As a game developer, distributing Steam keys is vital for marketing, testing, and press outreach. There’s just one problem: the allure of free video game keys also makes them a prime target for scammers.
These bad-faith actors prey on developers, seeking to exploit the system for personal gain. To make matters worse, these scammers are up to date on the latest technological advancements, meaning they’re getting bolder and more challenging to combat with each passing day.
If you’re a developer, then it’s very likely that these scammers have approached you before. The chances are that you may have even fallen for their clever deceit and unwittingly given them keys.
That’s why we’ve created this post to help you spot Steam key scammers.
Below, we’ve detailed how to identify the red flags that every developer should know. We’re hopeful that this advice will help protect your game and your business.
In this post, you’ll learn how to:
- Recognise suspicious requests from unknown sources claiming to be influencers or media.
- Spot fraudulent emails and fake websites that imitate legitimate platforms.
- Identify inconsistent or unverified accounts asking for bulk keys.
- Avoid falling for urgent or high-pressure requests designed to manipulate you.
- Be wary of individuals offering free promotions or exposure in exchange for keys.
- Verify the authenticity of press and influencer outreach through proper vetting.
- Use tracking tools and platforms to monitor key distribution and prevent unauthorised.
Understanding the common types of scams and why they occur is the first step in protecting your business.
Why Scammers Target Steam Keys
For those unfamiliar with the concept of digital game keys, Steam allows users to enter a digital code consisting of 15 letters or numbers to redeem a title onto their account.
The platform allows game developers to easily create thousands of these keys at a moment’s notice so they can be allocated to playtesters or securing reviews.
Many of these keys are also sold by third-party retailers, such as sites like Amazon, G2A, Kinguin, and CD Keys, or in physical special editions like Starfield’s Constellation Edition or Baldur’s Gate 3 Collectors Edition.
So, where do the Steam key scammers come in? These criminals reach out, posing as influencers and journalists to trick developers into handing over Steam keys in bulk.
Once they’ve amassed a collection, these scammers will sell these free keys for profit or use them in giveaways and trades to build their communities. This not only leads to revenue loss for developers but also tarnishes the game’s market value.
Common Steam Key Scams:
Fake Steam Curators
Steam key scammers will pose as Steam curators and ask for keys to review your game, claiming to have tens of thousands of followers.
Based on face value, these scams can look surprisingly convincing and only fall apart if you take the time to examine them closer. For example, scammers’ “game reviews” are generally just rehashed descriptions rather than genuine content.
Impersonation of Influencers or Media
Steam key scammers often pretend to be famous YouTubers or journalists.
They request Steam keys using fake websites and slightly altered email addresses, hoping developers will not notice the details because they’re caught up in the excitement.
Coffee Shop Scam
This is a different type of scam than the above as, rather than impersonating someone involved in content creation, the person emailing will pose as a business owner, such as a coffee shop or a gaming cafe.
They’ll ask for a high number of keys to give to their customers to promote the game for you, potentially 15-20 or even more.
The trick is that it will be from a location that the scammer knows will be exceptionally difficult for you to verify in person. They’ll almost always choose a different country or city from the one you’re based in, as it’s unlikely that you’ll jump on a plane to check things out.
Coffee Shop scams also tend to include AI-generated or Photoshopped images, which the scammer will use as fraudulent examples of previous campaigns they have run for other games.
Identifying Red Flags
Learning to spot these Steam key scams can save you a lot of heartache. But it’s an art that relies on intuition, honed over many months (or even years) of practice.
Naturally, in-house PR staff at game publishers and PR and marketing agencies like ourselves will spot scammers better as we deal with them regularly.
But we appreciate that, for the average developer, it’ll take time and effort if you don’t know what to look for.
Here are some red flags to watch for in key requests.
Unusual Key Requests
Steam key scammers often ask for multiple keys. They claim they need them for “friends” or “team members” to review the game together.
They may hide behind the fact that they’re seemingly from a large publication, but sites have strict editorial guidelines and processes regarding keys.
Unless it’s a co-op game, there’s no need for multiple keys. Even if your game is a co-op game, carefully consider how many keys are being requested. That doesn’t add up if it’s a two-player title, but they’re asking for three keys. The numbers don’t lie.
