Account theft is a concern for any online service, especially when there is money involved, and Valve Corp’s Steam Store is no different. According to information recently released by Valve, security is a growing concern for the digital games platform.

“Account theft has been around since Steam began, but with the introduction of Steam Trading, the problem has increased twenty-fold as the number one complaint from our users,” Valve said in a blog post.

Stream Trading allows users to sell in-game items for Steam credit, which can be used to buy other digital goods.

Valve continued, “Having your account stolen, and your items traded away, is a terrible experience, and we hated that it was becoming more common for our customers.”

Valve explained that stolen game items are often traded multiple times before the theft is discovered, and by then they are often in the hands of an innocent Steam user who had no idea that the digital good they purchased is illicit. While it might seem like the simplest solution would be to allow the innocent user to keep their item and create a duplicate for the original owner, and that is often exactly what Valve does, that solution is not without its own drawbacks, especially in competitive multiplayer games like Counter-Strike: Global Offensive, which is one of the biggest targets for digital item theft.

“Duplicating the stolen items devalues all the other equivalent items in the economy,” Valve said. “This might be fairly minor for common items, but for rare items this had the potential to significantly increase the number in existence.”

“Essentially all Steam accounts are now targets”

In its post, Valve noted that the rates of account theft are on the rise, partially because the stolen digital goods are worth more and partially because more people are active in the Steam economy

“Enough money now moves around the system that stealing virtual Steam goods has become a real business for skilled hackers,” Valve said. “[Also] practically every active Steam account is now involved in the economy, via items or trading cards, with enough value to be worth a hacker’s time. Essentially all Steam accounts are now targets.”

One solution Valve has implemented to help fight account theft is two-step mobile authentication, which requires a time sensitive numeric code in addition to users’ normal passwords. Unfortunately, according to Valve, most users have not enabled the feature, despite the fact that it is free.

“This is one of those times where we feel like we’re forced to insert a step or shut it all down”

Because so few users have enabled the two-step authentication security feature, Valve announced that they are making a few changes to the way trading features work for unprotected accounts (via steampowered.com):

• Anyone losing items in a trade will need to have a Steam Guard Mobile Authenticator enabled on their account for at least 7 days and have trade confirmations turned on. Otherwise, items will be held by Steam for up to 3 days before delivery.
• If you’ve been friends for at least 1 year, items will be held by Steam for up to 1 day before delivery.
• Accounts with a Mobile Authenticator enabled for at least 7 days are no longer restricted from trading or using the Market when using a new device since trades on the new device will be protected by the Mobile Authenticator.

“Once again, we’re fully aware that this is a tradeoff with the potential for a large impact on trading,” Valve said. “Any time we put security steps in between user actions and their desired results, we’re making it more difficult to use our products. Unfortunately, this is one of those times where we feel like we’re forced to insert a step or shut it all down.”

Photo by Don Hankins