Keys for your game are on a reseller site. Where they came from, and what you can do.

Your game is on a key marketplace for a third less than your store price. You have never sold there. The seller has a five-digit rating and a name you do not recognize, and there are forty keys in stock.

A game we shipped was extracted, rebuilt and resold, so we know what it is to find your own work under someone else's price tag. Resold keys are a different problem, and in one way a stranger one: the game is really yours, the keys are real, and somewhere back along the chain you or one of your partners issued them. This page covers where those keys come from, how to trace them, when revoking them is right, what a marketplace has and has not done for developers who asked, and how to close the source. It is not legal advice, and the places where a lawyer is worth paying are marked.

1. What you are looking at

Most key sites are marketplaces. The site does not own the keys. Independent sellers list them, the site takes payment and passes the key to the buyer. G2A describes its own role as letting sellers offer the products they own for others to buy. That structure matters for two reasons. The site will say it had no part in how a key was obtained. And a listing alone tells you nothing about whether the key was stolen, since the same page can hold keys from a bundle next to keys bought with a stolen card.

Save what you see before you do anything: the address of the listing, the seller names, the prices, the stock counts and the date. A dated screenshot and a capture on the Internet Archive's Save Page Now are enough. Prices and stock on these pages change daily, and a record of how many keys were on offer, and when, is what lets you match a listing to something that happened on your side.

If what you found is your game under a different name, or a free download, you are on the wrong page. See what to do when someone is selling your game or what to do when your game is on a pirate site.

2. The six places keys come from

This table is our own sorting, built from what developers have published about their cases. The middle column is the signal on your side, in your own records. That is where the answer usually is.

The first two are the ones developers have documented in the most detail.

Card fraud

Wube Software, the studio behind Factorio, set out the mechanism in 2016. Someone obtains credit card numbers, buys keys on the studio's own website with those cards, and moves the keys to resale sites at a lower price. Eventually the card owner notices and cancels the transactions. The studio does not keep the money and pays a fee of about $20 for each cancelled transaction. In 2019 the studio put a number on it: over 300 Steam keys bought with stolen cards just after its Steam launch, and an estimated $6,600 in chargeback fees.

The publisher tinyBuild described the same pattern at larger scale. Its chief executive said the company's own shop collapsed when it started to get hit by chargebacks, and that its payment provider would shut it down within days of a wave of orders.

This source only exists if you sell keys directly and take card payments yourself. If every sale goes through a large store, card fraud is that store's problem to screen, and it is not where your keys came from.

Fake requests

Valve's own documentation warns about this one. It says it has heard many reports of fraudsters impersonating journalists or storefronts to acquire keys, and then reselling those keys for profit. Every developer with a public store page gets these emails. They arrive in the days around launch, when you are tired and saying yes to everything that looks like coverage.

In 2022 the developer of BROK the InvestiGator tested the requests he was getting from curators. As reported at the time, he sent codes for the free prologue in place of the full game and waited to see who would write back asking for the real thing. Most never replied. Negative reviews then appeared from accounts claiming to own the full game, and Valve later banned at least 20 curators. The developer said he had no proof the codes were resold. The silence was the result that mattered: a reviewer who plays the game notices it is a prologue.

3. Trace your own keys before you act

You cannot respond well until you know which source you are dealing with. Three checks, in order of cost.

Read your own records against the listing

• When did the listings appear, and what happened in the two weeks before? A bundle, a giveaway, a batch sent to a distributor, a round of press emails, a deep sale.
• How does the price compare to your lowest historical price, your cheapest region and your last bundle?
• How many keys are on offer? Forty keys from one seller is not one fan selling a spare.
• If you sell directly, do you have chargebacks or refund disputes from the same period?

Check whether you can identify the batch

Steam lets you label each batch of keys when you request it. Valve calls correct tagging very important and a valuable accountability measure for keeping track of sales on other storefronts. It also provides a page for looking up a key, with two limits: you can query only one key at a time, and only keys from batches you requested or have permission on.

