Cheap Keys from Gray-Market Resellers: What the Discount Actually Buys You

You are at checkout. The game is $59.99 on Steam tonight; the same title, same platform, is $17.85 on a key marketplace with a stranger’s username at the top of the listing. The decision is not “is this site a scam” — that question has no single answer. The real decision is this: the discount is the price of moving every risk of the transaction from the storefront to you. Whether that trade is worth it depends on what those risks actually are, and they are specific, documented, and survivable if you go in with your eyes open.

Where do cheap keys come from?

A game key is a single-use, alphanumeric code that activates a license on a platform — Valve’s own documentation describes Steam Keys as “single-use, unique, alphanumeric codes that customers can activate on Steam to add a product license to their account.” Publishers hand them out as a free service so their games can be sold on other storefronts and at retail. The code is the product: whoever holds an unactivated code can, in practice, sell it to you.

Most keys flooding the discount marketplaces start legitimate. The usual sources: bulk codes sold to other stores or regions where the price is lower; surplus bundle and promotion keys; retail copies stripped for their download codes. And then there is the fourth source, the one the discounts you should not touch come from: keys bought with stolen credit cards. The fraud loop was documented in detail by the developer tinyBuild in 2016: fraudsters buy keys in bulk from the publisher’s own store using stolen card numbers, the real cardholders’ chargebacks arrive, and “our payment provider would shut us down within days” — in tinyBuild’s account, that is exactly what collapsed its own store. Minutes later, in tinyBuild’s words, “you’d see G2A being populated by cheap keys of games we had just sold on our shop.” The developer has already delivered the product; when the payment reverses, the key is pure loss.

How big is the problem, really?

Both sides of that question have real numbers, and the honest answer sits between them.

On one side: marketplace volumes are enormous and the confirmed-fraud cases are a rounding error next to them. G2A’s CEO, defending his platform after the 2020 audit below, pointed to “over 10 million transactions annually” versus 198 confirmed illegitimate keys.

On the other side, what the confirmed cases establish:

• tinyBuild (2016): by G2A’s own sales statistics, roughly $200,000 of its games had sold on the marketplace — closer to $450,000 at retail prices — a volume the developer tied to stolen-card purchases that collapsed its own web store. When asked for compensation, tinyBuild reported being told none would be given unless it agreed to work with the marketplace directly and revoke the keys itself — pulling games “from the players who now own them.”
• Wube Software, the Factorio developer (2020): the only studio ever to take up G2A’s public pledge to pay ten times the chargeback costs of proven stolen keys. G2A ran the audit itself after independent firms declined, confirmed that 198 of the 321 keys Wube flagged had been sold through its marketplace, and paid $39,600 — real money, to a developer who proved real fraud, at a ratio the marketplace itself chose. Afterward G2A said future verified cases would be reimbursed at full value rather than ten times.
• Devolver Digital (2014): publicly warned that its games bought on G2A were “not legitimate, not guaranteed, and not supported” — and said it was actively canceling those keys.

So the base rate of getting a revoked key is small, but the exposure is real, nothing in the documented cases suggests the marketplace caught these keys before they were listed, and the two documented compensation paths ran through the developer proving fraud — not through the buyer who lost the game.

What happens to you when a key is revoked?

Two separate things, and they are worth separating because people conflate them.

Fraud-claimed keys can be deactivated. A publisher who traces a key to a stolen card can revoke the code, and the license leaves your library. Your copy of the game disappears, and your recourse is whoever sold you the code — often an anonymous seller in another country, behind a marketplace whose buyer protection you have not read until now.

The platform will not make you whole. This is the load-bearing fact, and Valve states it plainly: “Steam Support cannot offer refunds on CD Keys purchased from 3rd party retailers.” Not “rarely” — cannot. Whatever the marketplace’s own refund scheme offers is the only refund scheme that exists on the platform side, which is why the marketplace’s terms, not Steam’s, are the ones that matter before you click buy.

