Disclosure: This post contains affiliate links. If you buy through these links, we may earn a small commission at no extra cost to you.
You see a listing for Elden Ring at $14.99. Steam sells it for $59.99. The site looks fine — clean layout, game covers everywhere, a padlock icon in the address bar. You type in your credit card details. You click Purchase.
Three things can happen next:
- The key arrives and works. (Rare, with sites like this.)
- The key never arrives. Support emails bounce back. Your money is gone.
- After two months, Steam revokes the key — turns out it was purchased with a stolen credit card. The original owner filed a chargeback, and now your Steam account has a strike. You are out $14.99 with zero recourse.
Scenarios 2 and 3 happen thousands of times every day. Game key fraud costs consumers an estimated $800 million per year globally, according to a 2024 report from the ESA. The scam sites are getting better: better designs, better English, better fake reviews. But at their core, they still make the same mistakes.
This checklist gives you ten concrete things to check before you type in your payment details. Each one takes roughly 30 seconds. Meanwhile, together they catch 95% of scam sites — not because the checks are clever, but because scammers are lazy and these are the corners they always cut.
Red Flag 1: The Price Is More Than 50% Below the Official Steam Price
Legitimate key sellers operate on thin margins. They buy keys from publishers at wholesale prices, typically 10% to 40% below retail. Consequently, a site selling a $60 game for $45 is normal. However, a site selling that same game for $12 is not.
There is no legal way to source a key that cheap. Period. The key is either from a region where the game sells for $5 — specifically, a region-locked copy that will not activate in your country without a VPN — or it was purchased with a stolen credit card. Either way, you lose.
Quick check: Open Steam in a second tab. Then look up the official price. If the key site lists the game at less than 50% of Steam’s current price, close the tab. In short, the “deal” is not a deal.
Red Flag 2: The “Compare At” Price Is Made Up
Scam sites love showing you a crossed-out price: $89.99 now only $16.99. That $89.99 was never the real price. No retailer ever sold that game at $89.99. The number exists purely to make $16.99 feel like a steal.
Quick check: Search the game on Steam, the PlayStation Store, or the Xbox Store. Whatever price appears there is the real MSRP. If the key site’s “original price” is $20 or more above the official MSRP, the entire pricing structure on that site is fiction. Do not trust anything else they display.
Red Flag 3: Pre-Orders Discounted More Than 15%
Pre-order discounts from legitimate sellers are small — think 10%, maybe 15% if there is a launch promotion. The site does not have the keys yet. Nobody does. The publisher has not released them.
A site offering a pre-order at 40% off is making a bet. The seller assumes they can source keys cheaper after launch and pocket the difference. When they cannot — and they often cannot for high-demand games — you wait. Sometimes weeks. Sometimes forever. Meanwhile, your friends are playing on launch day and you are staring at an “Awaiting Key” status on an order you placed three months ago.
This is not technically a scam — it is a business model built on promises the seller cannot guarantee. The result for you is the same: you miss launch day and fight for a refund.
Red Flag 4: No PayPal at Checkout
PayPal offers a buyer protection program that lets you dispute transactions when goods are not delivered or are not as described. Scam sites know this. They do not want chargebacks. They do not want disputes. So they remove PayPal from the checkout page.
A site that accepts only credit cards, crypto, or bank transfers is making it harder for you to get your money back. That is the point.
Legitimate key sellers offer PayPal. Almost all of them. Green Man Gaming has it. Fanatical has it. Humble Bundle has it. Even G2A marketplace sellers route through a platform that offers buyer protection. If a site takes credit cards but not PayPal, combine that with one other red flag and walk.
Red Flag 5: The Domain Is Less Than Six Months Old
Scam sites burn through domains. For example, a site gets exposed on Reddit, its Trustpilot page fills with 1-star reviews, and the operator abandons it. After that, they register a new domain, copy-paste the same site template, and start over.
Quick check: Go to who.is (not affiliated — just the fastest tool for this) or any WHOIS lookup tool. Type in the domain. Look at the “Created” or “Registration” date. Less than six months old? The site has not existed long enough to have a track record. You are the guinea pig.
Combine domain age with Red Flag 6 and you have a near-certain verdict.
Red Flag 6: Reviews Are Uniformly Positive and Sound the Same
Open the site’s reviews or testimonials page. Look for these patterns:
- Every review is 5 stars. In contrast, real businesses have 3-star and 4-star reviews. Perfection is fabricated.
- The language repeats. If five different “customers” all say “fast delivery highly recommend,” a template was involved.
- No specific details. “Great site!” tells you nothing. A real review says something like “Key activated on Steam in Germany, took about 10 minutes to arrive.”
Also check Trustpilot. But even there, be careful — some sites flood Trustpilot with fake positive reviews to drown out the real ones. Filter to the 1-star and 2-star reviews specifically. That is where the actual customer experience lives. If the 1-star reviews all mention the same problem (keys not delivered, keys revoked, no refund), the pattern is real.
