The Holds: Steam Guard and Trade Protection
Two different holds govern CS2 trading. Steam Guard holds: accounts without the mobile authenticator held for at least seven days have items held up to 15 days when traded or listed; accounts with the authenticator for seven days confirm trades on their phone and skip the holds. Turning Steam Guard on, removing the authenticator, or signing in from a new device each triggers its own restriction window.
Trade Protection is newer and different: Valve’s 2025 update puts exchanged items under a 7-day Trade Protection window in which a victim who reports fraud can potentially reverse the transaction from trade history. Until that window ends, a traded item is not finally yours — do not resell it, count it toward another deal, or pay for it with an irreversible payment.
The API-Key Scam
The API-key scam is the most common high-level scam: a victim logs into a fake site that secretly generates a Steam API key for the account, and the scammer’s bot then cancels the victim’s legitimate trade and sends an identical-looking trade to the scammer’s account. The victim confirms what looks like the right trade and loses the items.
The defence is boring and complete: check your authorised API keys regularly at Steam’s API page, revoke any you did not deliberately create, and never generate one for a site you did not choose. No legitimate trading site needs your API key to complete a trade you initiated.
Fake Middlemen and Impersonation
Fake middlemen are the oldest scam in the space: a “Steam admin” or “SteamRep middleman” in a multi-person chat asks both traders to send items to the admin, who is a copied profile run by the scammer. Valve staff never trade with players, never ask for items, and never join trade chats — anyone claiming otherwise, with links or screenshots as proof, is the scam.
Quick-switch and camouflage scams work the same way, at the confirmation window: a high-value item swapped for a look-alike at the last second, or one expensive item hidden among hundreds of cheap cases. Read every item in the confirmation window, every time, including the float and pattern of the item you expect.
The Checklist Before Every Trade
- Authenticator on for 7+ days. Otherwise your items sit in holds and your trades look like a fresh account’s.
- API keys checked. Revoke anything you did not create, before the trade, not after.
- Counterparty verified yourself. Never through links, screenshots or chat invitations sent by the other trader.
- Confirmation window read item by item. Every item, every float, every pattern — not just the first one.
- Trade Protection respected. Do not pay irreversibly, and do not resell, until the 7-day window ends.
- Payment disputable. If cash changes hands off Steam, use a method you can dispute; never crypto, gift cards or friends-and-family transfers.
If You Were Scammed
Report it from trade history inside the Trade Protection window — that is what the window exists for. Change your password, revoke API keys, and deauthorise devices. Report the scammer’s profile and the phishing site. And accept the hard limit: a trade you confirmed, outside the reversal window, is very rarely undone by Valve, which is why the checklist above comes before the trade, not after.
Frequently Asked Questions
What is CS2 Trade Protection?
Valve’s 2025 update puts exchanged items under a 7-day window in which a fraud victim can potentially reverse the trade from trade history. Until it ends, treat a traded item as not yet finally yours.
How does the Steam API-key scam work?
A fake site secretly generates an API key for your account; the scammer’s bot then cancels your legitimate trade and sends an identical-looking trade to the scammer instead. Check and revoke unknown API keys.
Are CS2 middlemen real?
Real middlemen exist, but most requests involving one are fake copies — and Valve staff never trade with players or join trade chats. Verify identity yourself, never through links sent by the other trader.
Why is my CS2 trade held for 15 days?
Accounts without the Steam Guard mobile authenticator held for at least seven days have items held up to 15 days when traded or listed. Enable the authenticator and wait out its seven days.
Sources
- SkinsMonkey: How to Avoid CS2 Scams in 2026 (API, Trade Protection)
- Steam Community: PSA — Beware of Scammers (middleman impersonation)
- UrbanWired: Steam Guard vs Email Codes (trade and market holds)
