A Steam login from another country is usually one of two things: your own sign-in placed in the wrong place on the map, or someone else getting as far as your password. Steam does not publish how it locates a sign-in; a location like that is normally estimated from the network address behind it, and an address only points to a place approximately. Telling the two cases apart takes a few minutes, and this is where to look.
Where Does Steam Show You Where a Login Came From?
Four places can tell you a sign-in happened. Steam Support does not document which of them show a location, so check what yours show. The first two are attempts to sign in; the login history and Authorized Devices show sign-ins that went through and devices that still have access.
The Steam Guard Code Email
If your Steam Guard works by email, a sign-in from a device Steam does not recognise is not complete until a code sent to your contact address is entered, as Steam Support's Steam Guard article describes it. The same article says this is on by default once your email is verified and you have restarted the client twice. The email itself is the signal: an attempt got far enough for Steam to ask for the second step.
Steam Support does not document what else the email contains. Players report it names a network address and a country; read the one you received. Steam's senders are [email protected] and [email protected].
A Sign-In Request in the Steam Mobile App
With the Mobile Authenticator, Steam Support lists three ways to sign in on a new device: scan the QR code with the Steam app, confirm a notification in the app after entering your name and password, or type the code the app shows. The confirmation request is where you would notice a sign-in you did not start. Steam Support does not say whether that screen shows a location; check the next request on your phone.
Your Login History
Steam has an account data page at help.steampowered.com/en/accountdata. A 2018 write-up describes a login history there with dates and locations; Steam Support's security articles do not describe its fields, so check them on your own account. If you want to know whether a sign-in went through rather than just being attempted, that is the page to open.
Authorized Devices
The Authorized Devices page at store.steampowered.com/account/authorizeddevices is the first stop in Steam Support's own checklist for a suspected compromise: look at the list, and if anything seems odd, use the Sign out everywhere option. Deauthorising a device removes it from Steam Guard authorisation, so its next sign-in needs a code again. Steam Support also notes that accounts with the Mobile Authenticator can see information about the devices that have access.
Why Does Steam Say I Logged In From a Country I Have Never Been To?
Because the location is an estimate from a network address, and the company that owns the address, not you, decides where it is registered. The common reasons a location by address comes out wrong are ordinary, and none of them is specific to Steam:
- a mobile network that routes traffic through another city or country;
- a VPN or proxy, including one left on by a browser extension;
- an internet provider whose address block is registered somewhere else;
- signing in from a cloud gaming or remote desktop machine;
- a service you connected to your account that signs in from its own server.
Location by address is an estimate, and no one publishes how often it misses. The useful question is not whether the country is right, but whether you, or something you set up yourself, made that sign-in at that time.
Did Someone Actually Get Into My Account?
Steam Guard is the second layer. The first is your account name and password; with Steam Guard on, a sign-in from an unrecognised device also needs a code from your email or your app. That gives you a way to read what you are looking at.
- A code email or an app request you did not trigger means an attempt reached the second layer. Without the code it cannot finish, unless the code reached them too, which is why your email account matters. The safe assumption is still that your password is no longer only yours, so change it.
- A device you do not recognise on the Authorized Devices list, or a sign-in on the account data page that was not you, means a login went through. Treat it as a compromise and work through the next section in order.
Steam Support is direct about how accounts with Steam Guard still get stolen, and none of the ways involve guessing the code: a compromised email account, which lets someone reset the Steam password; a Steam Guard .SSFN file handed over; malware on a computer that is already authorised; and phishing by people impersonating Steam or Valve staff. If the login turns out to be real, one of those four is the most likely door.
What Should I Do If the Login Was Not Me?
This is Steam Support's order, with the details from its linked articles.
- Sign out everywhere. Open Authorized Devices and use the Sign out everywhere option, so every session, yours included, has to sign in again.
- Change your Steam password. In the Steam client: Steam, Settings, Security, Change Password. Steam emails a 5-character code, you set a new password, and you get a confirmation email. It must not be one you used before, and it must not be the one on your email account.
- Secure the email account.Steam Support's advice is a strong, unique password and two-factor on the mailbox. Steam says it informs you of security changes to your account by email, so a mailbox someone else can read undoes everything else.
- Scan for malware, programs and browser extensions alike. A new password typed on an infected machine is not new for long.
- Move Steam Guard to your phone.Steam Support calls the Mobile Authenticator "the best level of Steam account security" because you authorise sign-ins with a device you physically hold. During setup Steam shows a recovery code; write it down and keep it off the computer. Where backup codes fit in, and why you never give one to anybody, is in Steam backup codes.
- Locked out already? Start with Steam's own recovery. Steam Support's article on stolen accounts states you can still contact them even if someone has changed the email address, password and phone number on the account.
Is That "New Login" Email Even From Steam?
A fake login alert is a common way to collect passwords, and it is built to look like the message in the first section. Steam Support gives you the checks: all official Steam logins go to www.steampowered.com, store.steampowered.com, steamcommunity.com or help.steampowered.com, and Steam Support is handled only through help.steampowered.com, never through Discord or any other chat, even if the message comes from a friend's account.
The simplest habit covers all of it: do not click a link in a login email. Type the Steam address yourself, sign in, and check Authorized Devices. If the alert was real, you will see it there.
If the Login Was a Service You Connected
Anything you connect that signs into your account, whether a playtime service, a trading tool or a cloud machine, signs in from its own server, so any location attached to that login will be wherever that server sits. The two things to check are where the provider's servers are and whether you can see and end the session yourself.
Our Steam Hour Boost handles it like this. On the Pro and Elite passes you pick the country before the account is connected, from 13 countries across Europe, North America and Asia-Pacific, and the session signs in from a server there. The free plan gives you a continent, not a country: Europe signs in from Helsinki and North America from Chicago, so a player in Poland on the free plan is signing in from a server in Finland. You connect with a QR code in the Steam app or, where your location offers it, with your account name and password, and every active session is visible to you and removable in the panel. Why that matters when you compare providers is in how Steam Hour Boost works.
Quick Answers
Can someone log into my Steam account with Steam Guard on? Not from a new device without the code. Steam Support lists how it still happens: a compromised email account, a Steam Guard .SSFN file, malware on an already authorised computer, and phishing.
Does a Steam Guard code email mean my account was hacked? No. It means a sign-in attempt from an unrecognised device reached the code step. If it was not yours, change your password, secure your email and check Authorized Devices.
Does Steam email you every time someone logs in? Steam Support documents a code request when a sign-in comes from an unrecognised device, and emails about security changes to the account. It does not document a separate alert for every login, so check Authorized Devices rather than waiting for a mail.
Where can I see my Steam login history? Authorized Devices shows what currently has access; Steam's account data page at help.steampowered.com/en/accountdata is reported to hold a login history, with fields Steam Support does not document, so check them on your own account.
Will a playtime service show up as a login from another country? It signs in from its own server, so any location shown for that login is the server's, not yours. Before you connect one, check where the provider's servers are and whether you can see and end the session yourself.
Imbaboost is not affiliated with Valve or Steam.
