Stay safe

Scammers copy popular marketplaces to steal Steam accounts and items. These rules protect you on Grailo and everywhere else.

What Grailo will never do

• We never message you first on Discord, Steam, Instagram or by phone. There is no "Grailo support" account that writes to you privately.
• We never ask for your Steam password, Steam Guard codes or recovery codes. You sign in only through Steam's own page, on steamcommunity.com.
• We never ask you to send items to "verify" your account, to unlock a payment, or to a bot for safekeeping.
• We never ask for payments outside the site, by bank transfer, gift cards, crypto or Steam credit.

Check the address

Grailo lives only at grailo.gg. Look at the address bar before you sign in or enter your Steam API key. Fake sites use names that look alike, with a zero instead of an o, an extra letter, or a different ending. When you sign in with Steam, the Steam page must be on steamcommunity.com, with the padlock, in a real browser window.

Your Steam API key

Sellers give Grailo their API key so we can confirm deliveries automatically. A key lets a site read and cancel your trade offers, which is exactly what scammers use to swap a real offer with a fake one. Enter it only in your Grailo settings, never on another site and never in a chat. If you think someone else has it, revoke it straight away at steamcommunity.com/dev/revokekey, then create a new one.

Before accepting a trade offer

• Accept only offers that contain exactly what you bought and ask for nothing in return.
• The offer must come from the seller shown on your Trades page. Check the profile and the Steam level, not just the name and avatar, which anyone can copy.
• If an offer is cancelled and a "new" one appears from a slightly different profile, do not accept it: that is a typical API key scam.
• When you sell, send the offer to the trade URL shown on Grailo, not to an account that contacts you separately.

If something feels wrong

Stop, do not accept anything, and write to support@grailo.gg. To report a fake site, an impersonator or a suspicious listing, use the report form or abuse@grailo.gg. Your money stays held until the delivery is verified, so taking a moment to check never costs you anything.