Red Flag 7: No Verifiable Contact Information
Scroll to the bottom of the site. Look for a Contact page. What do you find?
A legitimate business wants you to be able to reach them. Specifically, they display an email address, a physical address, and often a phone number. A scam site, on the other hand, displays a contact form. Sometimes nothing at all.
Quick check: Find the physical address on the site. Copy it. Paste it into Google Maps. Is it a real office building, or is it a random house in a residential neighborhood? Is it a virtual office address shared by 40 other companies? Does it exist at all?
No physical address, or an address that does not map to a real business location, combined with no phone number, combined with a contact form instead of an email = do not buy.
Red Flag 8: The Refund Policy Makes Refunds Impossible
Scam sites write refund policies designed to be technically present but practically useless.
Examples of fake refund policies: “All sales final” buried at the bottom of the terms page. “Refunds only for duplicate keys with video proof of failed activation” (nobody records themselves activating a key). “Refunds processed as store credit only” (your money stays with them regardless).
A real refund policy specifies: a time window (14 days, 30 days), refunds to your original payment method, and clear conditions that a reasonable person can meet. Browse the terms before you buy. Two minutes of reading saves weeks of fighting for a chargeback.
Red Flag 9: The Final Price at Checkout Is Much Higher Than the Listed Price
You add a $14.99 game to your cart. At checkout, the total is $21.47. Where did the extra $6.48 come from?
You will see a “service fee” tacked on. Next comes a “processing fee.” After that, a “payment handling fee.” And finally, a “security fee.” None of these were mentioned on the product page. In short, the site hooks you with a low headline price and recovers the margin through fees you only see at the last step.
Legitimate sellers either show the final price upfront or charge a single, small, clearly labeled fee (typically 50 cents to a dollar for payment processing). If the gap between the listed price and the checkout price is more than 10%, the listed price is a lie. The real price is whatever you see at checkout — and for that price, you could buy from a legitimate site with actual buyer protection.
Red Flag 10: “Global Key” Claims in the Listing Contradicted by User Reports
Many third-party key marketplaces allow individual sellers to list keys. A seller tags their key as “Global” — meaning it activates in any region. Then you search the game name plus “region lock” on Reddit and find a thread from last month: “Bought a ‘global’ key from [Site], Steam says it’s only for Argentina.”
Region-locked keys are not always a scam. But keys that claim to be global and are actually region-locked are. The seller lied about the product. What else did they lie about?
Since 2025, Valve has tightened its enforcement of cross-region activation. Activating a region-locked key using a VPN violates the Steam Subscriber Agreement. The penalty ranges from the key being revoked to account restrictions. The risk is not theoretical — search “Steam account restricted region-locked key” and you will find hundreds of posts from people who thought it would not happen to them.
Quick check: Before buying from any marketplace seller, search “[Game Name] [Site Name] region lock Reddit.” Read the first three threads. If anyone mentions getting a region-locked key when the listing said global, do not buy from that seller. Even if the particular key you are looking at is listed correctly — the seller has already demonstrated that they misrepresent products.
Safe vs. Scam: Side-by-Side Comparison
| Check | Safe Site | Scam Site |
|---|---|---|
| Price vs Steam | 10-40% off MSRP | 50-90% off MSRP |
| Payment options | PayPal + cards + others | Credit card only, maybe crypto |
| Domain age | 2+ years typically | Under 6 months |
| Contact page | Email, phone, real address | Contact form, no address |
| Reviews | Mixed ratings, specific details | All 5-star, generic language |
| Refund policy | Clear window, money back | “All sales final” or store credit |
| Checkout fees | None or one small fee | Multiple mystery fees |
| Pre-order discount | 10-15% max | 30-50% off unreleased games |
The Safest Game Key Sites (Verified, 2026)
These sites are authorized retailers or well-established marketplaces with functional buyer protection. They have been operating for years, accept PayPal, display real business addresses, and have refund policies that actually refund:
| Site | Type | PayPal | Refund Policy | Best For |
|---|---|---|---|---|
| Humble Bundle | Authorized retailer | ✅ | 14-day refund for unrevealed keys | Bundles + charity |
| Fanatical | Authorized retailer | ✅ | 14-day refund, key must be unrevealed | Flash deals |
| Green Man Gaming | Authorized retailer | ✅ | 7-day refund, unredeemed keys | Pre-orders |
| CDKeys | Marketplace (direct) | ✅ | Refund if key doesn’t work | Discounted AAA games |
| Eneba | Marketplace (sellers) | ✅ | Platform buyer protection | Price comparison across sellers |
| G2A | Marketplace (sellers) | ✅ | G2A Shield (paid add-on) | Largest selection, but use Shield |
A word on G2A specifically: the platform itself is not a scam, but individual sellers on it can be. G2A Shield — the paid buyer protection add-on — is effectively mandatory. Without it, your dispute process is slower and less likely to succeed. Factor the Shield cost into the price. If the key is still cheaper than CDKeys after adding Shield, buy it. If not, buy from CDKeys or wait for a Fanatical sale.
