Today I discovered that there are tons of Keys with doubtful origin injecting into the market

There is a tl;dr at the end

It was a bright Sunday morning, when I stumbled across an extremely abnormal behavior of prices of Earbuds in terms of Keys. I was making a regular look on the real-time chart of Earbuds and I noticed two things

1. Simple Moving Average of 50 Trades just jumps
2. Volume (Quantity of Buds traded in 4 hours) is quadruple (4x) the normal number

I began investigating who sold such Buds, at what prices, and at what time. It turns out that there are dozens of unique traders successfully selling Buds at 28, 29 and 30 Keys each. (29, 30 not shown below because of filtering rules)



The first few questions that came to my mind were

1. Are the trades legit?
2. Is someone trading back and forth between alts, i.e. fake trades?
3. Is there a bug in the system?"

As I continue to manually auditevery seller with the data table by

1. Checking the original_id of Buds
2. Checking the original_id of Keys
3. Investigating friends lists
4. Search for relevant ads on Outpost made by the seller

I noticed some abnormal events.

For instance, fried noobles had this trade; and ilhoudne had this trade.
fried noobles sold a few Buds at high price, while ilhoudne sold 1 Buds also at high price.
What was strange is that the Keys they received in the trade, all had original_id with alternating consecutive numbers.

By alternating + consecutive original_id of Keys, I mean

• 1188096131
• 1188096133
• 1188096135
• 1188096137
• 1188096139

Consecutive means that the buyer is the purchaser of Keys from Mann Co. Store.
But what about alternating numbers? Keys purchased from Store should have been totally continuous, i.e. 1, 2, 3, 4, 5 ...

This is the backpack of Buds seller fried noobles

This is the backpack of Buds seller ilhoudne

I immediately added both seller and kindly asked for their help. Both of them told me that their buyer, with tons of purchased keys, was

|steamID: Gnom
|steamID32: STEAM_0:0:16975419
|steamID64: http://steamcommunity.com/profiles/76561197994216566
|customURL: http://steamcommunity.com/id/Gnom3333
|steamrepURL: http://steamrep.com/profiles/76561197994216566

Gnom had a "friends only backpack" privacy setting and friends list as shown here.

I then asked ilhoudne to get the JSON Backpack of the Steam Community Inventory Page of Gnom (ilhoudne is from Italy), but it was too late. He was already cashing out the Buds to Russian Rubles. FYI 700 Rub is USD$22.71

So, who buys tons of Keys at $2.49 from store, buy Buds at 28-30 keys and then cash out to USD$22.71 per Buds? This makes no sense at all.

On the friends list of the shady buyer Gnom, there was another person purplerat who does similar things
|steamID: purplerat
|steamID32: STEAM_0:1:18361038
|steamID64: http://steamcommunity.com/profiles/76561197996987805
|customURL:
|steamrepURL: http://steamrep.com/profiles/76561197996987805


So we get the idea that they do purchase large amount of Keys on near-empty inactive accounts to buy Buds with Keys at ridiculous prices and cash out.

Afterwards, I looking at a seller who sold > 10 Buds at 28 Keys today cautiousfox
His backpack after the trades

And then, my good friends , who also sold quite a lot of Buds at high price today
Sick-My-Duck -------- His Backpack
naknak ---------------- His Backpack

I asked them what happened lately. They said that for the past few months, there has been some Earbuds buyer frequently buying Buds with Store Purchased keys in Bulk, in some cases, 10 Buds at a time.

Seller Sick-My-Duck said that most buyers are members of the "Invite Only" Steam Group
http://steamcommunity.com/groups/noprode
Notice the comment "Oops, two scammers have lost on steamrep. :3 Have fun being blacklisted "

He said at least 3 of his buyers were in this group and were mutual friends.
I wrote down the three profiles Sick-My-Duck supplied to me and wrote a script which searches for Mann Co Package from Members of the Group.

