Free game gift trap on Steam: 6 security warnings for gamers from experts

On Steam, one of the world's most popular gaming platforms, "free game gift" offers from people you do not know are emerging as one of the new traps used by cybercriminals. Bitdefender experts have warned gamers that such messages may be linked to account takeovers, payment card fraud, and phishing attacks.

Steam's game gifting feature is used as a practical way for users to share games. However, according to experts, attackers can exploit this system to circulate games purchased with stolen cards, seize in-game items, redirect users to fake login pages, or gain trust to solicit money.

Operations Director Alev Akkoyunlu stated that a gift from an unknown account is often not a selfless gesture, noting that scammers aim to create a sense of gratitude or obligation in the player. Akkoyunlu pointed out that young players, in particular, can be more easily deceived by promises of "free games" and "rare items."

“The most effective method of protection here is very simple: Do not accept gifts from someone you do not know and do not send anything in return.”

WHAT SHOULD YOU WATCH OUT FOR IN GIFT MESSAGES?

The first step recommended by experts is to reject gift offers from unknown users. Even if the offer seems attractive, accepting a gift from an unknown account can pose risks to both account security and potential platform restrictions. According to Valve's warnings, gifts from stolen sources can also cause problems for the accounts that accept them.

One of the methods scammers frequently resort to is the "I sent it by mistake" excuse. In this scenario, the attacker first tries to gain trust with a small gift; then, they claim to have sent a more expensive item by mistake and may ask for rare in-game items, wallet codes, or money. Experts emphasize that no payments or items should be sent in the face of threats, pressure to file complaints, or attempts to rush the user.

Another critical risk is fake links. Links that ask you to log in to accept a gift, verify your age, or view the sender's profile can redirect you to phishing pages that mimic Steam. It is recommended that you never interact with links that ask for a username, password, Steam Guard code, or QR confirmation.

Attempts by attackers to move the conversation off Steam, especially to platforms like Discord or Telegram, should also be considered suspicious. You should not trust individuals who identify themselves as Valve or Steam Support employees and ask for items to be "verified." It is worth remembering that Valve employees do not resolve account issues via chat applications.

There is also a separate warning for parents: Children who play games should be taught not to accept gifts from people they do not know, not to send items or information in return, and to always consult an adult in suspicious situations. Additionally, unexpected gifts from an account you know should be verified through a different communication channel, as friend accounts may also have been compromised.

For account security, it is recommended to enable Steam Guard, use a unique and strong password for every account, and keep two-factor authentication active. An up-to-date security solution can also provide additional protection by detecting fake pages and malicious links.