Suspicious Emails
Poor Grammar
Scammers often try to trick you by pretending to be from a specific location. Still, you can usually tell them apart from genuine requests, as fraudulent emails generally don’t look very professional.
For example, if you receive an email that is allegedly from a native English speaker based in the UK or the US that is riddled with poor grammar or awkward phrasing, alarm bells should start ringing.
Mail Merge Formatting Errors
Watch for any key requests that seem auto-generated.
An easy red flag is if your game name is included in square brackets like [Insert Game Name Here], as it indicates a mass email rather than personal outreach.
Evasive or Fake Email Addresses
Steam key scammers often use email addresses similar to those of a known influencer or journalist. However, they make slight changes, like adding an extra letter or number.
The best way to be sure someone is legit is to check the sender’s email address by copying and pasting it into a new document.
You can check the font being used in the new document. It’s a scammer tactic to use letters in different alphabets that may look the same but are not. For instance, the letter E in Cyrillic differs from the letter E in the Latin alphabet.
No Verified Email Address
Legitimate influencers will have clear contact information on their platforms, whether on their YouTube channel, website, or social media profiles. If it’s missing, you should proceed with caution.
Fake Influencers or Journalists
Lack of Evidence
Freelance journalists or influencers should have a portfolio of work. If they claim to have written for a major outlet, verify their credentials by checking the site or reaching out to the editors.
Questionable Websites
Some Steam key scammers link to sketchy or unrelated websites to back up their claims. If the site has little to no connection to gaming, it’s a major red flag. The content may even have been stolen from a legitimate website and passed off as their own.
Sketchy YouTube pages
When you visit a YouTuber’s page, a scammer will often go to great lengths to gain thousands of video views and hundreds of comments.
But don’t be fooled; take a closer look.
A scammer’s YouTube channel will often have the following:
- Thumbnails that lack uniformity, branding, or common YouTube traits, such as the face of the influencer, arrows, and bold text.
- A subscriber count, which is a round number and suspiciously similar view counts for each video.
- Videos that just show gameplay, often with little or no voiceover. Alternatively, the voiceover may be in a language other than the one the YouTuber says they speak or where they are from.
- Another big red flag is very generic comments, like “Nice video with clear features.” These will have been written by bots or generated by AI.
- Comments which never refer to the actual game by name because they are designed to be used across multiple videos. Some comment sections may even be filled with comments that stop mid-sentence.
- Usually, creators respond to at least a handful of positive comments by liking them or leaving a reply. Fake accounts, however, will have no engagement from the creator.
- The ‘About’ section lacks social media links and is generally empty.
- The ‘Community’ tab is empty because there is no real community. It’s all fake.
If you’re still unsure, try adding the channel to your bookmarks. It’s common for these channels to rebrand ever so often to evade Google takedowns and ensure their fraudulent activities can continue.
By regularly checking the links of any questionable channels you have flagged, you’ll be able to immediately chop out any definite fakes that change their name.
How to safeguard against the Steam Key scammers
Before distributing keys freely, you should take steps to verify who you’re dealing with.
If we have one word of advice, it’s this…
Assume that 99% of the people approaching you via email and asking for keys are one of these scammers or unauthorised Steam key resellers.
If you’re a small developer, it can be flattering when a big influencer approaches you and wants keys to your game. But you need to treat it all with extreme caution and scepticism.
Research the requester
Check their profiles! Look for genuine reviews and content on the Steam curator page or YouTube channel.
Steam curators’ reviews should contain some semblance of their actual opinion, not just reworded game descriptions. Another red flag is if every game they review is huge, even some of the most prolific people working in the industry make time for indies and lesser-known projects.
Social Media Verification
Another way to check that a person is legitimate is to check their social media accounts.
For example, send the person a message on X or put a comment on their latest YouTube video verifying their request. If they are genuine, you should get a response reasonably swiftly.
If you can’t DM directly, post a screenshot of the request and tag them, asking if that was really them. If they answer, either way, you’ll know.
Even social media presence is an excellent barometer for determining whether the requester is real or not, especially for influencers.
Being an influencer is all about personal branding, so having links to social media is essential.
These social media links are almost always missing from the scammers’ emails. They’ll likely link you to their YouTube or Twitch channel but never to a social media profile.
Don’t give in to pestering
Steam key scammers are relentlessly persistent and will often email you several times in a bid to steal your precious keys.