A marketplace does not show the key before purchase. So the lookup only helps once you hold a key from the listing. Buying one key from a listing of your own game, to learn which batch it came from, is a step some developers take. It costs the price of one key and it funds the seller by that amount. In our view it is worth doing once when the stock is large and your records do not explain it, and not otherwise. If a player writes to you about a key that stopped working, that key answers the same question for free.

Keep a key log from now on

If you have no record of who received which keys, you have found the first thing to fix. One spreadsheet is enough: batch, date, tag, how many, who received them, and why. Valve's advice is to request keys in small batches, to give partners only as many as they will reasonably need, and in general to treat keys like cash. A log is what makes the next listing traceable in five minutes.

4. Revoking keys: what it does and who it hits

Steam lets you ban keys from batches you control. You can ban a whole batch or just keys that have not yet been activated. Valve's documentation is direct about the limits. It says you may ban keys that have been stolen or purchased fraudulently, that you should never ban keys that have been legitimately sold to customers, and that you should be very careful because you could be removing access from legitimate customers.

The reason for the caution is who feels a ban. The person who committed the fraud was paid long ago. The key is now in the library of someone who bought it from a reseller, often without knowing anything was wrong. Wube published some of the messages it received after revoking keys bought with stolen cards. One player wrote that the game was removed after roughly 300 hours and about two months of play. Another had received it as a birthday present.

How we would sort the decision. This is our judgment, not a rule from Valve:

If you do revoke activated keys, tell the player the truth when they write: the key was bought with a stolen card or obtained by fraud, you were not paid for it, and their claim is against the seller and the marketplace they bought from. Valve's refund policy says it cannot provide refunds for purchases made outside of Steam, and gives keys bought from third parties as an example. So the reseller's own buyer protection is the player's route.

5. Asking the marketplace

You can write to the marketplace. What happens next has varied a great deal, and the two best-documented cases point in opposite directions.

The case that paid

In July 2019, after G2A publicly offered to repay developers ten times what they could prove they had lost to chargebacks, Wube took up the offer. It sent a list of the Steam keys it had revoked because they were bought fraudulently, and asked how many had been sold on the site. Ten months later the result was reported: of 321 keys on the list, 198 were found to have been sold through the marketplace, in an audit G2A carried out itself, and Wube was paid $39,600. The same report says G2A stated that from then on it would compensate developers the full value of chargeback fees for keys sold on its marketplace, where the developer is able to prove they were illegitimate. We could not read G2A's own statement, which blocked our attempts to open it, and we do not know whether that policy still stands today.

The case that did not

In 2016 tinyBuild asked the same marketplace about keys for three of its games. By the publisher's account, the reply was that no compensation will be given, with a suggestion that the keys had come from the publisher's own distribution partners. tinyBuild valued the resold keys at about $450,000 at its retail prices. That figure counts every resold key as a lost full-price sale, which is an upper bound and not a measured loss.

What made the difference

Our reading: Wube had a list. It could name specific keys, show that each one had been revoked for fraud, and point to chargeback fees it had paid. A marketplace can check a list of keys against its sales. It cannot check a general complaint that cheap keys must be stolen. If you write, bring:

• The exact keys, in a file.
• For each, the reason you believe it was obtained illegitimately: the chargeback record, the refund, the false-identity request.
• The fees or losses you can document.
• A specific request: remove these keys, tell us how many were sold, and tell us which seller accounts listed them.

Use the marketplace's own support or business contact, keep everything in writing, and keep the tone flat. Expect it to take months. Wube's took ten.

Blocking keys in advance

In 2019 G2A proposed a tool that would let a verified developer paste in review keys so they could not be listed, and would stop a seller listing more than three keys from a registered giveaway. It said it would build the tool if 100 developers registered interest. A later report counted 19. We found no evidence the tool was built, so do not plan around it.

6. Why a copyright notice usually does not fit

A takedown notice says someone is copying or distributing your work without permission. A key listing is not a copy of the game. The player still downloads the game from the store you chose, under the store's license. What is changing hands is a code that you or your partner issued.

