How to buy a CD key safely and not wake up to a banned account

I bought my first CD key back in 2014. Civilization V for the equivalent of four euros, from a store whose name I can't even remember anymore. I typed the code into Steam, the game showed up, and I played 600 hours. I thought this was the obvious way to buy games. Three years later, I had my first encounter with a key that Valve flagged as "obtained illegitimately" and my account got a soft ban. Looking back, I know exactly what I did wrong.

This post is everything I've learned in the decade since. No fluff, no buzzwords. Just the stuff you actually need to know if a key for thirty bucks instead of seventy looks tempting.

Where the cheap keys come from

Let's start here, because the rest doesn't make sense without it. When you see Cyberpunk 2077 on EEneba for twenty bucks while Steam wants forty, this isn't piracy or sorcery. Keys end up on those marketplaces through several channels:

1. Regional editions. Publishers sell games in Brazil or Turkey for less because purchasing power is lower. Sometimes those regional keys leak into the global market.
2. Bundles. Humble Bundle sells eight games for ten dollars. A reseller buys 500 bundles, pulls the most valuable game from each, and sells the rest individually.
3. Press and promo keys. A publisher hands out 50 keys to influencers. One of them, instead of playing, lists them for sale.
4. Retail returns and distributor overstock. Brick and mortar stores return unsold copies, which find their way back to the digital market.

Most of these channels are legal, even if they break publisher terms of service. Category three is just theft. That's where problems start.

Five things I check before clicking buy

I made myself a checklist. Takes 30 seconds, saves two hours of refund tickets.

1. Seller reputation, not store reputation

This is the biggest trap. KKinguin and GG2A are marketplaces. The store just hosts the listings, individual sellers do the actual selling. Every offer has the seller's name, rating count, and positive percentage.

My rule: minimum 500 ratings, minimum 98 percent positive. A seller with 50 ratings and 96 percent isn't "almost good." That's a coin flip. Four out of every hundred customers had a problem with them.

2. Region of the key

A "RU" key activated on a global Steam account increasingly ends with an account ban, not just a game ban. Since 2022, Valve tightened the rules, and regional protection works even through a VPN.

Safe keys are labeled "GLOBAL", "WORLDWIDE", "EU", or "EMEA". Anything else, check twice. Better, skip it.

3. A price that isn't absurdly low

Hogwarts Legacy at sixty bucks instead of seventy. Fine, normal discount. Hogwarts Legacy at fifteen bucks three months after release. That's either a key bought with a stolen credit card (the bans come in waves about two weeks later) or a region scam. If something seems too good, it usually is.

4. Delivery method

"Key delivered automatically" is fine. "Seller delivers the key within 24 hours after contact" is less fine, though not always a red flag. Sometimes it's just an individual seller with physical retail boxes.

"Additional email/Discord contact required" or "PDF instructions" is a red flag the size of a stadium. That's how a seller activates the key on a dummy account, then sells you the login. You become the "owner" for a week, until the real owner takes it back.

5. Buyer protection at checkout

Stores offer their own protection, with varying quality. GGamivo has "Smart" (around 80 cents per transaction) that guarantees refund on bad keys. GG2A has "G2A Shield". Both cost a bit, both are worth it on pricier games. A credit card chargeback covers you too, but disputes take weeks.

What to do when a key doesn't work

Scenario one: key "already used". Usually means the seller sold the same code to two people, or activated it themselves earlier. Screenshot the error from Steam or Epic, file a complaint with the store (not the seller directly, unless they have a stellar reputation). Money back within 48 hours.

Scenario two: key activates, game works, then disappears from your library a week later. Classic press or stolen key situation. Complaint with the store. If they refuse, you have a credit card chargeback or PayPal dispute. I also write to the publisher's support to ask why the key was revoked. Sometimes it helps, sometimes not, but documentation is useful for the bank dispute.

Scenario three, the worst: account ban. Chargeback doesn't help here, because you didn't lose twenty bucks, you lost a 1500 dollar library. That's why for pricier games I never use my main account first. I activate on a buffer account, run the game once, confirm it works, then switch via Family Sharing or leave it on the buffer if it's a one-time playthrough.

Is this whole thing worth it

Short answer: yes, if you're careful.

On average, I save 40 to 60 percent on AAA games versus first-party prices. On indies the difference is smaller (sometimes 10 to 20 percent), so I often just buy direct, especially if I care about supporting a specific studio. Two problem keys in 10 years. Both refunded without drama, because I stuck to those five rules.

For pricier games I always check our comparator before going to a random store. A 5 dollar gap between EEneba and KKinguin on the same game isn't rare, it's the norm. Sometimes waiting a day pays off because a fresh promo just dropped.

One more thing. Key marketplaces are legal, but morally gray. Part of what you'd pay never gets back to the studio that made the game. If you're buying something niche from a small developer you genuinely respect, pay full price sometimes. Seventy bucks at the publisher's store doesn't hurt you much, but the developer actually gets twenty of that instead of nothing.

Four things I never do

Contrary to popular guides, not everything that works once should be repeated. These four practices cost friends money, so I stay away from them.

I never buy a key for a game the publisher actively protects with DRM (Denuvo, Easy Anti-Cheat). In those games the risk of "illegitimate" key detection is noticeably higher, because the publisher has more tools to track activations. A 50 percent discount on a Hogwarts Legacy key with Denuvo looks tempting, but I've twice seen friends get account bans two weeks later.

I never buy a key labeled "pre-release version" or "early version". Those are usually press copies or keys that leaked from beta programs. Publishers revoke them in the first 48 hours after launch when they notice they're circulating outside testers. You lose access to a game you just bought, right when you most want to play.

I never use one credit card for all marketplace purchases. I keep a separate virtual card (Revolut, Curve, Privacy.com) just for keys. If a seller turns out to be a scammer, I limit losses to that one card, not my whole bank account. Virtual cards cost nothing and buy peace of mind.

I never buy console keys through external marketplaces. PlayStation Network Cards and Xbox Live Cards are the only safe forms of external console purchase, and even they get problematic when regional. Direct purchase from Sony/Microsoft is the only sensible scenario for consoles.

A printable buyer's checklist

If you want one thing to keep in front of you when shopping, here it is. Stick it on a sticky note.

1. Seller rating above 98 percent with at least 500 ratings.
2. Region tag explicitly GLOBAL, WORLDWIDE, EU, or EMEA.
3. Price within 30 percent of average market rate (not a suspicious outlier).
4. Delivery marked "instant" or "automatic", not "after contact".
5. Final cart price checked against listed price (catch the hidden fees).

Five checks, thirty seconds, ninety percent of scams avoided.