How to Secure a Rust Account After Buying

What you receive, and why the order matters

A Rust account is delivered as the Steam login and password plus the Steam Guard Mobile Authenticator file (.maFile). The .maFile holds the data of an authenticator: opened in an authenticator app such as Steam Desktop Authenticator, it shows the current Steam Guard code and can confirm sign-ins, trades and Market listings. Anyone who kept a copy can do the same.

Steam allows one authenticator per account. So once Steam Guard sits in the Steam Mobile app on your phone, every old copy of the file is useless, and the later steps (email, password) are confirmed on your phone. That is why the authenticator comes first.

Step 1: Move Steam Guard to your phone

1. Install the Steam Mobile app on your phone and sign in with the account's login and password.
2. When Steam asks you to confirm the sign-in, enter the current code from the .maFile authenticator.
3. On the app's Steam Guard tab, choose Move Authenticator and follow the steps.
4. Open the Steam Guard settings (the gear icon), tap Recovery Code and write the code down somewhere offline. It lets you remove the authenticator yourself if you ever lose the phone.

After the move, Steam restricts trading and the Community Market for 2 days. The other route, removing the old authenticator with the revocation code stored in the .maFile and adding a new one, blocks trading and the Market for 15 days, and trades or Market listings created in the first 7 days after a new authenticator is added are held for 15 days. Steam itself recommends moving the authenticator rather than removing it whenever you can. Neither route affects playing Rust.

Step 2: Change the contact email

Steam sends password resets and verification codes to the contact email, so it has to be an address only you control. In Steam, open Settings > Account and choose Change Contact Email Address. With the authenticator on your phone, you can approve the change in the Steam Mobile app instead of entering a code from the old inbox. Then verify the new address from its inbox. Our guide on how to change your Steam email covers each screen.

Give the new email account its own strong password and turn on its two-factor sign-in at the email provider: whoever controls that inbox can reset the Steam password.

Step 3: Change the password

In Steam, open Settings > Security and choose Change Password. Steam sends a verification code to the contact email, which is now yours. Pick a password you don't use anywhere else.

Step 4: Sign out everywhere else

Steam's Authorized Devices page (store.steampowered.com/account/authorizeddevices) lists the devices signed in to the account and has a Sign out everywhere option; use it. The option to deauthorize all other devices under Account details > Manage Steam Guard does the same for Steam Guard, so every other device needs a new code to sign in. Sign back in on your own PC and phone afterwards.

Step 5: Check for a Steam Family

Steam Families group up to six accounts, and adults in a family have real power over its child members: they can set parental controls, and once a child has been in the family for 30 days, an adult can recover that child account's sign-in details. Open Account Settings > Family Management to see whether the account belongs to a family.

• A child member can't leave on its own. An adult in that family or Steam Support has to remove it, and until then the account isn't fully yours.
• An adult member should leave. Steam won't let the account create or join another family until a year has passed since it joined the old one.

There is one more reason to leave: Steam says an account whose games are borrowed by a family member who cheats can lose its Family privileges and be VAC banned.

Step 6: A phone number, with one caveat

Valve recommends adding a phone number (Account details > Contact Info): with it you can reset the password or move the authenticator by text message, and it is needed for Steam Guard backup codes. A phone number isn't required for the authenticator itself.

Know how Steam treats shared numbers first. Accounts with the same phone number may be treated as the same identity, and in games whose developers turn it on, a VAC or game ban on one account applies to every account using that number. If your number is already on another Steam account, a ban on either one can reach both.

Step 7: Look for a Web API key

A Steam Web API key lets software work with the account through Valve's API, including its trade offers. A well-known Steam scam registers a key on a hijacked account to watch its trade offers and swap them for look-alikes sent to the scammer. Open steamcommunity.com/dev/apikey while signed in, and if a key is registered that you didn't create, revoke it.

Step 8: Check what you paid for

• The ban record and the limit: no VAC or game ban on the profile, and a Steam level above 0 (limited accounts are stuck at 0).
• The skins: every Rust skin from the listing should be in the inventory. Market prices move, so compare the items rather than the total.
• Hours on public view: if the servers you play on check hours, set the profile's game details to public. Our guide to Rust hours explains why.

If anything doesn't match the listing, contact us inside the 14-day buyer protection window.

The steps at a glance

Step	Where	What it closes
Move Steam Guard	Steam Mobile app > Steam Guard	Old copies of the .maFile
Change the email	Steam > Settings > Account	Resets and codes going to someone else
Change the password	Steam > Settings > Security	The password the seller knew
Sign out everywhere	Authorized Devices	Sessions still signed in elsewhere
Leave a Steam Family	Account Settings > Family Management	Parental controls and child-account recovery
Revoke a Web API key	steamcommunity.com/dev/apikey	Trade offers watched and swapped

What not to do

• Don't give anyone your password, a Steam Guard code, or an SMS recovery or removal code. Steam Support never asks for them.
• Don't sign in on pages outside steampowered.com and steamcommunity.com, however official they look.
• Don't run programs that claim to clean up, optimize or fix Steam; Valve warns they can be malware built to steal accounts.
• Don't use the account to play around a ban on another account. Facepunch treats that as ban evasion, and the new account can be banned too.

What a Rust order on BuyAccount includes

Every Rust listing comes with the Steam login and password plus the Steam Guard .maFile, and every listed account has no VAC or game ban on record and is not limited when it is listed. Payment is held until you confirm the account works, and every order has 14-day buyer protection; see our buyer protection page.

Frequently Asked Questions

Can I just keep using the .maFile?

It works, but anyone with a copy of the file can generate your Steam Guard codes and confirm trades. Moving the authenticator to your phone makes every old copy useless.

Will moving Steam Guard affect my Rust hours or skins?

No. Playtime, stats and items stay on the account. Only trading and the Community Market pause for 2 days after the move.

What if Move Authenticator doesn't work?

You can remove the old authenticator with the revocation code from the .maFile and add a new one in the Steam Mobile app. It works the same way, but trading and the Market stay blocked for 15 days.

Before you buy, see how to check a Rust account before buying and what a Rust account is worth, or compare listings on our Rust accounts page.