The Steam API-Key Scam That Empties Rust Inventories

Ask people who've lost a Rust inventory how it happened, and it's rarely the coinflip. It's a fake login page. Skin phishing is the quiet, expensive threat around Rust gambling, and it works the same way over and over — so once you know the shape of it, it's genuinely easy to avoid.

How the scam works

It almost always starts with an unsolicited message: someone adds you on Steam or Discord and asks you to "vote for their team," "rate my skin," "claim a season reward," or "verify to withdraw." There's a link. The link leads to a page that looks like a real Steam login — or a real gambling/trading site — but isn't.

From there it goes one of two ways:

• —Credential theft: you type your Steam login into the fake page and hand it straight to the scammer.
• —Steam Web API-key theft: the fake site walks you through "logging in" in a way that exposes your Steam Web API key. With that key, a scammer can watch your trades and quietly cancel and redirect them — so a trade you think is going to a friend or a withdrawal actually lands in their inventory.

The API-key version is nastier because everything looks normal on your end until your skins simply don't arrive.

The red flags — all easy to spot

• —"Log in / verify on this other link." A legitimate site you already use doesn't need you to authenticate somewhere else. Treat it as hostile.
• —Unsolicited DMs with links. No real giveaway, reward, or promo is handed out through a random direct message. Assume every one is a scam.
• —Urgency. "Urgent," "limited time," "act now" is pressure designed to stop you thinking.
• —Anyone asking for your inventory or API key. Real support never needs you to transfer skins or share a key to "fix a bug."

How to shut it down

• —Only ever log in on the real Steam domains — check the address bar reads `steamcommunity.com` or `store.steampowered.com`, exactly. Bookmark the gambling sites you use and open them from the bookmark, never from a message.
• —Check your Steam Web API key at `steamcommunity.com/dev/apikey`. If there's a key registered that you didn't create, revoke it — that's a red alert.
• —Turn on the Steam Guard mobile authenticator. It blocks most account takeovers even if a password leaks.
• —Stick to sites you've actually vetted. Our legit checks and reviews exist so you're typing a known URL, not chasing one from a stranger's DM.

None of this requires being technical. It's four habits: bookmark real sites, never log in through a link someone sent you, keep your API key clean, and keep Steam Guard on. Do those and the most common way people lose a Rust inventory just stops being available to the scammers.

*18+ only. Gambling can be addictive — if it stops being fun, stop. See our responsible gambling page for support resources.*