So the thing is that a friend of mine wanted to buy me as a gift a game on Steam, but I didn't have an account, so what he did was create an account for me, with my own email, and with a random password, and he suggested me to then change it. Of course I had to go to my own email and click the "confirmation link" in order to validate the email address first, and then change the password.

The thing is that I trust this friend in this case, but I was just wondering if there is any risk of doing this. The account is linked to my own email, and the password has been changed, so I think there is no risk, but this seems a bit awkward to me, so makes me thing there may be any risk involved here.

2 Answers 2


Let's start with the general case...

The email in usually the main verification point for an account, so since you control the email address it would be difficult for someone else to reset the account or take action without you knowing. However, there are a few possibilities:

  • Poor session management by the service: If your friend logged in with the account and never logged out, even if you changed the password he could still remain logged in. A best practice for the website would be to invalidate all active sessions when a password is changed
  • Account recovery which can bypass email: Some services allow you to reset and regain control of the account with a backup email, a phone number, or by answering challenge questions
  • Social Engineer Support: If there is a human element there is always the chance that via email, live chat, phone, etc. someone could social engineer their way into gaining access to their account if they know enough information

In the case of steam, you can review their account recovery FAQ. From an initial read it looks like you may be able to recover an account with key information and without email access, but I have not gone through the process to try it out.

Steam offers a 2-factor authentication option, which could help to prevent these types of attacks, but I am not sure how they would handle attempted social engineering when the attacker claimed they lost access to the 2-factor solution. Check out Steam's guide to securing your account.

In general, I would not recommend having other people setup your account on your behalf.


A couple of points here:

I had to go to my own email and click the "confirmation link" in order to validate the email address first

Make sure the email was from Steam. It could've been a phishing e-mail.

If the password was changed from the Steam portal by manually going to the official link, then it should be fine. If it was changed from a link sent in an e-mail, maybe by your friend, again it could've been a phishing e-mail.

Also, you could check the password recovery options for your account(like secret questions and answers or some secondary email) and change them too. Even if you've changed the password, but if the password recovery methods are still known to your friend, he can reset the password anytime.

Regarding the gift being given to your account, it shouldn't be any risk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .