For starters, did it go through your Steam accout or "only" throgh your PayPal account?

Start by reading these...

https://psteamhelp.yuanyoumao.com/en/faqs/view/783F-5E0F-9834-22D2

https://psteamhelp.yuanyoumao.com/en/faqs/view/5E79-EA37-6D29-8CE9

Oprindeligt skrevet af cSg|mc-Hotsauce:

Start by reading this...

https://psteamhelp.yuanyoumao.com/en/faqs/view/5E79-EA37-6D29-8CE9

:nkCool:

Thank you, but that guidance does not apply to this situation. This incident involves an unauthorized $3,553.40 purchase for (6) Steam Deck units shipped to Pasadena, CA, a location with no connection to me whatsoever.

Critically, no Steam Guard verification, no new-device authentication, no login alert, and no transactional confirmation were triggered.

The issue is not procedural. The issue is a failure of Steam’s stated security safeguards. I have already followed Steam’s official process and opened the fraud ticket. PayPal has initiated its own investigation.

What would be helpful is insight from anyone who has dealt with unauthorized high-value hardware orders, shipment interception, or successful escalation pathways when Steam’s authentication systems did not function as advertised.

Oprindeligt skrevet af ReBoot:

For starters, did it go through your Steam accout or "only" throgh your PayPal account?

It went through both. The charge shows as a Steam purchase with a full Steam receipt, and PayPal then processed the authorization immediately after. So yes, it was routed through my Steam account credentials and then charged to PayPal.

You exposed your login credentials:
a) Either by logging into a site that faked a Steam login and made a bot log into your account using the save password as well as the trust device feature while injecting a Steam API access into it.
b) Or by installing malware that stole your session data or injected a keylogger.
c) Or by using outdated login information that got exposed in a leak.
d) Or by falling for a Steam Support impersonation scam on Discord or similar platforms.

1. Scan for malware using any reputable antimalware program.
2. Check that the email and phone number on the Steam account are still yours.
3. Ensure your email address and/or password aren't contained in any public breaches. There are various sites that allow you to do that.
-- If they are contained in any public breaches, change your email account's password from a secure computer before proceeding.
-- If that happens, you may want to secure other accounts than just Steam.
-- Consider using mobile two-factor authentication on your e-mail address if your e-mail provider supports it.
4. Deauthorize all devices INCLUDING the one you are using (You will have to relog after you click it): Steam -> Settings -> Security -> Deauthorize All Devices or https://psteamproxy.yuanyoumao.com/twofactor/manage
5. Change passwords from a clean computer
6. Generate new backup codes for your Mobile App https://psteamproxy.yuanyoumao.com/twofactor/manage
7. Revoke the API key https://psteamcommunity.yuanyoumao.com/dev/apikey (there should be nothing in the APIKEY)
8. Change your trade link: Profile > your inventory > trade offer > Who can send me trade offer > scroll down and make a new trade link.
9. If points were stolen within 14 days, reset your Steam password (not change, RESET using Forgot Password) to cancel pending awards.

As for how to dispute the charge properly, Hotsauce linked the correct articles.

That it went through PayPal only worked because Steam caches PayPal authorizations for two weeks. However, it still does do no harm to change passwords etc. there as well.

DO NOT chargeback through PayPal. If you do that, you will risk account restrictions on Steam and will never be able to use PayPal on Steam again.

Dispute the charge through Steam support instead.

You sound very lawyerly, right down to not reading the information provided to you that absolutely applies to your situation.