Most skin marketplaces use Steam's tools exactly as Valve designed them. They make their money from gaps in the system: wallet funds that can't be cashed out, a roughly 15% market fee, trade locks, and users who can't easily tell what a fair price is. A smaller group of sites and scammers do abuse the same tools. Knowing which is which helps you decide where to trade.
Why third-party skin sites exist
Selling a skin on the Steam Community Market pays you in Steam Wallet funds. Those funds can be spent on games, items and other Steam purchases, but they can't be withdrawn as cash. For most CS2 items Valve takes 5% as the Steam fee and another 10% as the game fee. If a buyer pays $10.00 for your item, you receive about $8.70 in locked wallet funds.
Third-party sites exist because players want real money, or want to trade for a specific item without listing and waiting. Steam provides the tools that make this possible, and the sites build a business on top of them.
What the Steam API gives a site
A skin site draws on several Steam features, and only some of them belong to the official Web API:
Sign in through Steam. This uses OpenID. The site receives your SteamID64, which is a public identifier, and never sees your password. Your profile name and avatar are then available through the Web API.
Inventory reading. If your inventory is public, a site can see every item, its float and pattern data (through inspect links), and whether the item is currently tradable or trade-locked.
Trade offers. Your trade URL contains your account ID and a token that allows strangers to send you an offer. It can't be used to take items. Sites run bot accounts that send and receive offers through Steam's web session, and use the API's trade offer methods to check whether an offer was accepted, declined or canceled.
Price data. Sites pull Steam Market prices, mostly through unofficial but widely used endpoints, and use them as a reference for their own quotes.
Trade hold information. The API can tell a site how long a hold would apply to a given account, which lets the site decide whether to pay out instantly or wait.
None of this requires hacking. The API key itself is also tied to your account. Anyone who has spent at least $5 on Steam can generate one at steamcommunity.com/dev/apikey, and that key is the center of the scam side of this topic, which I cover below.
How a typical deposit and withdrawal works
On a bot-based site, the flow is almost always the same:
- You log in with Steam and the site reads your inventory.
- You choose items and the site quotes a price.
- A bot sends you a trade offer. You accept it and confirm it in the Steam mobile app.
- The site credits your site balance, or pays you through a payment processor or crypto.
- When you buy, the process runs in reverse: you pay, and a bot sends the item to your trade URL.
The bots hold large inventories and use mobile authenticator secrets to confirm their own trades automatically. That automation is why trades on these sites feel instant. It also means the operator holds a lot of sensitive credentials, which matters when you judge how seriously a site treats security.
Where the money comes from
The buy/sell spread. A bot that buys your item for 70% of a reference price and resells it for 85% earns the difference. The reference price is usually the Steam Market price, which is itself in wallet funds. Because wallet funds are worth less than cash, a site can sell items below the Steam price in cash terms and still make a margin.
A simple illustration with made-up numbers: an item lists at $10.00 on Steam. Steam would pay you $8.70 in wallet credit. A bot site offers $7.50 in cash. The site then resells the item to another customer for $8.80. The site earns $1.30 per item, a gross margin of about 15%. You received cash, and the site was paid for taking on inventory risk and for the convenience.
Commissions on peer-to-peer markets. Sites where users list items for other users usually charge 5 to 10% on a sale. Many add a withdrawal fee on top. A $9.00 sale with a 5% commission and a 3% payout fee leaves you about $8.29, before any currency conversion.
Fees at the edges. Deposit bonuses, minimum withdrawal amounts, crypto network fees, and exchange rate margins all add up. Each is small, but they are charged on every transaction.
Balance float. If you leave funds in a site balance, the site holds that money. Some sites encourage this with bonuses that carry wagering requirements, so the bonus only becomes withdrawable after you spend or gamble a multiple of it.
Trade lock timing. Valve applies trade locks to some items, for example certain items obtained in trades or Market purchases. The lock date is visible in inventory data. A site can use it to delay payouts or to price locked items lower, since it must hold them before it can resell.
