Only official domain: skinflip.appHow to recognise our real domains
Skin scams almost always follow the same scripts. Here is how to recognise them, what SkinFlip does against each one, and what you should do.
Our commitments
How it works: a link takes you to a copy of SkinFlip or Steam that steals your credentials.
Our countermeasure: sign-in only through Steam OpenID, HSTS, strict security policy, no iframes, "only official domain" banner and lookalike-domain monitoring.
What you should do: always check the address: skinflip.app for us, steamcommunity.com for Steam.
How it works: with your Steam API key, a scammer cancels your offer and recreates it towards an account imitating your partner.
Our countermeasure: we never ask for a key; key check before Active Trading; substitution detection by the extension; the Gardien compares the real partner with the agreed one.
What you should do: check your Steam API key page: if an unknown key exists, revoke it and change your password.
How it works: an account copies your partner's name and avatar to grab the trade.
Our countermeasure: SteamID64, level, account age and bans are shown; warning badges; trade-banned accounts can neither post nor use Active Trading.
What you should do: compare the SteamID64 with the one shown on the proposal, never the name.
How it works: the item offered looks like the agreed one but has a different wear, seed or stickers.
Our countermeasure: listings and offers tied to an assetId and its exact attributes; the Gardien checks item, wear, seed, stickers and charms; automatic withdrawal if the item leaves the inventory.
What you should do: compare each item of the Steam offer with the summary.
How it works: you are offered "a bit of extra money", then the payment is reversed or the trade is undone.
Our countermeasure: money is forbidden by the terms; messaging detects "PayPal", "crypto", "gift card", "+ money", warns and reports automatically.
What you should do: refuse any money compensation and report the message.
How it works: someone claims to be a "middleman" or "SkinFlip support" to make you send your items.
Our countermeasure: messaging limited to participants; outside links blocked; keyword detection (middleman, support, verify your account, API key, Discord).
What you should do: remember: our team will never message you first.
How it works: you are asked to "scan this QR to verify": you actually log the scammer into your Steam account.
Our countermeasure: this site never shows a Steam login QR code; the word "QR" triggers a warning in messaging.
What you should do: never scan a QR code someone sends you.
How it works: the habit of confirming quickly makes you approve a modified offer.
Our countermeasure: small batches, "To confirm" page, substitution detection, value caps.
What you should do: on your phone, only confirm offers identical to SkinFlip's list.
How it works: inflated or bought reviews create a false sense of trust.
Our countermeasure: reputation computed only from trades definitive at D+8, never from comments; cancellations count negatively.
What you should do: look at the number of definitive trades and the account age.
How it works: you are pushed to quickly accept a trade where you lose a lot of value.
Our countermeasure: value balance shown on each side, warning above a configurable gap, stricter threshold for new accounts, Active Trading caps.
What you should do: take your time and read the value balance.
How it works: a fake extension or a malicious update reads your Steam data.
Our countermeasure: open-source code, reproducible builds, releases approved by two humans, public changelog, minimal permissions.
What you should do: only install the Gardien from the official stores, through our links.
How it works: a sanctioned fraudster comes back with a new account.
Our countermeasure: one account per SteamID64, list of banned SteamIDs, account-link signals reviewed by moderators (no automatic ban).
What you should do: be wary of recent accounts, level 0 or private profiles.