Why do you barley cover any scams?

Do you have ideas? I'm all ears.

They check new traders on SteamRep. They do not check SteamRep before clicking on a link. And the few people who do perform that level of due diligence, rarely enter their password into phishing sites or Steam chat to begin with. So there's very little benefit to the community in listing hijackers in our database.

On the other hand, the damage to someone's reputation when we ban them is very real and very significant. And with Valve locking down support tickets and other ways we would verify they were hijacked when so claimed in appeals, it's getting much harder to prove someone was a victim when they do finally recover their account and appeal. That means more and more hijacking victims, if we chose to ban for that, would serve a life sentence in addition to the initial harm the hijacker caused them.

We know this not from speculation or personal anecdotes like you're citing, but because SteamRep did, in fact, issue BANNED BY SR tags for phishing links years ago. We learned both of the above points in the process from the thousands of cases we saw through from their initial report, their ban from multiple trading websites, their later appeal claiming they were hijacked (usually verifiable, rarely lying), and then their later attempts to recover their good standing within all the server clusters and websites that auto-banned them for their reputation as a scammer. This lesson came at a significant cost, with disproportional harm to the very scam victims we're trying to protect, for very little benefit to the rest of the community, so we as an organization decided to stop tagging for phishing scams years ago. We specifically excluded it from our investigative policy for that reason, and explained our reasoning there to help others like you understand why we made that decision.

Yes, burner accounts exist as well. I'm no stranger to those. That's why you don't trade with a 15-day-old account, they can be mass-created and they require substantially more work on our part to tag than it takes the scammer to create in the first place. Back when we tagged for that, and for a while afterwards, it ground our incoming reports to a halt while we still barely scratched the surface of phishing accounts. And given how few people check our website before clicking phishing links, it's still not worth it.

Then let's try and argue in good faith without rhetoric, ok? Other people have pointed that problem out who weren't sarcastic, and a lot of people legitimately don't understand why we make that distinction, so I explained exactly what problems we have with cross-platform reports.

Your complaint is against Valve, and it's a valid one, but it's not something we or anybody else making their own scammer database can ever hope to deal with. Unless Valve gives us access to ban accounts on their platform that are used for hijacking, and clean up spam on their platform, there is simply nothing we can do about it. We can issue a "ban" in our database, but it's just that: a flag in our own 3rd-party public database of known scammers, which carries as much weight as the community at large voluntarily gives it. We don't have any more access to people's accounts on the Steam platform than you do - we can't stop someone from adding a friend, sending a chat message, posting links in a Steam forum, or even sending trade offers.

Aside from hijacking itself, we do. With clear evidence.

That's not "clear evidence", it's speculation. It's saying "this account looks suspicious, so I'm declaring it's a proven scammer. We're not going to ban someone for being "too new" in Steam. We're not going to ban someone for having too many reports on backpack.tf or having too low a reputation score on steamtrades.com or backpack.tf. That's a factor for you to take into account, but there are paid "reputation bombing" services out there which will take thousands of accounts and bombard a target profile with fake reports, similar to the fake review services many advertising agencies offer. The characteristics you described, as well as other factors can be taken into account for a big picture assessment during an appeal, but having a new Steam account, or even getting rep-bombed on another site, do not prove the profile belongs to a scammer. Having a mark in our database is another, different kind of red flag, which is a lot more significant. Our recommendation is that you check these factors for yourself on a profile that doesn't have any marks on our website, but pooling that other information together into an assessment from our own database will (a) delegitimize the more serious marks in our database and (b) paint scammers a picture of a baseline "trustworthy" profile that they will farm out on all their new accounts, making scammers that much harder to spot.

Hidden Content:

**Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Administrative, Moderating).**

Who exactly is supposed to keep all these millions of scam bots added in their friends list? Do you expect one of our 10 SteamRep admins, with varying levels of activity, to keep these as many scammer accounts added as possible just so they can sign into Steam each day and check which phishing bots are still sending them links? For millions more profiles than Steam allows you to have in your friends list? Do you expect the victims (or would-be victims) reporting these accounts to us to keep all the phishing bots who added them in their friends lists, and proactively track that? Even if we weren't limited by the time sink that proposal presents, that leads into another problem:

It's much harder for us to ban an account than it is for a scammer to make a new one. If a scammer wanted, they could simply make a thousand new accounts in a day, with a script, report them all to us, and it'd be more than enough to keep our hands full while the scammer proceedes to make another thousand accounts and scam with those. One thousand not enough? Try two thousand tomorrow. They don't even do this manually; their accounts are created programmatically where they enter a number of accounts to create into a paid spamming program sold on the black market, while we have to review each individual report and its evidence one account at a time. And the appeals process is about 3 times worse on average. The onus is on you to not trade with or trust a brand new Steam account and then complaining to us that we didn't mark it before you found it.