Wube looked at this when it found its game advertised on a key site and wrote that after looking into some trademark/copyright law, it seems there is not much we can do. That is one studio's conclusion, not a ruling. Whether a particular resale is lawful depends on how the key was obtained, on the terms it was issued under, and on the country, and courts in different places have treated the resale of digital goods differently. If the answer matters to your business, this is a question for a lawyer in the country concerned.

What we would not do is send a copyright notice for a listing because it makes you angry. A notice is a statement made under penalty of perjury, and the law has a remedy against knowingly false ones. There are narrower cases where one may fit: a seller using your art to sell something that is not your game, or a listing that offers a download and not a key. For those, the process is the one for copies on sale. If the issue is your name being used in advertising, that is a trademark question.

Keys obtained by card fraud or impersonation are a different matter in law from keys resold after a bundle. Fraud is a crime, and you can report it to your payment provider and to the police. In practice, small cross-border card fraud is rarely pursued, which is why the steps in the next section do more than a report does.

7. Close the source

This is where an afternoon's work changes the next year. Take the parts that match the source you found in section 2.

If you sell keys from your own site

• Let someone else carry the fraud screening. Wube reported that after it switched payment providers, the fraudulent purchases stopped. It moved its checkout to a widget run by an established store. A provider that handles millions of game purchases sees fraud patterns a single studio's shop never will.
• Delay delivery when an order looks wrong. Many orders from one address, mismatched countries, a run of purchases minutes apart. A key held for review can still be cancelled. A key already emailed cannot.
• Record which key went to which order. Without that link you cannot revoke the right keys when a chargeback arrives, and you cannot hand a marketplace a list.

Review copies

• Use the store's own tools where they exist. Steam's Curator Connect sends a review copy to a curator's account directly. Valve notes that the system does not use keys and instead makes a license available to the selected curator through Steam. You can send offers to 100 curators, with up to 5 copies each. There is no code to pass on.
• Answer requests at an address you found yourself. When someone writes as a journalist or creator, do not reply to the address the request came from. Find the contact address on the outlet's own site or the channel's own about page, and send the key there. A real creator receives it. An impersonator never sees it.
• One key per request. A request for several keys "for the team" or "for a giveaway" from someone you have not worked with is the commonest shape of the scam.
• Send something a reseller cannot use. The prologue test from section 2 works because a demo key has no resale value. A pre-release key that Valve classes as Release State Override is another option for press before launch. Valve says it is never OK to sell those keys.
• Tag every batch by purpose, so a press key that turns up on a marketplace can be recognized as a press key.
• On itch.io, generate keys one at a time for press. Its documentation recommends a single key with a label for a friend or press contact, which lets you track downloads and revoke it.

Bundles, giveaways and regions

• Assume some share of any bundle will be resold. People buy bundles for one game and sell the rest. Decide whether the bundle is worth it with that already counted.
• Hand out giveaway keys through a system that ties each to an account, where you can. G2A's own proposal acknowledged that some giveaway keys are gained using bots.
• Look at your regional price gap. Wube noted that the gift copy from Europe was listed cheaper than the worldwide one, and named buying in one country to sell in another as a likely source. Where you issue keys for a low-price region, ask the store what region limits it offers.
• Know that deep discounts set a resale price. Anyone can buy at your lowest price and sell above it until your next sale. Wube pointed out that this is where speculative buyers earn their margin. It is the cost of discounting, and it is lawful.

Partners

Give a distributor or retailer the number of keys they will reasonably sell, in a tagged batch, and more when they ask. If your contract says where they may sell, a traced key is how you show a breach. Valve also reviews large key requests itself. It says launching games may receive up to 5,000 Default Release keys, with further requests looked at case by case.

8. What to tell players

Most people buying from a key site are not trying to hurt you. They saw a lower price. Many do not know the developer may receive nothing, or that the key can stop working.

