Indie Game Scams Every Dev Will Face (And How to Avoid Them)

If you've got a game on Steam, or you're even close to having one, the indie game scams have already found you. The emails start arriving before you've even set up your capsule art. I know because they arrived for me before I'd done anything worth scamming.

The good news: most of these scams are lazy. The bad news: lazy scams still work because new devs are excited and excited people don't read things properly. I have been that person. You will be that person. The goal is to be that person as rarely as possible.

One line to remember above everything else: do not sign anything you haven't read, and contact a lawyer when it actually matters.

The Indie Game Scams Nobody Warns You About

Most articles on game dev scams spend 400 words telling you that scams exist and then stop. I want to be a bit more specific because knowing the name of the thing is how you spot it in your inbox at 11pm when you're tired and you want to believe a 40,000 subscriber streamer genuinely loves your game.

There are two that you will almost certainly run into. Everything else is a variation of one of these two.

Scam #1: The Fake Influencer Email

This is by far the most common one right now. Every game developer gets these. In fact it's not limited to game development. We all get them. I run a few projects beyond games and they show up for all of them.

The structure is always the same. Someone emails you claiming to be a reviewer, streamer, or content creator. The email address looks close enough to real. The name is familiar. The profile they link you to has real subscriber numbers, real content. Everything scans until you look slightly closer and realise the person emailing you is not the actual person behind that channel. They've just borrowed the identity wholesale.

The motivation is simple: the steam key scam wants your free keys. Keys they can sell on grey market storefronts, or use to bulk up a library they then resell. Your game's perceived value drops the moment those keys flood grey market sites at 70% off retail.

How to verify: go to the actual influencer's official channel and find their business contact email listed in the About section. Send a quick message there. If the person who emailed you isn't them, you'll know within 24 hours. Most scammers don't follow up when they realise you've done basic checks.

A lot of these emails are automated, which is actually what makes them easiest to spot. The wording is generic. They almost never mention the name of your game in a way that shows they played it. They'll say things like "your amazing project" and "I'd love to feature your title" without ever naming the title. That's a red flag so large you could wrap a Humble Bundle in it.

I personally just block and move on. Some devs hand out invalidated keys on purpose to waste the scammer's time. I get the appeal but I'd rather spend those neurons on something that moves P For Pistol forward.

Scam #2: The Bundle Key Scam (Indie Edition)

This bundle key scam indie devs walk into is legal, which makes it worse.

The bundle scam works because the Humble Bundle model is real and genuinely good for some devs, so when a random company pitches you a "bundle deal" your first instinct is to at least hear them out. That instinct is correct. The scam is in the fine print.

Here's how it plays out. Someone contacts you offering a cut of bundle sales — they'll throw out numbers like 20-30% revenue share and make it sound like easy passive income. To participate, you just need to hand over somewhere between 10,000 and 50,000 Steam keys. Sign the contract and send the keys over quickly so they can "get you into the distribution pipeline."

Once you sign, the keys go out. Then something called the Happy Hour kicks in, a term I'd never heard before this scam existed in my orbit. The bundle organiser and their associates buy up the keys in bulk immediately after they go live. They've essentially pre-arranged the purchase. The keys then get sold on third-party storefronts, grey market sites, or in private channels at a fraction of your retail price.

Your actual Steam page now competes against 10,000 copies of your game selling at 80% off somewhere else. Potential customers go where the price is lower. Your wishlist conversions drop. Your launch momentum gets kneecapped before it starts.

And because you signed a contract, there's very little you can do about it after the fact.

The fix is boring but essential: do not sign any contract without a lawyer reading it first. If the company pushing the deal says you need to sign quickly or the offer disappears, that's not urgency, that's pressure. Legitimate deals can wait 48 hours for legal review. Scams can't afford to.

What to Do If You've Already Fallen For One

If you handed out keys that are now floating around grey market sites, contact Steam support immediately. Valve has mechanisms for invalidating keys in bulk. It's not instant and it's not guaranteed to fix the damage, but acting fast matters. The longer those keys circulate, the harder the cleanup.

If you signed a bad bundle contract, talk to a lawyer before you do anything else. Some of these contracts have teeth. Some are barely enforceable. You won't know which one you're dealing with until someone with legal training reads it.

The emotional part is harder. You feel stupid. You don't need to. These scams are designed by people who do this full time. You're a developer who makes things. They're a scammer who reads contracts. The gap in experience is asymmetric. All you can do is close that gap faster than the next dev they target.

The Broader Pattern: Why Indie Devs Get Targeted

Every indie developer scam works because of a specific combination: you've made something, you want people to see it, and you're probably operating without a team that includes a lawyer or a business manager. That's most of us.

The solution isn't paranoia. It's just a short checklist before you act on any unsolicited offer:

1. Did they name your game specifically?

2. Can I verify who this person actually is in under five minutes?

3. Is there a contract? Has anyone with legal training looked at it?

4. Is there artificial urgency pushing me to decide quickly?

Four questions. If any of them return a bad answer, slow down. The legitimate offers don't evaporate if you take three days to verify them. I think about this the same way I think about SEO for indie developers: a small amount of due diligence upfront saves an enormous amount of pain later. It's not exciting work, but neither is watching your launch week get gutted by grey market keys.

Conclusion

The scams are going to keep coming. Honestly, the more your game looks like something worth scamming, the better that is for your ego even if it's terrible for your inbox.

Read everything. Sign nothing without legal review. Move fast on cleanup if you miss one.

If you're still in the early stages and trying to figure out the actual game part before worrying about the scam part, follow along with P For Pistol as I figure that out in public. And if you want a longer read on why most of the marketing advice aimed at indie devs is also a kind of scam, the piece on whether indie developers should even bother with SEO covers that ground without the usual content farm cheerfulness.