Is It Safe to Sign In With Steam? How to Tell, and What FaceitScout Can See

Short answer: signing in through Steam is safe when the login happens on Steam's own website, and dangerous when it only looks like it does. This page explains how to tell the difference on any CS2 site, and exactly what FaceitScout receives when you sign in.

If you play Counter-Strike you have been warned about this for years, and rightly. Fake "Sign in through Steam" buttons are the most common way accounts and inventories get stolen. So a site that asks you to click one owes you an explanation.

How the real thing works

Steam offers websites a sign-in method called OpenID. It works like this:

1. You click the button and are sent to steamcommunity.com.
2. If you are already signed in to Steam in that browser, Steam just asks whether to continue as you. If not, you type your details into Steam's page, and Steam Guard asks for its code as usual.
3. Steam sends you back with one piece of information: your Steam ID.

The website never sees your password. It is not given a key to your account. It cannot open your inventory, send trade offers, or change anything.

How the fake thing works

A phishing site shows you something that looks like Steam's login but is part of its own page. The usual trick is a fake pop-up window drawn inside the site, complete with a fake address bar. You type your password into it and hand it straight to the attacker.

Three checks catch nearly all of them:

• Read the real address bar. Before typing anything, the browser's own address bar must say steamcommunity.com. Not something similar, and not an address bar inside the page.
• Try to drag the login window off the page. A real window moves anywhere on your screen. A fake one drawn inside the page cannot leave it.
• Notice whether you are asked at all. If you are already signed in to Steam in that browser and are still asked for your password, be suspicious and go back to the first check.

And one rule that has no exceptions: no legitimate site needs your Steam Guard codes read out, your API key, or a "verification" trade.

What FaceitScout gets when you sign in

• From Steam: your Steam ID. With it we read your public profile name and avatar, the same things anyone can see on your profile page.
• Nothing else from Steam. No password, no email address, no friends list, no inventory access, no ability to trade.
• An email address only if you give us one, for example to start a Pro trial and get a reminder before it ends, or when you buy a plan.

One more thing, so nothing here is left out: when any lobby is scanned, we look up each player's public Steam details, such as account age, CS2 hours where the profile shows them, and ban status. That is public information about every player in the match and does not depend on anyone signing in.

Why Steam, when this is a FACEIT tool?

Every FACEIT CS2 account is tied to a Steam account. Your Steam ID is how we find your FACEIT profile and your matches, so one sign-in covers both and you have no new password to create or lose.

You can try it without signing in at all

If you would rather look first, you can. Type your FACEIT nickname on our front page and you get a real scan of your last match with no account. Free accounts get three scans a day and the browser extension; nothing asks for a card.

What we store is set out in the privacy policy, which also has the button to delete your account.