[Steam] ADVICE: Unathorised account access

[SJ777]

Hey there, my dad got a whole heap of emails from steam saying that some one is accessing his steam account from a new PC and to enter the confirmation code. All good thats the steamguard process, however he did not initate these accesses. So we have changed his password as directed by the email. My question is: does the fact he has these emails mean that someone actually has successfully obtained his password and if not for steamguard it could have been very bad?

[Jigoku]

Was the email specifically titled "Your Steam account: Access from new computer"?

If so, then yes, it would seem someone had your father's username and password combination and if not for SteamGuard it may have been hijacked. The generation of that specific email requires entering of valid account info into a "new" computer.

Before worrying about anything too malicious look closer to home first. Had anyone else tried logging in through a browser? Did someone in the family try logging in to make a purchase for the account?

[SJ777]

thanks Jig,

i asked about that and doesn't appear he tried access any other way...just came out of the blue.

As a word of warning, when it sends the confirmation code, it tells the user which email it was sent to, so if you use the same password for steam and your steam registered email, then it could be very easy for them to obtain the confirmation code.

So - ensure your steam registered email password and steam password are not the same.

[Jigoku]

Originally Posted by SJ777

As a word of warning, when it sends the confirmation code, it tells the user which email it was sent to,

It doesn't. It tells you the email domain but not the actual email address.

[SJ777]

Originally Posted by Jigoku

It doesn't. It tells you the email domain but not the actual email address.

aha - cool - thanks

[Redgum]

I triggered the same message when accessing steam from the laptop on the same network as my main PC.

Its a good safeguard but definitely time to update the passwords.

[Dalienx]

If however the email reads something like..
Your account has been accessed from another computer, CLICK HERE to update password...


Dont click! its a scam!

[Reoh]

Originally Posted by Dalienx

If however the email reads something like..
Your account has been accessed from another computer, CLICK HERE to update password...


Dont click! its a scam!

This.

Whenver I receive an email along these lines I always navigate to the actual website through other means and not by clicking a link. It's just so much safer that way.

[RMBear]

I clicked on a link provided by a Rev A Rippoff from Nigeria promising 40% of US$14,000,000 if I gave him my banking details...

Still waiting...

My SDD pooped a week or so ago, so I put Win7 on another HDD in the meantime... received the emails from Steam and was a little cautious until I put 2+2 together. It sent an email with the code to reactivate Steam on this "new computer".

[SJ777]

Emails are legit. He got the same emails the following night and then morning - after we'd changed passwords....so I have a feeling this is something to do with my dads over zealousness with security in terms of clearing cookies etc (and not really paying attention if steamguard dialogs are jumping up asking for input....)

Doing some testing and I think it his own machine generating them in response to thinking its a new computer each time its booted. Have not had any repeats after another password change, having his PC off for a day and then back on but not running ccleaner etc....

will see what happens...