• List your official sellers on your website and your store page's links. One line: these are the stores that pay us.
• Say plainly what the risk is to them. A key from an unofficial seller can be revoked if it turns out to have been bought with a stolen card, and the store cannot refund a key bought elsewhere.
• Answer revoked-key mail kindly. The person writing lost money too. Explain what happened and point them to the reseller's buyer protection.
• Leave out the lecture. Wube's line was that it would rather you pirate the game than buy it from a grey-market site, because a fraudulent key costs the studio a fee on top of the lost sale. You can make the same point in one sentence without contempt for the buyer.

9. How much this deserves

Do the arithmetic for your own case before you spend a week on it. This is our framing.

• Fraud keys cost you real money. Each one is a sale reversed plus a fee. Wube's roughly 300 keys cost about $6,600 in fees alone. If this is your source, fixing it today is worth more than anything else on this page.
• Impersonation keys cost you the keys and the time you spent answering. The fix is a change of habit.
• Bundle, sale and regional keys were paid for once, at a price you agreed to. The loss is the gap between that price and the price a reseller's customer would have paid you, for the share of them who would have bought from you at all. Nobody can measure that share. It is smaller than the listing makes it feel.

A reasonable routine: check the two or three largest key sites at launch, after each bundle and after each deep sale. Save what you see. Compare it to your key log. Act when the numbers do not match anything you did. Then go back to the game.

Common questions

Is it legal to resell game keys?

It depends on how the key was obtained and where. A key bought with a stolen card or obtained by impersonation involves fraud. A key bought in a bundle and sold on is a different question, and countries answer it differently. A lawyer in the relevant country can tell you where your case sits.

Do I get paid when someone buys my game from a key reseller?

Not for that sale. If the key came from a bundle, a sale or a retail batch, you were paid once, when the key first left your hands. If it came from card fraud, you were paid nothing and charged a fee.

Can I revoke keys that are being resold?

On Steam you can ban keys from your own batches. Valve's documentation allows this for keys that were stolen or bought fraudulently, and says never to ban keys legitimately sold to customers. A ban removes the game from whoever activated the key.

How do I find out which of my keys are on a marketplace?

Marketplaces do not show keys before purchase. You can match listings to your records by date, price and volume, look up a single key you have obtained against your tagged batches, or give the marketplace a list of keys you already know to be fraudulent and ask which were sold.

Can I send a takedown notice to a key site?

Usually not for a key listing, since a key is not a copy of the game. A notice may fit if the listing uses your art to sell something that is not your game. Do not sign a notice you are not sure of.

Will a marketplace compensate me for stolen keys?

One studio was paid $39,600 in 2020 after supplying a list of 321 keys, 198 of which were confirmed as sold on the site. Another publisher was refused in 2016. Specific keys and proof of chargebacks are what the successful case had.

How do I tell a real key request from a fake one?

Find the outlet's or creator's contact address yourself, on their own site or channel, and reply there instead of to the sender. Send one key. For curators, use Curator Connect, which grants a license to the curator's account with no key involved.

Should I stop giving out keys altogether?

No. Review copies are how small games get seen. Give them through channels tied to an account, in small tagged batches, to addresses you verified.

Should I put my game in a bundle if the keys will be resold?

That is a business decision. Count on some resale, and compare the bundle's payment and reach with a period of cheaper keys in circulation. Many studios decide a bundle late in a game's life is worth it and one near launch is not.

Is buying from a key reseller worse for a developer than piracy?

For keys that came from card fraud, yes, in direct cost: the developer pays a chargeback fee for each one. For keys from bundles or sales, the developer was paid once at a low price. Buyers cannot tell which kind they are getting.

This page describes the published documentation of Valve and itch.io as read on 12 October 2026, and the accounts of Wube Software, tinyBuild and others as they or the press reported them at the time. Marketplace policies described here are historical and may have changed. We could not open G2A's own statement on the Wube audit and rely on a contemporary report of it. The source table, the revocation table, the advice on tracing and the routine are our own analysis. It is general information, not legal advice about your situation.