Enable Steam Guard Mobile
The Steam Mobile Authenticator confirms every login and every trade on your phone. It also removes long trade holds. If you trade skins at all, this is the most important setting you can turn on. Keep your recovery code somewhere safe and offline.
Check your Web API key
Visit the API key page on steamcommunity.com while logged in. If a key exists that you did not create, revoke it immediately and change your password – it is the main tool behind trade-offer hijacking. Legitimate trading sites do not need you to create an API key to sell or buy.
Spot phishing pages
Phishing sites copy the Steam login window. Always check that the address is steamcommunity.com or store.steampowered.com, and be suspicious of pop-ups that cannot be moved outside the browser window. Free-skin, voting and giveaway links in chat are the most common bait.
Keep your trade link private-ish
Your trade link is safe to share with sites you trust, but if you start receiving spam offers you can generate a new link in Steam, which invalidates the old one. Remember to update the link on sites where you saved it.
What to do if something happens
Change your password, deauthorise all devices, revoke API keys and contact Steam Support. Contact the support of any site involved with your trade IDs. Speed matters – act immediately.
Sources and further reading
Ready to sell?
Load your inventory and see your price instantly.