Members of the group who has engaged in such suspicious behavior:

http://steamcommunity.com/profiles/76561198023031871/
ingener17
16 Packages
owned by 76561198075294580
was Free-to-Play on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561198029167264/
Dratmer
Public profile, Private Backpack
was Free-to-Play with public backpack on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561198061247058/
MX Russia # 2
No more packages
was Free-to-Play on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561198006616326/
Fan Fan
No more packages
was Free-to-Play on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561198038481010/
FarinktoN
16 Packages
was Free-to-Play on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561198006121241/
Painter
17 Packages
was Free-to-Play on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561198047927808/
killers55
16 Packages
was Free-to-Play on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561197987575463/
puzey
16 Packages
was Free-to-Play on May 23, 2012 (empty)
Bought Buds from Muhfugger (Archived Backpack) on 2012-11-04, puzey still has the Buds

http://steamcommunity.com/profiles/76561198052631237/
Blade
16 Packages
was Free-to-Play on May 23, 2012 (empty)

http://steamcommunity.com/profiles/76561198010626965/
Батюшка™
14 Packages
was Free-to-Play on May 23, 2012 (empty)

Here are the conclusions from the suspicious group.

1. We all know that Mann Co Package is grant for every USD$20 of purchase from Store. They had 14-17 Packages, so they "spent" USD$280-$340 on Keys using each account.
2. All the involved accounts in this group were created at least months ago.
3. The accounts were Free-to-Play (Per my replication of Valve's database in May 23, 2012)
4. No weapons/hats stayed in these backpacks.
5. They sometimes open the Mann Co Packages or just give them away to Buds sellers.
6. Usually no Keys/Buds were left behind.
7. The proven accounts NEVER signed in at TF2 Outpost. However, they do look for Buds sellers there.
8. They refer each other to the largest Buds sellers on Outpost

So it is reasonable to believe that this is a group that is worthy of our attention.
From the script I made, the Group

• Has 65 Members
  • Of which 30 has Public Backpacks
    • Of which 23 are Premium
      • Of which 6 has Keys left
      • Of which 6 has Mann Co Packages left
    • Of which 7 are Free-to-Play
  • Of which 35 has Private Backpacks

You can imagine the impact of this group if they inject thousands of Keys into the market every week by suspicious means.

There are also two additional accounts supplied by the Buds seller Sick-My-Duck.
These two are not group Members.


http://steamcommunity.com/profiles/76561198072115106/
wiz
Account created on September 22, 2012 (which is very recent)
Backpack Today

http://steamcommunity.com/profiles/76561198038883849/
NOISE@M3W
was Free-to-Play on May 23, 2012 with 31 low-value items
Backpack per my replication of Valve's database in May 23, 2012
Backpack Today

-----------------------

Now, back to the accounts mentioned in the beginning (purplerat, friend of Gnom)
Backpack of purplerat on May 23 , 2012
Backpack of purplerat Today
Backpack of Gnom on May 23, 2012 was empty, but was Premium with 300 Slots.
Backpack of Gnom Today based on Translated Italian JSON supplied by the Buds seller

By comparing the 4 snapshots, we can conclude that purplerat transferred some Vintage Weapons to Gnom, to make Gnom "look like" a player from the old times, and that someone has access to both accounts.

-----------------------

Now let's talking about Consecutive Numbers (1, 2, 3...), "Consecutive Even" Numbers (2, 4, 6...), "Consecutive Odd" Numbers (1, 3, 5...)

I mentioned before that the Keys received by the two Buds seller fried noobles and ilhoudne were all "consecutive even".

The truth, after creating a script which dumps all original_id of Keys sitting on Buds sellers' backpacks, is that the Keys received by the sellers for the past month form a series from 1 of the 3 kinds (cons, cons odd, cons even.)

Inspect the following spreadsheet carefully, they are the dumps from the script, with each column forming a series.
https://docs.google.com/spreadsheet/ccc?key=0AigPUOUQ7pCsdGxMQlowZzVQZ281UEYyN0thNnhLT2c

The sellers often trade away some keys for other purposes. Otherwise, the oringinal_id series would have been longer (extended).