We have strict evidence requirements for your protection, and that means each case where a BANNED BY SR tag is issued means a human being spent time researching and vetting evidence before making a conclusive statement that this account is a proven scammer. If we relaxed that, it would be trivial for someone to get your account banned in our database just to spite you. So we can't relax those requirements.

Many won't, but believe it or not, if they think it's worthwhile, they'll keep coming to get their reputation purged instead of simply making new accounts. Either for legitimacy, or just to waste our time if they think we're making a difference.

No particular year. SteamRep tagged for phishing reports before I was staff in summer 2014. We were still cleaning up the mess well into 2017 if I remember correctly, with innocent people waiting sometimes as long as 4 years before an admin was available to review their case. While we have fewer hijacking appeals left today (in part due to not tagging for phishing links anymore). We got a lot of "my account was stolen" appeals for certain types of scams - fake betting websites in particular - and one scammer who wasn't particularly bright who got banned for it pointed out in his public appeal that his website was phishing, not a fake betting website, and demanded we unban him because hijacking was outside our investigative policy (that doesn't apply retroactively, and admins still have limited discretion). It was a fake betting site when we banned him, but quickly changed to phishing (same appearance, just a fake login button) when he appealed. It was around that time we discovered the paid web hosting package he used (similar to one discussed a little here) actually has a switch he can flip between "phishing mode" to harvest accounts and "fake betting mode" where the pool of stolen accounts are used to automatically spam forums and chat messages. We wound up excluding fake betting sites for the same reason in 2019, and I think we're just finally coming close to clearing out our appeal backlog this year. More and more to this day, the "meta" of scamming is to steal someone else's account and use that for your illegal business to cover your tracks and leave someone else to deal with the consequences of your actions, and sadly there's not a lot we can do about it; we just keep hurting innocent victims whenever we try.

I think you missed my point. Complaining to Valve may be pointless, but complaining to somebody else who isn't Valve is even more pointless. Unless Valve gives us special access to do their job for them, we're just as powerless as you to stop account hijacking. I don't know how else to explain this to you: Hijacking scammers don't even notice when we ban them in our database because it has no impact on their account.

You, as an informed trader, can look up a profile in our database to see if it has been reported for scamming, and you can also look for certain red flags before dealing with the profile. But the only way a ban in our database could possibly affect an account hijacker is if their victim performs additional steps to copy and paste the scammer's profile into our 3rd-party website before clicking on a link they see in a forum or in chat. And anybody paying attention to that level of detail would not click the link in the first place, but the majority of the CS:GO community, does not even know SteamRep exists. We simply don't have access to stop account hijacking in Steam, as Valve would need to actually give us access to do their job for them, and that's never going to happen.

Friendly reminder, this is expressly against the general discussion rules #3.

Thanks.

You are, I was simply reminding you dont.

Have a nice day.

I explained why we don't address hijacking cases, and I told you why we don't address cross-platform cases. We would like to be able to handle those, as we still very much consider that fraud, but it's simply not possible without opening massive loopholes which will hurt a lot of innocent people, and likely leave many of them unable to appeal.

Just because they didn't appeal right away after the hijacking doesn't mean they weren't hijacked. If it's a CS:GO player, they may not even know SteamRep exists, especially considering the majority of that community does not honor bans from SteamRep.

Many hijacked accounts are either not recovered in a timely manner, and some never recovered at all. Scammers know some stolen accounts won't be recovered, and they turn around and sell those accounts to cheat-smurfing subscription services or other interested buyers who don't care where the account came from. They have tons of experience at figuring out it takes to keep the stolen account, and when a victim is able to get it back or lock them out, so they can be quite thorough. Sometimes the victim finds an old receipt and manages to recover the account years later, or they may not have known how to navigate through Steam Support's rather confusing and ever-changing triage. It's not always an overnight process, and it used to take weeks even if the victim did everything right. And painful enough that some victims (as the scammers are counting on) will just give up, maybe trying again in the distant future.

We are not going to automatically issue a BANNED BY SR tag because someone's reputation sank too low on another 3rd-party site because we provide a different service. Backpack.tf tells you, with significantly less curation, if a user has been reported for generically sketchy behavior. Any time the user provably scams, their moderators ban the person from their site and push that into ours.

You go to steamrep.com to see if any particular scams have provably happened, verified by an expert, and possibly if other recent reports have been filed, as a near absolute disqualifier. You check for other red flags specific to the circumstances - does it make sense for an account that has only been used for ~2 months to be trading items of this value? You go to backpack.tf and other sites to check for other less verifiable claims that might suggest a trend, taken with more of a grain of salt as these are easier to fabricate, to make a qualitative assessment on the type of trade you're conducting.

