Warning, a bunch of text incoming.
Now, my personal recommendation is if you want to buy and sell Steam items, do so through the Community Market, as everything else involves some sort of risk. If you decide to do a cash trade or any trade outside the Steam Community Market, here is some information that will hopefully keep you safe.
If you keep your Steam inventory public and own any CS:GO/DotA 2/PUBG skins that are worth more than 30$ or so, you've probably experienced being added by a random person out of the blue and asked whether you are willing to trade your items for PayPal/Steam codes/other skins. If you're at all willing to consider doing that, there are two things to say here: NEVER GO FIRST IN A DIRECT TRADE AS A SELLER and treat every such activity as a scam until you're convinced the person you're trading with is legit. There are many different scam methods, and I'm not going to go into details about every one of them in this thread at this time; I'll add a link to the SteamRep forums for a list of the most common scams.
Some good rules to go by, in no particular order:
- Apply common sense.
If it smells fishy, it's probably a scam. If it's too good to be true, it's probably a scam.
If the person adding you doesn't own the games they wanna trade items for (say they don't own CS:GO but are interested in your knife), then it's very likely a scam.
Check their games and their inventory - it's highly unlikely someone with an account worth 15$ (has PUBG on their account and another 55 free/0.01$ games and skins worth a grand total of 0.07$) will be willing to buy your Ivory school uniform set worth 800+$.
- Account age means nothing. Account level means nothing. "+Rep" means nothing. A "nicely looking" account means nothing.
A steam account from 2004 can be bought for <10$, and you can use lvlup bots to get your steam level boosted. It requires a small investment to do so (<100$), which most scammers consider a "cost of doing business". Rep4rep groups exist on Steam, rep bots do as well. Some scammers even post "how to stay safe from scams" threads on their profiles, don't fall for it. It only takes fooling one person once to recuperate the costs and make a profit.
A good rule of thumb is to run the person's Steam profile through the SteamRep database @steamrep.com, but keep in mind that they are also a volunteer organization and the moderator that used to process all the reports took a leave of absence a couple of months back. That being said, consider "unconfirmed reports" good enough to know the person behind that account is trying to scam you. It's also worthwhile checking out their friends list, if it's full of "ghost" accounts, or there are multiple people on there who are banned by SteamRep or one of the partner communities, it's safe to assume that person is probably a scammer.
For more tips regarding using SteamRep's resources and trading your items safely, hop on to their forums and read the pinned posts at the top here. I highly suggest spending the time to read every pinned post if you want to trade items, knowing all of the common scams is the first step of avoiding getting scammed.
- Be aware of people being too eager to do the deal or their story not adding up
Now, this goes back to someone adding you out of the blue as well, that's a clear sign something isn't right if you haven't posted your item for sale on any subreddits or external sites. That's the first time your spidey sense should start tingling, proceed with caution from there on. If the person you're talking to is being impatient, there's a high chance they are looking to scam you. If they offer to "prove" they're legit without you asking for it, they're most probably scammers. The most active type of scam lately is a new one that has been started by some Georgian guys whose steam profiles show them as based in Canada/USA/Germany/Spain/UK; you'll know they are Georgian (or claim to be) once they start sending you links to their social media (Facebook/Instagram profiles are the two most common I've encountered, dead giveaway is all their surnames end in -adze, -idze, -shvili -vali). NEVER ADD THESE PEOPLE ON SOCIAL MEDIA SITES OR AGREE TO A DIRECT CONNECTION, INCLUDING A STEAM CALL.
I've personally been contacted by about 15 different guys in the last month or so and their scam goes something like this: they send you a friend request, sometimes they also give you a message on your profile asking to add them; once you do, they act like you've known each other for years and if you agree to their offer for your items, they tell you a story how they can prove they are legit by showing you LIVE (on a stream or share screen) their PayPal and Bitcoin wallet balance. Keep in mind these things can be faked in advance as shown in this video here. Even if they aren't, until that balance is sitting in YOUR account, it means nothing. PayPal transactions are NOT secure and can be charged back months after you've concluded the trade; moreover, PayPal can dip into your personal bank account to compensate the buyer even if your personal balance shows ZILTCH (nothing, 0, flashing a "YOU'RE BROKE AF" sign). There's a rather large group on Facebook made by these guys that's made out almost entirely of fake profiles (you can buy Facebook group members at a rate something along the lines of 10$ per 5k ppl). The group in question is this one. What they do is they tell you "here, let me show you, I'm the owner/admin/moderator of a steam group with 35k ppl in it dedicated to trading, I'll post on here asking for recommendations" then starts logging into alt profiles and typing messages saying "+rep" or "trusted seller, I went first, everything was fine", which is obviously a lie.
They will do their utmost to convince you to go first in the trade, even though they were the ones contacting you, by telling you to check out their rep threads, market transactions, PayPal balance transactions, whatever. All of it is fake. They might agree to a middleman and propose a guy from that same Facebook group or someone that's indirectly connected to them, don't fall for it. They might also try to ask you to deposit the items in a third-party site for the sake of an "item verification" or to get the "item index number". Neither of those things exist, NEVER go outside of Steam with your items if you're not prepared to lose them.
Especially after Valve added the 7-day cooldown on steam trades, there's no reason to rush deals. Involving a middleman means it will take at least a week for the trade to be completed (as the item will be "stuck" in the middleman on cooldown for a week), which allows for more than enough time for a direct bank transfer to clear. Make sure both of you authenticate the middleman yourselves (every middleman listed at any point on SteamRep has a ton of accounts impersonating them) and you're all (middleman included) happy with the conditions of the trade. Middlemen don't charge any fees for their services, but it's a nice notion to tip them after a successful trade, as they are providing a service at the end of the day and they do double-check both parties to make sure there's no foul play happening.
- Never share screen with someone you don't know or click links they send you in steam chat
This is fairly straightforward, but scammers aren't only interested in your virtual items. There are multiple ways to obtain someone's IP address trough an unsecure direct connection (say, Steam call, logging into a teamspeak server, discord or Skype call w/ share screen or just logging into a random game server), and from there on out, it's down to social engineering to figure out how to get access to your accounts and personal files. Steam chat also uses a font that won't always show special characters, so something that might look like "opskins.com" and "feel" secure can turn out to be "ọpskins.cọm", or another URL masking a phishing site. To check this, you can highlight the text around the link you've been sent and paste it into notepad to see if the URL is legit; then again, if someone you don't know sends you a link in a steam chat window, assume it is a phishing attempt if you haven't explicitly asked for that link. If you want to take a chance and go check out the link they sent you, type it out yourself in your browser, don't copy-paste or click on anything.
Stay safe, everyone. I'll try and keep this updated.