This is a warning point in itself. No genuine influencer would request keys for multiple games from your studio in separate emails.
The scammer’s initial email and subsequent emails may play on your emotions to increase their chances of getting a key from you.
‘Sob stories’ are typical in all kinds of scams, and Steam key scams are no different.
These may include claims that they’re based in Ukraine and making content despite the war, saying they have a health problem but making these reviews helps them feel better, or promising to give extra keys to charity.
Don’t give in. Feel free to ignore them. Don’t accuse them of being scammers or argue. Just stay silent. They’ll eventually leave you alone.
Use Key Distribution Platforms
Steam has an internal system for distributing keys to legitimate curators called Curator Connect. If someone claims they can’t use it, run for the hills.
In addition, you can purchase access to secure key distribution services, such as Keymailer, Lurkit, and Terminals.io, which track who receives the keys and verify their legitimacy before granting access.
While these services are not 100% infallible, they are usually enough to outsmart and block the efforts of most scammers. Just be wary that Steam key scammers’ ever-evolving and sophisticated methods might mean some fraudsters will need to be manually purged, so keep your eyes peeled.
Email Verification
You can also check email addresses against scam databases to verify whether a trusted domain links to an email.
If someone claims to be from a major outlet and you suspect it’s a scam, put the email address into Google. There’s a good chance other developers may have reported it in places like Twitter/X or subreddits, which will show in the search results.
Steam key scammers posing as journalists also like to hide behind the claim that they are freelancers. They’ll claim that is why they don’t have an email address from the website they will apparently create content for using your key.
Community Support and Reporting
Working with other developers and agencies is a strong way to fight scammers. Knowledge sharing and reporting tools can help developers avoid common pitfalls.
Join Developer Communities
Many developers share their experiences with scammers on forums and Discord servers. By being active in these communities, you can learn the latest tactics. You can also get advice on suspicious key requests.
Shared Scammer Databases
Some PR firms and developer collectives share databases and spreadsheets of known scammers and suspicious emails. Contributing to and using these lists can help reduce your risk.
Report Scams to Platforms
Many platforms have systems to act against fraudulent accounts or content, so be sure to report scam attempts to platforms like Steam, YouTube, and social media networks whenever possible.
Google is becoming increasingly stringent about policing fake channels on YouTube, which is why these channels often rebrand to stay active.
The Evolution of Steam Key Scams and the Role of AI
As technology advances, so do scamming tactics. In recent years, scammers have become more sophisticated. They now use AI tools and complex social engineering to seem credible.
Here are some of the ways that we see things evolving.
AI-Generated Content
Steam key scammers increasingly use AI-generated emails, video content, and even fake reviews to create a sense of legitimacy.
AI can help scammers create more polished messages, making it harder to spot scams which previously would have been easily outed due to language errors.
Some scammers are even using AI to create fake video reviews that back up their claims of being high-profile YouTubers.
These fake reviews mimic real gameplay commentary with AI-driven voiceovers and replicate influencers’ speaking styles. This technique is uncommon in key scams, but it’s gaining traction as scammers seek clever new ways to deceive developers.
AI-Enhanced Social Engineering
AI lets scammers gather details about game developers and their networks. They’ll then use this info to craft targeted phishing attempts.
For example, the email you receive may mention one of your colleagues or reference other emails from their supposed friends.
If they reference an email that you haven’t been sent yet, that’s an easy red flag to spot. But it gets trickier when someone references your colleague, as that means you’ve got to take the extra step of reaching out to that person to see whether or not it’s legitimate.
Overall, this trend marks a scary shift from generic scams to more personal, harder-to-dismiss attacks.
In summary
The world of Steam key distribution is fraught with potential scams, but developers can protect themselves by staying vigilant and recognising the red flags.
As scamming tactics evolve, especially with the use of AI, it’s more important than ever to be cautious and methodical in verifying key requests.
Use community support. Use key distribution platforms wisely. Above all, If you’re in doubt or your gut feeling is that things just aren’t right, walk away from suspicious requests.
Working with other developers to identify prolific scammers and their methods can ultimately help. The same goes for working with a seasoned PR agency well-versed in identifying common scammer tactics.
Whatever you choose, we wish you the best of luck on the frontline of this ongoing war.
Good luck!
