I’ll admit right away that I’m not a huge gamer. If I were, it might have taken me less than a year and a half to notice that my Steam account had been hijacked.
It was actually a tweet from Brett that led me to the uncomfortable realization. There was a Humble Bundle of Star Trek comics going on, see, and that’s not a thing I should be passing up. Checking my Humble Bundle account, I found a purchase I’d made in 2012 – complete with Steam keys.
“Hmm,” I said to myself, “I should really use these at some point.”
So I headed over to Steam’s site, where it is apparently impossible to enter keys or even reset your password without downloading the whole application. Since my laptop was relatively new, a-downloadin’ I went, only to find that sending a password reset request for my account never got to my email inbox. Nor my spam folder, nor anywhere else I could find, despite multiple attempts.
Fortunately, there’s an option to send the reset request directly to your email address. Unfortunately, the error message that pops up when your email address isn’t found in their system is a bit confuzzled.
Yep, an email has been sent. Or, wait, maybe it’s failed. There is a quantum superposition of both succeeding and failing states that will only collapse when you check your email again and find, inevitably, yeah, it totally failed.
In fact, the only emails I have from Steam are as follows:
- “Welcome to Steam”, asking me to verify my email address upon the initial creation of the account in January, 2010.
- “Recent changes to your Steam account”, confirming that my contact email address had been successfully changed in April, 2013.
A responsible account holder would have noticed the second email in, say, April, 2013. As a deadbeat gamer, I breezed right past it in the litany of special offers and sales and coupons that make their way to that particular address.
Now I’m aware of an account, with some small number of games, which I cannot access. Obviously four years of hardly ever using it has not thoroughly damaged me, but dangit, it’s mine.
Steam helpfully provides a support page with a procedure for reclaiming a hijacked account. It’s necessary to provide the support team with:
- Your Steam Account login name
- Your most recent Steam contact email address
- Proof of account ownership
The first was no problem, but the second was bizarre. If I knew the most recent contact email address, I could just use the automatic password reset tool. The whole issue was that someone, some evil terrorist nogoodnik hacker, had transferred access to their own email address.
Proof of account ownership was a whole other obstacle. What had I ever bought through Steam? Mostly I’d grabbed free games when they were offered; I am extremely cheap. The Humble Bundle had Steam keys, but I didn’t remember ever actually activating them. Steam support also wants scans of product keys from physical CD packaging, which of course is how everybody buys games now, right?
Nevertheless, I sent them a screenshot of my Humble Bundle keys with the support ticket number added with an image editor (probably Microsoft Paint).
Well. This just isn’t done, apparently. The response:
Thank you for contacting Steam Support.
Please provide the latest email address that was used on the Steam account.
We require that the ticket number be handwritten on the CD Key.
Please make sure to handwrite your Support Ticket Number 3057-IJBN-1544 on the quick reference card or sticker above the CD Key (the number should not be written on a separate piece of paper or inserted with an image editor) and resubmit your scan or digital photo in .jpg format for review. Please ensure that you submit a full-color image, rather than a photocopy.
Note: Please use a pen with permanent ink and avoid marking over the CD Key code.
Argh. They were insisting upon a CD key, with a handwritten ticket number. Internet folk passing around screenshots is hardly unheard of.
In desperation, I consulted Steam’s list of games using CD keys. Toward the end, I finally saw one that looked familiar: Star Trek: D-A-C. Here was the game that was the whole reason I set up a Steam account in the first place!
The reboot Star Trek movie had been on my Christmas list in 2009, and approximately every single person I know got it for me in one format or another. A digital copy of the film, along with Star Trek: D-A-C, was given to me on a 4GB flash drive emblazoned with the Starfleet command chevron. I still use it nearly five years later.
The game was terrible, of course; “D-A-C” stood for “Deathmatch. Assault. Conquest.” – a perfect summation of the Star Trek ethos if ever I heard one. No amount of tearing my house apart uncovered the original package, because of course I recycled it immediately upon registering it with Steam, because the entire point of online accounts is to eliminate the need for paper copies of everything.
I’d almost resigned myself to letting go of the account when I decided to take a closer look at the email Steam support had sent me. Two bits stuck out at me:
We require that the ticket number be handwritten
Please make sure to handwrite your Support Ticket Number … (the number should not be written on a separate piece of paper or inserted with an image editor)
It couldn’t be that simple, could it?
That there is a digital photograph of a color laser printout of the exact same page I’d submitted before. By inscribing blue ink from a ballpoint pen on the printout, I’d somehow incontrovertibly proven my rightful ownership of the account in question, because I was given practically instant access to the account.
Not using my original email address, mind you – Steam recommends that your support account use a different address than your actual Steam account, because purple monkey dishwasher. I’d sent them a Humble Bundle account screenshot with the original email address on it, I’d sent screenshots of emails from Steam in that account’s inbox, but what made the difference was handwritten ink next to an activation key that, I confirmed once I had access again, I had never actually linked to Steam. It’s not unlikely that this very method was used to hijack my account in the first place.
- Follow support folks’ instructions to the letter, because they’re probably locked into a script.
- Read emails, even from accounts you don’t use much.
- Never ever ever throw anything away.
Hey, is there a hoarding game on Steam?
John ‘jaQ’ Andrews has been writing about technology professionally since 1999. His work appears in the Techie section of New Hampshire’s largest free weekly paper, The Hippo; on the blog of Zco Corporation, a mobile app development company; consumer info portal News For Shoppers; and his own site,www.jaqandrews.com.