Filtering Steam key scammers

If you have ever published a game on Steam you most probably know what Steam keys do and how they work. For those who don’t know - it’s a way for game developers to market their game by giving out Steam keys or in other words basically giving out a game copy for free. The one who has a key, can easily redeem it on Steam to get the game. However, such system is like a bait to the scammers who try to get a Steam key of your game and resell it to someone else. If you send one, not much can be done then. But if you find out that before sending the key, the imagination can go far enough. I've read a funny story where Mike Rose (@RaveofRavendale) trolled all the scammers by sending them fake keys: https://twitter.com/RaveofRavendale/status/964168451014254594

From Blazing Beaks experience, seeing that we have never got a coverage from the people whose emails seemed to be legit and who were “very excited to try and post a video”, I decided to spend more time digging in and figuring out what’s going on with Steam key requesters and decided to share some findings.

When we released Blazing Beaks, we sent a lot of keys to youtubers, twitchers, media. Some great videos and reviews were made and we were very happy with that. On the other hand, we also received a lot of emails from content creators who were asking for a key. Before sending a key to every person who asks, we carefully checked emails, names, nicknames if they match with the ones stated in their official websites, channels. If not, we asked for confirmation which in most cases never happened.

It was interesting to find out some tactics of scammers. The most interesting and personally for me never seen before scamming method was as follows. Every 3 weeks or so I used to get emails from youtubers who asked for a Steam key. But I had a feeling that I’ve already read an email somewhere. I went through all my previous emails and became suspicious when I found a bunch of messages that looked similar in a way. The text was surely different, but there were some highlighted and bold parts in the text that similarly appeared in the previous ones. Senders were different, at the time of reading those messages emails were legit, twitter accounts were legit, channels had more than 10k subscribers and the content on their channel seemed to be really interesting.

Seems legit? It isn't!

The only thing that I missed to double check at that time was youtube channel address. It was the same in all suspicious emails, but instead of it being a short link with channel name (for instance: https://www.youtube.com/ChannelName ) it had a unique 25 symbols id in it (something like: https://www.youtube.com/channel/uzxjwdbknkafasfs….. ) and this kind of makes sense - who will remember a link with random 25 symbols string in it appearing in previous emails?

I usually click on the link, check the channel email with sender’s email, check if content is related to our game, if videos are posted regularly. I would rather remember the same channel itself than the link to it and that’s what the scammers thought about too. Every time they send a request to the same developer, they completely change the channel itself to make it look legit -  from the title, emails, twitter accounts to header images and etc. This way they can send emails to the same developer in safe day intervals (3 weeks or so) and repeat the process again and again. Sadly, I also found those channels in one popular Steam key sending service and they were marked as verified.

Here’s my personal list which very likely helps me tell if a requester is a scammer or if I’ve already been scammed.

It is very difficult to fight such scammers, but it’s worth checking if there are any signs of request being a scam. Once you start doing that constantly it becomes easier and easier to filter real and fake ones. Hopefully, one day there will be some tools which help to verify each and every request. In the meantime, let’s do our best to fight those scammers!