What to Do If You Already Bought From a Scam Site
Stop what you are doing and follow these steps in order:
Step 1: Do not activate the key yet. If you have not clicked “Redeem” in Steam, do not. An unredeemed key is easier to dispute than one you have already used.
Step 2: Contact the seller in writing. Email them. Use the contact form. Screenshot everything. State clearly: you want a full refund to your original payment method. Give them 48 hours to respond. Most will not respond. The point is creating a paper trail for step 3.
Step 3: File a dispute. If you paid with PayPal, open a dispute through the Resolution Center. Reason: “Item not as described” or “Did not receive item.” Attach screenshots of your purchase, the listing, and your attempt to contact the seller. PayPal resolves most disputes in favor of the buyer when documentation is provided.
If you paid by credit card, call your bank. Ask for the disputes or chargeback department. Tell them you did not receive the goods as described. Banks handle this differently by country, but most have a 60-day window from the transaction date for chargebacks.
Step 4: If the key is already activated and gets revoked later, your chargeback and dispute options shrink dramatically. Steam Support does not refund third-party keys. PayPal may decline a dispute on an activated digital good. Your best remaining option is your bank’s chargeback process — but results vary by country and card issuer.
Step 5: Warn others. Leave a factual review on Trustpilot. Post in the r/GameDeals subreddit. Name the site. Describe exactly what happened. Attach screenshots. A scam site survives by staying under the radar. One detailed post with receipts can save hundreds of people from the same experience.
FAQ
Are CDKeys and Eneba legitimate?
Both are large marketplaces, not authorized retailers. However, CDKeys sources its own inventory directly and has a strong reputation — keys arrive reliably and activation issues are rare. Eneba connects you with third-party sellers; the experience depends entirely on which seller you buy from. Check the seller’s rating and number of completed sales before purchasing. On either platform, pay with PayPal for an additional layer of protection.
Can I get banned on Steam for buying from key sites?
Steam does not ban accounts for buying from unauthorized resellers. What Steam does is revoke individual keys that were fraudulently obtained. If you activate a stolen key — even unknowingly — Steam removes the game from your library. Your account itself stays intact. The risk is financial (you lose the money) and inconvenient (the game disappears mid-playthrough), not account-ending.
What is the single fastest check for any key site?
Search the site’s name followed by “scam” or “legit” on Reddit. Example: “gameseal scam Reddit” or “hrkgame legit Reddit.” Read the first three threads. If multiple real users describe the same problem (keys not delivered, charges without delivery, refund refusals), the pattern is established. This check takes 30 seconds and catches the vast majority of problem sites.
Is it worth paying full price on Steam just to be safe?
For multiplayer games you plan to play for hundreds of hours? Yes. The $15 you save on a discounted key is not worth the headache of a revoked license 60 hours into Elden Ring. For single-player games you will play once? A safe discounted key from a verified site is fine. Match the risk to the stakes.
The Bottom Line
How Scam Sites Get Away With It
Game key scam sites operate on one simple principle: the price is low enough that you will not fight for a refund. They count on you feeling embarrassed about falling for a $12 scam. Chances are you do not know how chargebacks work either — and the site is betting on that too. After all, they want you to move on to the next deal instead of leaving a warning for the next person.
The 5-Minute Safety Routine
The ten checks in this guide take roughly five minutes total. That is less time than a single call to your bank’s disputes department. First, check the price against Steam. Then verify the domain age. Also look for PayPal. Most importantly, read the 1-star reviews first. Those four alone eliminate most scam sites. After that, the remaining six catch the ones that are getting smarter.
A legitimate game key deal exists — Humble Bundle monthly, Fanatical flash sales, CDKeys AAA discounts that are 30% off, not 80% off. And those deals are real. They come from sites with years of history, working refund policies, and actual customer support teams. So if a deal looks too good to be true, run it through this checklist. One of the ten will catch it.
Compare verified sellers on our game deals page. Need step-by-step key activation help? Our game key activation guide walks through every platform. And when buying from any key marketplace, keep your payment data and connection safe with our best gaming VPN picks.
More gaming safety & guides: Game Key Activation Guide: Steam, Epic, GOG (2026) | Game Deals: Find the Best Prices Across Verified Sites | Best Gaming VPN for Low Ping & Secure Buying (2026)
Sources: r/GameDeals Wiki: Authorized Key Resellers List | ESA 2024 Report on Digital Software Piracy & Fraud | Steam Subscriber Agreement — Section 3: Account Security & Restrictions | PayPal Purchase Protection — Digital Goods Coverage