How to spot fake Steam key requests

Check every key request against the creator's own channel before you send anything. Write to the address listed there, give one key, and log who got it. Those three habits stop most key scams.

Valve's Steamworks documentation puts it plainly: "We've heard many reports of fraudsters impersonating journalists or storefronts to acquire keys, and then reselling those keys for profit." The pattern is familiar to most indie developers. Someone poses as a YouTuber, streamer, curator or outlet, collects free keys and sells them on key resale sites. Each one is a sale you lose.

Quick checklist

• Find the creator's channel or site yourself, through a search, not through links in the email.
• Copy the sender's address and search for it on that channel's About or contact page. You want an exact match.
• Check that the channel posts regularly, covers games like yours and links to the same social accounts.
• Send one key per creator, unless your game needs two players.
• Decline giveaways run by other people.
• Start a new email to the listed address instead of pressing reply.
• Log each key with the name, address, channel link and date.
• Use Curator Connect for Steam curators.

Red flags, with examples

Every name, address and domain in these examples is invented.

1. A free webmail address claiming a big channel

From: Snugfern Plays <snugfernplays.biz@webmail.example>
Subject: Collab request

Dear developer,
I run Snugfern Plays, 1.2M subscribers. Please send 5 Steam keys
for me and my team so we can cover your game. We need them today
to schedule the video.

Larger creators usually list a business address on their channel. A free webmail address that appears nowhere on the channel is the most common warning sign. Here it comes with three more: a generic greeting, no game name, and a request for several keys. Developers also note that very large channels rarely ask for keys at all.

2. Lookalike domains and letters

From: Bitmoor Gazette Reviews <reviews@bitrnoorgazette.example>
Subject: Review copies for Glimwhistle

Hello Brindlewick Studio, our writers would love to review
Glimwhistle. Could you send 3 keys for the review team?

The real outlet uses bitmoorgazette.example. This one swaps the "m" for "rn", which reads the same at a glance. Some scammers go further and use Cyrillic letters that look identical to Latin ones, so careful reading will not catch them. Copy the address and search the outlet's contact page with Ctrl+F, or paste both into a text compare tool. A lookalike will not match.

Fake outlets exist too: sites built from articles copied elsewhere, with no social accounts of their own. If you search a sentence from one of their reviews and find it on other sites, move on.

3. Links that do not line up

From: Hollow Oak Curators <hollowoak.curators@webmail.example>
Reply-To: keys.desk@mail-relay.example
Subject: Steam curator review

Our curator group would like to feature your game.
Channel: youtube.com/channel/UCq8Zr2xLm40TpWv7KdA1nB

Three problems here. First, the Reply-To line sends your answer to a different address than the one in the From line. Second, the channel link uses a long random ID rather than a named handle. One developer found the same ID behind several "different" creators: the channel had been renamed and restyled between requests. Names can change, but a channel ID stays the same, so note it. Third, Steam curators can receive copies through Curator Connect, so an email request deserves a closer look.

Also open the social accounts the channel lists and confirm they link back to it.

4. Mass requests and pressure

Copy-paste mail is easy to spot once you look for it: "Dear developer", no mention of your game, wording you have seen from other senders, and a deadline. Requests for "a few keys for my team" or keys for a giveaway are common too. Giveaway keys rarely bring sales and often get resold. A real creator can wait a day while you check.

5. Channels that look hollow

Subscribers can be bought, so check activity instead. Warning signs include plenty of subscribers but few uploads, raw gameplay with no commentary, and high view counts with almost no comments. One studio that screened for subscribers and regular uploads later found most of those channels gone.

How to verify a request

1. Search for the channel, outlet or curator page by name and open it from the results.
2. Find the contact address. On YouTube it is usually in the channel's About section. Outlets list staff or press contacts.
3. Copy the sender's address and search for it there.
4. If it does not match, write to the listed address: "We received a key request in your name from another address. Please confirm from this address and we will send a key." Real creators reply. Impostors go quiet.
5. Look at recent uploads or articles. They should cover games like yours, with real commentary and real comments.
6. If you cannot verify a request, let it go.

Safe ways to hand out keys

• Curator Connect. Steam's own tool sends review copies straight to curators' accounts, with no email or keys involved. You can expire an offer that has not been accepted, though an accepted copy cannot be revoked. Your game needs a public store page or a release to use it.
• A key distribution service. These services screen creators and track who claims each key, which saves time. Scam channels have still slipped through, so keep checking anything that looks off.
• Small numbers. Valve advises requesting keys in small batches and says to "treat keys like cash." Keep a separate batch for press and creators so you can act on it without touching keys sold to players.
• A key log. Record each key next to the person, address, channel ID and date. One developer treats a key redeemed days after an "urgent" request as a sign it was resold.

What to do if a key is resold

Stop sending keys to that contact and add the address to your block list. Then check your remaining keys.

In Steamworks, the Ban or Disable Steam Keys page lets you ban keys you have the rights to. In the second step you choose whether to ban every key in a batch or only the ones not yet activated. Valve's documentation says developers may ban keys "that have been stolen or purchased fraudulently," and also says you should never ban or disable keys that were legitimately sold to customers. Banning unused keys in a press batch is the cautious move. Valve also asks developers to take care, because a ban can remove access from legitimate customers.

Your key log tells you which batch and which contact a key came from. That makes the next decision easy.

Our Key Request Triage template for n8n labels these emails in Gmail and drafts replies for the real ones.

To check a request you have received, paste it into our free Steam key request checker.

Sources

• Steam Keys, Steamworks Documentation
• Curators and Curator Connect, Steamworks Documentation
• Curator Connect FAQ, Steam

Steam is a trademark of Valve Corporation. n8n is a trademark of n8n GmbH. ReadyUpAgents is independent and not affiliated with or endorsed by n8n, Google, Valve or Steam.