As you can see, for each Buds the sellers sold, the original_id of received Keys form a LONG series (usually >20 Keys).
Also, the series could sometimes be completely odd, completely even, or a mix of both (not shown in the spreadsheet).

Note: I assume that original_id of an item does not changes under any circumstances. Only the id (or current_id as referred by TF2Items) changes when an item is being traded. In the spreadsheet, every number is an original_id.

-----------------------

So far we have proven that there are people injecting tremendous amount of Keys of unknown origin every week.

The questions I would like the entire trading community to consider are:

1. How did the Russians in this post manage to purchase vast amount of Keys from Valve, regularly, via fraudulent means?
   • Theory (Speculation)
     • Get new accounts
     • Wait for a few months
     • Buy Keys @USD$2.49 from Store with Stolen Credit Card (Usually USD$300 total)
     • Buy Buds from largest sellers on Outpost @2 Keys higher than daily average
     • Sell Buds for USD$22.71 or Webmoney equivalent
     • Keys get circulated in the market
     • Credit Card company charges back Valve because virtual item has no cost
     • Valve never deletes injected keys
     • Repeat Step 1
   • Feel free to propose more theories.
2. Are these acts conducted by a single person or distinct users?
3. If it is not the former, does a "leader" exist among the Keys purchasers?
4. Were the first two accounts (Gnom, purplerat) mentioned in beginning related to the Steam Group?
5. Were the accounts "Hijacked" to become alts of Keys purchasers, or did the purchasers prepared the accounts over the last few years?
6. Why do some of them trade alternating Keys (either odd or even original_id) to Buds sellers?
7. Is it a safety measure to bypass Valve's Steam Support tracking system so that the Keys "Do not look concentrated" in certain backpacks?
8. Why do the Keys purchaser choose the largest Buds sellers on Outpost aside from the benefit of having continuous stock of Buds?
9. There were members of the Steam Group being trade banned. Does larger Buds seller on Outpost have lower risk of being trade banned because of receiving suspicious Keys, given that their trading record is legit?

More importantly, this is not the first time such events are documented.
Someone on SourceOP documented similar events back in April 2012.
This leads to the questions:

1. When did the Russians mentioned start injecting keys into the market? Fall 2011 when Buds started to rise? Summer 2012? Before Halloween? For sure it is not today.
2. What if such injection of Keys is the main cause of indefinite decrease in value of Keys for the past 2 years?
3. What if such method of injecting Keys is the main cause of the dramatic increases of the Price of Earbuds in terms of both USD and Key value?
4. Do you prefer such Keys being constantly injected into the market?
5. What should we do as legit traders?
6. What should have been done to the Store purchasing system if you were given authority?

-----------------------

tl;dr A group of Russians bought >5,000 Keys from Store today using illegitimate credit cards and bought few hundred Buds from TF2 Outpost at an ridiculous price of 28-30 Keys (The average yesterday was 25.5 Keys). They have been doing this for quite a long time and their activity today is alarming.

-----------------------


I would like to take the opportunity to genuinely thank the Earbuds sellers today:
fried noobles, ilhoudne, cautiousfox, Sick-My-Duck and naknak for provide me necessary information unconditionally, so that truth may be revealed in this post. A few undisclosed friend also helped.

I would also like to thank the creator of Backpack.tf, Brad Pitt, for providing me archived JSONs of backpacks on my request.

Lastly, thank you Valve for providing the API.

You may check the real-time chart here.


This is the imgur album.

-----------------------

Please take you time to read the entire post and say what needs to be said.

If this is true (and it looks very convincing) we should get Valve involved in this and they should really check those purchases and check with the CC companies to see if those were fraudulent charges. This could be over $10k in charges (in the single latest event) plus I'm sure they would not be happy a group of people are manipulating their economy.

