If you haven't heard of Steam, it's a popular gaming platform run by game developer Valve that makes buying and playing online games a snap. At any given time, it might have 3 million to 4 million active users and, according to Valve, more than 125 million accounts. And many of those accounts are a tempting target for hackers. Even if you don't use Steam, it's likely your kids or grandkids do, so be sure to pass this on to them.
Now you might be wondering why hackers would want to take over gaming accounts. Part of it is that the accounts store a player's credit card information for buying games and making other purchases. However, there's actually an even more lucrative target.
Many modern games allow players to buy or find special items. For example, a fantasy game might have a special sword that's difficult to find, and there might only be a handful in existence. These items are tied to a player's Steam account.
If a hacker can get into the account, they can use the new Steam Trading system to transfer any valuable items to a hacker-owned account. From there, the hacker can sell the items to other players who might not know they're stolen. Basically, it's old-fashioned theft and fencing in the digital world.
Steam says upwards of 77,000 accounts are hacked every month and cleaned out. Hackers specifically target higher-level players they know will have rare and valuable items. Sometimes a hacker can spend months finding a way into certain accounts.
To combat this, Steam has introduced two-factor authentication for accounts called Steam Guard Mobile. Logging into an account on a new gadget requires a code sent to the person's phone or secondary email address. Also, any Steam Trading transactions require a second code to approve, and trades can't be made within 7 days of changes to the account settings. Get more details on two-factor authentication and how to use it to secure your accounts on Facebook, Google, Microsoft and more. Even Amazon finally has it.
Steam is also putting some new Steam Trading rules in place. Users without Steam Guard Mobile have a three day waiting period before trades and sales go through. That should give the legitimate account owner time to notice the hack and reverse it.