There is a tl;dr at the end It was a bright Sunday morning, when I stumbled across an extremely abnormal behavior of prices of Earbuds in terms of Keys. I was making a regular look on the real-time chart of Earbuds and I noticed two things Simple Moving Average of 50 Trades just jumps Volume (Quantity of Buds traded in 4 hours) is quadruple (4x) the normal number I began investigating who sold such Buds, at what prices, and at what time. It turns out that there are dozens of unique traders successfully selling Buds at 28, 29 and 30 Keys each. (29, 30 not shown below because of filtering rules) The first few questions that came to my mind were Are the trades legit? Is someone trading back and forth between alts, i.e. fake trades? Is there a bug in the system?" As I continue to manually auditevery seller with the data table by Checking the original_id of Buds Checking the original_id of Keys Investigating friends lists Search for relevant ads on Outpost made by the seller I noticed some abnormal events. For instance, fried noobles had this trade; and ilhoudne had this trade. fried noobles sold a few Buds at high price, while ilhoudne sold 1 Buds also at high price. What was strange is that the Keys they received in the trade, all had original_id with alternating consecutive numbers. By alternating + consecutive original_id of Keys, I mean 1188096131 1188096133 1188096135 1188096137 1188096139 Consecutive means that the buyer is the purchaser of Keys from Mann Co. Store. But what about alternating numbers? Keys purchased from Store should have been totally continuous, i.e. 1, 2, 3, 4, 5 ... This is the backpack of Buds seller fried noobles This is the backpack of Buds seller ilhoudne I immediately added both seller and kindly asked for their help. Both of them told me that their buyer, with tons of purchased keys, was |steamID: Gnom |steamID32: STEAM_0:0:16975419 |steamID64: http://steamcommunity.com/profiles/76561197994216566 |customURL: http://steamcommunity.com/id/Gnom3333 |steamrepURL: http://steamrep.com/profiles/76561197994216566 Gnom had a "friends only backpack" privacy setting and friends list as shown here. I then asked ilhoudne to get the JSON Backpack of the Steam Community Inventory Page of Gnom (ilhoudne is from Italy), but it was too late. He was already cashing out the Buds to Russian Rubles. FYI 700 Rub is USD$22.71 So, who buys tons of Keys at $2.49 from store, buy Buds at 28-30 keys and then cash out to USD$22.71 per Buds? This makes no sense at all. On the friends list of the shady buyer Gnom, there was another person purplerat who does similar things |steamID: purplerat |steamID32: STEAM_0:1:18361038 |steamID64: http://steamcommunity.com/profiles/76561197996987805 |customURL: |steamrepURL: http://steamrep.com/profiles/76561197996987805 So we get the idea that they do purchase large amount of Keys on near-empty inactive accounts to buy Buds with Keys at ridiculous prices and cash out. Afterwards, I looking at a seller who sold > 10 Buds at 28 Keys today cautiousfox His backpack after the trades And then, my good friends , who also sold quite a lot of Buds at high price today Sick-My-Duck -------- His Backpack naknak ---------------- His Backpack I asked them what happened lately. They said that for the past few months, there has been some Earbuds buyer frequently buying Buds with Store Purchased keys in Bulk, in some cases, 10 Buds at a time. Seller Sick-My-Duck said that most buyers are members of the "Invite Only" Steam Group http://steamcommunity.com/groups/noprode Notice the comment "Oops, two scammers have lost on steamrep. :3 Have fun being blacklisted " He said at least 3 of his buyers were in this group and were mutual friends. I wrote down the three profiles Sick-My-Duck supplied to me and wrote a script which searches for Mann Co Package from Members of the Group. Members of the group who has engaged in such suspicious behavior: http://steamcommunity.com/profiles/76561198023031871/ ingener17 16 Packages owned by 76561198075294580 was Free-to-Play on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561198029167264/ Dratmer Public profile, Private Backpack was Free-to-Play with public backpack on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561198061247058/ MX Russia # 2 No more packages was Free-to-Play on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561198006616326/ Fan Fan No more packages was Free-to-Play on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561198038481010/ FarinktoN 16 Packages was Free-to-Play on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561198006121241/ Painter 17 Packages was Free-to-Play on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561198047927808/ killers55 16 Packages was Free-to-Play on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561197987575463/ puzey 16 Packages was Free-to-Play on May 23, 2012 (empty) Bought Buds from Muhfugger (Archived Backpack) on 2012-11-04, puzey still has the Buds http://steamcommunity.com/profiles/76561198052631237/ Blade 16 Packages was Free-to-Play on May 23, 2012 (empty) http://steamcommunity.com/profiles/76561198010626965/ Батюшка™ 14 Packages was Free-to-Play on May 23, 2012 (empty) Here are the conclusions from the suspicious group. We all know that Mann Co Package is grant for every USD$20 of purchase from Store. They had 14-17 Packages, so they "spent" USD$280-$340 on Keys using each account. All the involved accounts in this group were created at least months ago. The accounts were Free-to-Play (Per my replication of Valve's database in May 23, 2012) No weapons/hats stayed in these backpacks. They sometimes open the Mann Co Packages or just give them away to Buds sellers. Usually no Keys/Buds were left behind. The proven accounts NEVER signed in at TF2 Outpost. However, they do look for Buds sellers there. They refer each other to the largest Buds sellers on Outpost So it is reasonable to believe that this is a group that is worthy of our attention. From the script I made, the Group Has 65 Members Of which 