Also, if they're not based in the US isn't the store not in USD? Unless they're using VPNs to login and look like they're coming from the US

There are a couple points that I'd like to make, the first being is that this is all speculative. I agree that it looks suspicious, but I think we'd have to trust Valve to be on top of things if they were actually being charged with thousands of fraudulent purchases every day. Second, I don't think there is anything that us traders could actually be doing. Valve wouldn't ever delete these keys because they'd have to reverse a massive amount of trades (and every trade can bubble out into 26-27 more so that gets to be way too much to handle after like 3 or 4 layers). To me it sounds like a money laundering scheme, probably a massive one if it's truly on the scale you're talking about. This is a legal issue that we should probably all try to stay out of unless you can think of a way in which this would be directly affecting us (keys naturally devalue, I doubt they'd really be behind that)

They can buy Keys at 74 Rub (USD$2.34 Equivelent) http://wiki.teamfortress.com/wiki/Mann_Co._Supply_Crate_Key/ru in Russia.

They bought them but immedidately cashed out at 30 Rub per Key, 700 Rub per Buds http://i.imgur.com/nJHz9.png

Unless Earbuds are 9 Keys each, it is impossible for them to make profit without using illegitimate means to obtain keys from store.
Keep in mind that they even paid 28-30 Keys to buy an Earbuds on TF2 Outpost.

I also noticed this last week (November 5th), when a Russian bought 3 of my buds for 28 keys each. After I sold them, another added me wanting to buy more, I declined (see gorodok screenshot 1). I saw many buds from several different accounts being traded to a single main account, then finally 25 buds being moved into a new account.

Here was the main account which all the buds were traded into (Commander): http://steamrep.com/profiles/76561198049728744
http://steamcommunity.com/id/commander_spb/friends

From the friends list of Commander, there are some of the several accounts used to trade keys to buds, (their inventories all contain mann co store packages):
http://steamcommunity.com/id/steriossteriso2222
http://steamcommunity.com/profiles/76561198023300703
http://steamcommunity.com/profiles/76561198034254553
http://steamcommunity.com/profiles/76561198017442856

Here is the final account which the buds were traded into (Lomik) (see 2nd screenshot lomik), the account is set to private now:
http://steamcommunity.com/profiles/76561198075194100

I hope this provides further confirmation/evidence of this activity.

I just want to show one more concrete proof that this has happened before 6 months ago.

The accounts were found by looking at backpack archive at 2012-05-23

These are the accounts that have Mann Co Store Packages that had original_id = current_id, i.e. the store granted them directly.

http://steamcommunity.com/profiles/76561197972715916 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197974791363 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197975624317 -------- 16 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197977929349 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197979938511 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197982488227 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197986820994 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197991984665 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197995462539 -------- 14 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197995465860 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197996587224 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197997406353 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197998271866 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561197998283651 -------- 17 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198000154435 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198000503958 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198001673823 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198004838950 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198006550017 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198007630883 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198007756251 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198008106465 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198008595920 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198008779615 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198020003839 -------- 10 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198020445418 -------- 31 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198021973968 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198023034338 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198029669118 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198029754254 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198030174914 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198034904050 -------- 12 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198039578357 -------- 37 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198044483483 -------- 18 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198045262837 -------- 12 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198059885838 -------- 15 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198063874350 -------- 11 Mann Co Store Packages
http://steamcommunity.com/profiles/76561198064098428 -------- 11 Mann Co Store Packages
Notice how the number of original packages is exactly 18 all the time.

mules, buying 192 keys with a stolen CC

I think Valve knows about it pretty much but its not feasible for them to counter this as the opportunity cost is higher than the loss. So they just go along with it as the loss they make is negligible as compared to thousands of other legitimate sales.

ehm, quite in contrary, Valve cracks pretty hard on that, for it costs them a lot of money, while those frauds are whitewashing the cash.

Absolutely correct!

Credit card fraud is taken very seriously by law enforcement the world over, and a company like Valve will always takes measures to try to protect itself against complaints from CC companies accusing it of being lax with security measures.