What you do have is your payment instrument. Under the federal Fair Credit Billing Act you can dispute a billing error in writing within 60 days of the first statement showing it; the card issuer must acknowledge within 30 days and resolve within 90, and federal law caps your liability for unauthorized charges at $50. For a code that never activated — never “delivered as agreed,” in the statute’s framing — that is squarely a billing error. A key revoked after it activated is more likely to run through your card network’s standard dispute rules than the FCBA’s, but the route is the same one: written dispute, to the issuer, backed by your evidence. It is slower than a store refund and it is not meant for buyer’s remorse — but for a code that never activated, or a key revoked days after purchase, it is the backstop that follows you everywhere.

What about region locks?

Region restrictions on keys “vary by each individual publisher” — Steam Support says so directly: “There is no standard or universal restriction placed on retail games.” Some keys sold into a cheaper market will not activate in yours, and the error (“Game not available in your territory”) arrives after you have paid, at which point Steam’s advice is to get your refund from the seller. One more rule is worth the repetition: using a VPN or proxy to redeem a region-locked purchase is, per Steam Support, “strictly against the Steam Terms of Service and may result in restrictions on your Steam account” — the remedy can cost you more than the game.

The decision, made explicitly

The discount is worth the risk when all five of these are true — and any one of them failing should end the transaction:

1. The loss is affordable. If the game vanishing from your library next month would genuinely sting, buy it from the authorized store. The gray-market discount is a payment for accepting a small probability of total loss; that payment should scale with what you can stand to lose.
2. The price is plausible. A key at 70% off a game that has never been on sale deeper than 40% is not a deal; it is the fraud loop’s pricing signature. Compare against the game’s lowest official sale price, not its launch price.
3. You are paying with a credit card. Not a gift card, not crypto, not a wire — payment methods that cannot be disputed turn “small risk of loss” into “certain loss when it happens.”
4. You have read the marketplace’s buyer protection before buying — what it covers, how long the window is, and whether it applies to sellers with no history. Protection varies by marketplace, and the marketed tier is often an add-on rather than the default.
5. You kept the receipt trail. Screenshots of the listing, the seller’s page, the price, and the activation error. Every recourse path — marketplace dispute, card issuer, fraud report — starts with evidence you can attach.

Never gray-market-buy: pre-orders (a code promised for a game that does not exist yet, sourced from nobody in particular), gifts for someone else (your risk decision, their loss), and anything redeemed through a VPN.

If a key already failed

1. Confirm with the platform whether the code is invalid or region-restricted — the remedy differs, and the exact error text is your evidence.
2. Contact the seller through the marketplace, then open the marketplace’s dispute. Do this inside its window; note the deadline when you buy.
3. If the marketplace does not resolve it, dispute the charge with your card issuer in writing within 60 days of the statement carrying it.
4. Report it: ReportFraud.ftc.gov is the federal channel, and it is where the pattern data that eventually produces enforcement comes from.

One caution worth saying out loud: the crime in a stolen-key sale sits between the fraudster and the merchant whose card processor took the hit. The buyer is usually not a target of investigation — but as a practical matter your loss gets made whole, when it does, through the marketplace’s terms and your card issuer’s dispute process, not through anyone’s goodwill. State consumer-protection statutes vary, and none of them guarantees a refund on a code an anonymous seller walked away from.

FAQ

Are all key marketplace purchases scams? No. Most keys listed are genuine — surplus stock, regional arbitrage, bundle codes — and most buyers get a working game. The risk is not the average case; it is that the distribution of bad outcomes has a fat tail (no recourse, revoked game) that the official store’s price does not have.

Is my account at risk for activating a cheap key? Activating a region-correct key that turns out to be fraud-sourced has not been documented as grounds for account action; the documented account risk is redeeming region-locked content through a VPN, which Steam’s terms treat as a violation. The buyer-side worst case in the documented cases is losing the game, not the account.

Why can’t Steam just refund me? Because the transaction never touched Steam. The key program exists so publishers can sell elsewhere; Steam collected no money from your purchase and its support policy states it cannot refund third-party retailer keys. The refund obligation, to the extent one exists, lives with the seller and the marketplace.

What is the single biggest tell of a bad listing? Price relative to history, seller age, and payment method — in that order. A brand-new seller at an implausible price taking only irreversible payment methods is the fraud loop, item for item.