A familiar account asks you to vote for a team: pause before login

Do not let familiarity verify the destination

Steam’s guidance explains that a known account can be used in this scam pattern. The sender being on a friends list therefore does not certify the linked page. Keep the account familiarity and site verification as two separate observations.

The profile-identity guide explains why display information has limits. This does not mean every legitimate tournament or voting activity is fraudulent. It means the particular unsolicited pattern should not inherit trust from a familiar profile without independent evidence of the event and its actual access requirements.

Avoid entering secrets or approving a QR request

Do not provide passwords, security codes or login approvals merely to satisfy an unexpected voting request. A copied logo and familiar-looking page cannot establish the real destination. Use the genuine login-address checklist before considering an authentication step.

The QR-login guide also emphasizes your own initiated action. An approval can have consequences even if the message describes it as a harmless vote. There is no need to perform a test login or visit the suspicious destination to understand why the request and the access demand must be evaluated separately.

Verify an event independently if you need to

If the event itself matters to you, find its official information independently through a known legitimate source. Do not use the suspicious message’s login route as the proof that its own story is true. Compare the task with the actual published event requirements.

You do not need to send the contact your authentication material to ask a question. A narrow conclusion can be that the destination remains unverified. The website login-and-return guide explains another reason to preserve the original task when an unrelated login request appears.

If credentials were entered, secure access first

Follow Steam’s official security guidance if you already exposed account access. Review authorized devices, the associated email and relevant account security controls. Preserve the actual observations rather than assuming that closing the page alone ends every authorized session.

If access is lost, use the official recovery guide. Recovery of access does not guarantee restoration of all items or removal of other restrictions. Keep the security task distinct from any later inventory or transaction question, each of which needs its own records and applicable conditions.

Keep the response proportional

Retain the message and destination context privately if needed. Where appropriate, use Steam’s official report or block controls based on the behavior you observed. Do not publish another person’s private details or organize messages to other users as a test.

A clear result is enough: the request was unsolicited, the login destination was not independently established, and no sensitive approval should follow merely from sender familiarity. That conclusion protects the original task without claiming every event is fake or that a suspicious message by itself proves the sender personally created the scam.

Sources and current rules

• Official Valve / Steam reference 1
• Official Valve / Steam reference 2

Sources checked on 2 November 2026. Labels and locations can vary by client version and language. Match the described state in your own current interface.