30 has Public Backpacks Of which 23 are Premium Of which 6 has Keys left Of which 6 has Mann Co Packages left Of which 7 are Free-to-Play Of which 35 has Private Backpacks You can imagine the impact of this group if they inject thousands of Keys into the market every week by suspicious means. There are also two additional accounts supplied by the Buds seller Sick-My-Duck. These two are not group Members. http://steamcommunity.com/profiles/76561198072115106/ wiz Account created on September 22, 2012 (which is very recent) Backpack Today http://steamcommunity.com/profiles/76561198038883849/ [email protected] was Free-to-Play on May 23, 2012 with 31 low-value items Backpack per my replication of Valve's database in May 23, 2012 Backpack Today ----------------------- Now, back to the accounts mentioned in the beginning (purplerat, friend of Gnom) Backpack of purplerat on May 23 , 2012 Backpack of purplerat Today Backpack of Gnom on May 23, 2012 was empty, but was Premium with 300 Slots. Backpack of Gnom Today based on Translated Italian JSON supplied by the Buds seller By comparing the 4 snapshots, we can conclude that purplerat transferred some Vintage Weapons to Gnom, to make Gnom "look like" a player from the old times, and that someone has access to both accounts. ----------------------- Now let's talking about Consecutive Numbers (1, 2, 3...), "Consecutive Even" Numbers (2, 4, 6...), "Consecutive Odd" Numbers (1, 3, 5...) I mentioned before that the Keys received by the two Buds seller fried noobles and ilhoudne were all "consecutive even". The truth, after creating a script which dumps all original_id of Keys sitting on Buds sellers' backpacks, is that the Keys received by the sellers for the past month form a series from 1 of the 3 kinds (cons, cons odd, cons even.) Inspect the following spreadsheet carefully, they are the dumps from the script, with each column forming a series. https://docs.google.com/spreadsheet/ccc?key=0AigPUOUQ7pCsdGxMQlowZzVQZ281UEYyN0thNnhLT2c The sellers often trade away some keys for other purposes. Otherwise, the oringinal_id series would have been longer (extended). As you can see, for each Buds the sellers sold, the original_id of received Keys form a LONG series (usually >20 Keys). Also, the series could sometimes be completely odd, completely even, or a mix of both (not shown in the spreadsheet). Note: I assume that original_id of an item does not changes under any circumstances. Only the id (or current_id as referred by TF2Items) changes when an item is being traded. In the spreadsheet, every number is an original_id. ----------------------- So far we have proven that there are people injecting tremendous amount of Keys of unknown origin every week. The questions I would like the entire trading community to consider are: How did the Russians in this post manage to purchase vast amount of Keys from Valve, regularly, via fraudulent means? Theory (Speculation) Get new accounts Wait for a few months Buy Keys @USD$2.49 from Store with Stolen Credit Card (Usually USD$300 total) Buy Buds from largest sellers on Outpost @2 Keys higher than daily average Sell Buds for USD$22.71 or Webmoney equivalent Keys get circulated in the market Credit Card company charges back Valve because virtual item has no cost Valve never deletes injected keys Repeat Step 1 Feel free to propose more theories. Are these acts conducted by a single person or distinct users? If it is not the former, does a "leader" exist among the Keys purchasers? Were the first two accounts (Gnom, purplerat) mentioned in beginning related to the Steam Group? Were the accounts "Hijacked" to become alts of Keys purchasers, or did the purchasers prepared the accounts over the last few years? Why do some of them trade alternating Keys (either odd or even original_id) to Buds sellers? Is it a safety measure to bypass Valve's Steam Support tracking system so that the Keys "Do not look concentrated" in certain backpacks? Why do the Keys purchaser choose the largest Buds sellers on Outpost aside from the benefit of having continuous stock of Buds? There were members of the Steam Group being trade banned. Does larger Buds seller on Outpost have lower risk of being trade banned because of receiving suspicious Keys, given that their trading record is legit? More importantly, this is not the first time such events are documented. Someone on SourceOP documented similar events back in April 2012. This leads to the questions: When did the Russians mentioned start injecting keys into the market? Fall 2011 when Buds started to rise? Summer 2012? Before Halloween? For sure it is not today. What if such injection of Keys is the main cause of indefinite decrease in value of Keys for the past 2 years? What if such method of injecting Keys is the main cause of the dramatic increases of the Price of Earbuds in terms of both USD and Key value? Do you prefer such Keys being constantly injected into the market? What should we do as legit traders? What should have been done to the Store purchasing system if you were given authority? ----------------------- tl;dr A group of Russians bought >5,000 Keys from Store today using illegitimate credit cards and bought few hundred Buds from TF2 Outpost at an ridiculous price of 28-30 Keys (The average yesterday was 25.5 Keys). They have been doing this for quite a long time and their activity today is alarming. ----------------------- I would like to take the opportunity to genuinely thank the Earbuds sellers today: fried noobles, ilhoudne, cautiousfox, Sick-My-Duck and naknak for provide me necessary information unconditionally, so that truth may be revealed in this post. A few undisclosed friend also helped. I would also like to thank the creator of Backpack.tf, Brad Pitt, for providing me archived JSONs of backpacks on my request. Lastly, thank you Valve for providing the API. You may check the real-time chart here. This is the imgur album. ----------------------- Please take you time to read the entire post and say what needs to be said.