Nothing new... great info though, but nothing new. Get stolen CC, buy items from valve store, turn them around for real money = profit...

It's about the same as: Guy gets stolen CC, guy buys TV at Best Buy, guy sells TV on Craigs list for cash...

This is pretty crazy. I mean, I knew that scammers were doing this in small time, but nothing like this.

They have been doing this awhile, nothing really new.

Edit: PC Gamer Quote:

gg, yes we call these scammers "carders"

I'm going to so far to speculate that they're using the Mannco store and tf2 to do a lot of the laundering work.

Think about it, they get fraudulent funds and trade them for keys and quickly turn those over for a different item and them quickly sell it for a legitimate purchase of money for buds. Immediately from the Mannco Purchase, the stolen funds becomes Valve's problem if Credit Card companies investigate, Valve would need to refund, but can't remove the keys or anything because they've already been dispersed throughout the Mannconomy because of quick trade to bulk sellers who I would assume sell keys in bulk as well, and suddenly 28 keys from dubious funds becomes 2 keys in 14 people's backpacks and so on. But this begs the question, Why have these companies not come knocking? These people must be leeching funds in a hard to detect way, but that's not our problem. Our problem is that we're the middle step in these people's operation and it's going to affect all of us from key flooding.

Judging from the evidence, It looks like after the buds are purchased, then traded around a bit to take the scent off, to make it look like they just wanted a bunch of buds with daddy's money and then traded it for what they wanted. From there, there's other accounts used to sell the buds for money, accounts not associated with the people purchasing from the Mannco store. If you use something like a paypal gift, they can't chargeback, but then again, you're buying buds for like 10 dollars cheaper than normal, you aren't complaining too much. After they get some tf2 player's money, I don't know if they're using another step to hide it even further, but that's not our concern. This would effectively help hide the source of funds from the end where they turn it to physical cash to do whatever with. I could guess after the tf2 step, they would pass some of the money around through paypal, or similar services, with possibly another step to hide it, but they might not need to, tf2 might be doing it well enough for them.

TL;DR: I'm postulating that these people are sacrificing some of their stolen money to go through the tf2 economy to launder the funds. This is possibly the middle or end step to solidify the possession of stolen money. Of course, this is speculation and if Valve finds any other evidence to support it, it could be 10's of thousands of dollars of fraud and Russian authorities would need to investigate it.

Please stop perpetuating urban myths, a virtual items does NOT receive the the same protection as physical items and irrespective of what a buyer may put as an addendum, the vast majority of chargebacks will win. Good idea people start to read PayPal rules and conditions along with Virtual Item FAQs and extant documentation regarding chargeback cases, all easily available via Google.

Anyway, credit card fraud is an issue for Valve and effected CC companies, along with relevant authorities. I would be very surprised if their data collation of store purchases does not flag transactions outside the mean in a hurry, and we can be sure Valve are aware of this thread, so presumably any appropriate action would be taken.

I am so pleased that all that happened coz of mine report to steam curator :3 ( i can find more info about carders if needed)

I also have his paypal e mail and webmoney id
contact me if needed

@ VenGanZa re:

Not only credit cards can be affected, but also debit cards. I think it is incontrovertible the fraud affects the credit card holders as well.

Here is an interesting article:
http://www.forbes.com/sites/kenrapoza/2012/04/24/russias-millionaire-dollar-hackers/

Congrats base64, your investigation made it on Kotaku. Really nice work.

... I can't really think of a legit way to stop this, other then warn all buds sellers? But I mean, they gain huge profit from these trades, so...

Outstanding work base64 on all this data collection and thorough analysis

Assuming items bought together in the store are assigned sequential ids, I think the key seller only selected nonsequential keys when he put them in the trade window. In other words, he selected a key, skipped the 2nd one, selected the 3rd key, skip the 4th, and so forth - basically an easy way to break sequence. Luckily he had an obvious pattern in his selection process.