Looking at low reputation scores on 3rd-party sites, age of account, and other similar factors, are good red flags to check, but they do not prove a specific scam happened. That's why we suggest doing your own research when an account has "no special reputation". If backpack.tf believes the reports the received have enough evidence to prove a scam happened, they can and will issue a BANNED BY BPTF tag directly in our database. If Steamtrades.com would like to do the same (last I checked, they had a zero-moderation policy on +/- rep feedback, but that was admittedly a few years ago) they can apply as a friend and partner community, so they too can issue tags in our database. Same applies to any number of other legitimate trading communities.

And if they carry significant weight, they will also import those reports into our site. Meanwhile, there is simply no way to automatically recognize signs of reputation bombing from our database. If there were, backpack.tf would stop it at its source, and then abusers would adjust their methods accordingly. But as it stands, if someone abuses that, it's isolated to backpack.tf or wherever it happened, and not spread around to someplace like SteamRep where we make the absolute determination that someone is proven to be unsafe to deal with, beyond all reasonable doubt.

And hijackers are a different type of scammer altogether, who by and large do not use those websites, at least while hijacked. The hijacker runs through everyone in the victim's friend list, sends the phishing links (or copy/pastes their "accidentally reported to Steam admin" story if that's their method), and then uses the account to mass-add other victims. They will also trade away all the victim's items to the scammer's own alt account using one of several methods to bypass Steam Guard. But at no point will they log into 3rd-party trading websites, because that doesn't help them to claim additional accounts or items. It's extra effort when the scammer is already racing against the clock in case the victim finds a way to recover the account or lock them out, and many of the high-value trading sites have automated mechanisms to detect if an account appears hijacked to begin with. So there is nothing we can do from our end.

The exception to this is if the trading website has an inventory of its own (trade bots), but most CS:GO trading websites with that functionality do not honor bans in our database or use our API. Even if they did, the items would be long-gone by the time a ban was issued, so still no benefit to a BANNED BY SR tag there. All of this happens within a matter of minutes, often less than a minute, because the scammer knows he's racing against the clock. So even if we quickly handled a report, the damage would already have been done by the time someone looked at it and there'd be nothing else for us to mitigate.

Once the victim finally does recover their account though, 3rd-party websites and game servers who honor our bans will continue perma-banning them automatically, and the victim will have to appeal with us (however long that takes) before they can return to the community, hoping they have enough evidence to prove to us they recovered their account and aren't just the hijacker again (Valve is making this increasingly difficult to prove), and then turn around and appeal on each website that automatically banned them, pointing to their SteamRep appeal. I've seen cases where the websites refuse to unban even after the appeal is granted, after the hijacking victim pushes for months. That kind of experience is unreasonably harmful to victims, and it's not what SteamRep is here for.

On the flip side, you keep talking about these brand new accounts that don't look hijacked, upset that we won't ban those. I already told you: it takes more work from us to ban them than it takes the scammer to create them. And banning those won't stop the scammer from sending phishing links or extorting people's credentials, because that takes place entirely within Steam.

You say that wouldn't happen, but our firsthand experience says it has and does. And it puts a significant drain on our limited resources for no benefit to the community when it does. These aren't theoretical and hypothetical problems we're trying to address beforehand, they're things we learned the hard way and in many cases are still recovering from.

We don't allow using the general discussion forum to leverage favorable outcomes in reports or appeals. If you have questions about why we do things the way we do, we're happy to answer those, as you can see I've been doing. But if you try to contest the decision in a specific case, that's not what this section is for. We don't allow that because the people inevitably unhappy with our decisions would drown out the general discussion this section is for.

This site has no focus at all with "reputation" negative or positive that isn't what we are here for. This is setup to help educate, however its essential that you read our policies for what we do and do not review prior to submitting a report here otherwise it takes time away from those reports that are valid. Being "fishy" isn't something we take reports for, just making them based on assumptions isn't fair to the accused much like someone reporting you because they felt you were "fishy" or assumed you were up to no good without valid evidence that supports it or shows it.
Keep that in mind when submitting reports here since again I'm sure you wouldn't enjoy it very much if someone did so to you without anything backing it up. Many of the reports we get we do not review/investigate for various reasons. Just making posts on someones steam profile saying they are bad or up to no good doesn't mean anything in anyway here or anywhere for that matter.

Please review these links they will help you understand what we require/review and need to have reports submitted here.
https://forums.steamrep.com/threads/report-submission-fundamentals.169802/
https://forums.steamrep.com/threads/screenshot-guide-requirements.157969/
https://forums.steamrep.com/threads/steamrep-investigative-policy.140101/

We are not Valve, only they can see that information. SteamRep has no affiliation with Valve that is why we do not review HIjacking/Phishing reports per policy.
https://forums.steamrep.com/threads/steamrep-investigative-policy.140101/
This policy was noted many times already and explained in great depth so far in this thread - Not sure what you intend to gain from reviving it.