Currency differences. Steam prices items by region and currency. Operators with wallet funds in cheaper currencies can buy items on the Market and sell them elsewhere in a stronger currency. This is arbitrage rather than abuse, but it is part of how the spread stays profitable.
Gambling. Case opening, jackpot and coinflip sites also use Steam login and trade offers. They earn through the house edge. Valve sent cease and desist letters to a number of CS:GO gambling sites in 2016, and many continue to operate anyway.
Price data and how it misleads
Many sites show a "Steam price" next to their own price with a discount label. Be careful with that comparison. The lowest listing on the Steam Market can be set by a single seller, especially for rare or low-volume items, and that figure can sit well above what the item actually sells for. A site that quotes you 90% of that Steam price may be quoting you more than its worth on paper, or it may be pricing the item below its real value. You can't tell without the sales history, which Steam shows in the price graph on the item page.
Quotes can also change between the moment you see them and the moment you accept. Check the final amount on the confirmation screen, not the headline figure.
Where abuse begins
The scams in this space usually combine a fake or copied site with one of the Steam features above.
API key theft and offer swapping. A scam site asks you to log in through a fake Steam window. If you enter your credentials and Steam Guard code, the attacker logs into your account, generates an API key, and registers their own domain on it. With the key, their software watches your incoming trade offers. When you receive a legitimate offer, the software cancels or declines it and instantly sends you a lookalike offer from a bot with the same display name and avatar. If you accept without checking, you lose the items.
The Steam mobile confirmation screen is the main defense here. It shows the partner's name and the items being sent, and the attacker can't confirm on your behalf without your authenticator.
Fake login popups. Some scam sites draw a popup window inside the page that looks like a Steam login window, complete with a fake address bar showing steamcommunity.com. This is called a browser-in-the-browser attack. A real popup can be dragged outside the browser window. A fake one stays trapped inside the page.
Fake middlemen and "verification" bots. Scammers ask you to send your item to a "verification" bot, or to a "middleman" who will hold items while you trade with someone else. No legitimate service works this way.
Requests for secrets. Anything that asks for your Steam password, Steam Guard code, authenticator files or identity secret is asking for full control of your account. A service that wants to confirm trades on your behalf needs your identity secret, and that equals full control.
What Valve has changed
Valve has added several protections over the years:
Trade offers must be confirmed in the Steam mobile app for accounts using the authenticator.
Accounts without a mobile authenticator face trade holds of up to 15 days.
Newly added authenticators trigger a shorter hold, commonly 7 days.
API keys are revoked when the account password changes.
API keys require a minimum spend, which limits throwaway accounts.
These rules change from time to time, so check Steam Support for the current terms before relying on a specific number of days.
How to check a site before you trade
Look at the address bar. Type the site address yourself or use a bookmark. Don't follow links from comments, Discord messages or ads.
Check your API key page. Visit steamcommunity.com/dev/apikey. If a key exists that you didn't create, or a domain you don't recognize is listed, revoke it, change your password, and review your authorized devices. Some peer-to-peer services do ask for your key to watch trade status. Even when the site is legitimate, whoever holds the key can read and cancel your offers, so give it only to a service you've researched, and revoke it afterward.
Read the confirmation screen. In the Steam app, check the partner's name and the exact items before confirming. Compare the partner's account ID with the one the site shows.
Calculate the net payout. Take the quoted price and subtract the commission, payout fee, conversion margin and any minimum withdrawal. Compare that figure across at least two sites.
Check item prices independently. Look at the Steam price history and recent sales volume, not just the lowest listing.
Keep your trade URL out of public places. It can't be used to take items, but it lets strangers send you offers, which helps scammers target you.
Use the mobile authenticator and keep a recovery code. A hijacked account is the hardest loss to reverse.
A legitimate skin site makes its money in plain view, through spreads and fees you can read and calculate. If you can't work out how a site profits from your trade, treat that as a reason to look more closely before you send anything.
I wrote this with CS2 in mind and used fee percentages and trade hold durations as I know them. Valve changes these rules periodically, so check them against Steam Support before publishing. The dollar figures in the worked example are illustrative, not taken from any specific site.
