-restoration policy is narrower than most people expect: Market sales and trades are final by design, and Support will usually decline to roll back items the attacker already moved. Read the current policy before you count on recovering sold inventory.
- Change the password to something unique you have not used elsewhere.
- Enable the Steam Guard Mobile Authenticator — not SMS alone.
- Review and revoke Authorized Devices you do not recognise.
- Cancel unfamiliar trade offers, Market listings and API keys.
- Read the item-restoration policy before counting on a refund of lost items.
If you cannot recover, or if you want to move on
Not every recovery succeeds. The attacker may have resold the account, enough contact details may have been overwritten that Valve cannot verify ownership, or the review can simply land on the wrong side despite good evidence. That is a brutal outcome and nobody can honestly promise you a different one.
If you need to start fresh, buying a Steam account with the libraries you want is a legitimate option — not a substitute for recovery while that path is still open, but a working one once recovery is over. The accs.io Steam catalog lists accounts with named games and clear access details, credentials arrive by email within a minute of checkout and every order ships with a replacement window if anything is off.
Take your time choosing. Pick the library and access you actually want, not the biggest game count. The companion guide on valuing a Steam library is a useful second read when you are not sure what to compare.
Frequently asked
How long does Steam account recovery take?
A straightforward self-service reset through the stolen-account wizard usually completes in minutes. A support-ticket review involving stolen-account evidence typically takes a few business days, and complex cases can take longer. The fastest path is to supply strong proof — a recent purchase or an old attached email — in your first reply rather than waiting to be asked for it.
What proof do I need if I do not have receipts?
Valve’s proof guide accepts a range of evidence. Prior account email addresses, previous login names, Steam Wallet codes previously redeemed on the account, retail CD keys attached to the library and the approximate account-creation date all count. One strong signal is usually enough; several weaker signals combined also help. Submit everything you can in the first reply.
Can Steam restore my items, Market listings or wallet balance?
Sometimes, but not always. Valve’s item-restoration policy limits what Support will roll back — trades and Market sales are usually final once completed. Restoration is more likely for items still sitting on the account at the time Support reviews the case. Do not assume anything is coming back until an agent confirms it in writing.
What if the attacker enabled Steam Guard with their own phone?
The wizard handles this. Valve’s recovery route does not require you to pass Steam Guard on a device the attacker controls; it switches to an identity-based review instead. Do not try to receive the attacker’s code through any third party — "I can get you into the account for a fee" is almost always a second scam that hands over whatever evidence you share.
Will Steam ever ask for my password through email or chat?
No. Valve does not ask for your password in a support ticket, in email or in a Discord message, and real Steam staff do not contact players first on third-party platforms. If someone requests a password or a one-time code that way, it is an impersonation attempt — close it and keep working through help.steampowered.com directly.
Should I buy another Steam account while I wait on recovery?
There is no rush. Recovery is free and buying a second account does not speed up the review of your original one. Treat the catalog as an option for if recovery fails, not as insurance against it. If you do eventually need a new account, pick one with the specific library you want rather than chasing the biggest game count.
