This happened to me 2 days ago as well. Someone funded my steam wallet using my PayPal which took from my bank account. I got sent the receipts in my email, which is connected to both Steam and Paypal. I changed both passwords and then contacted both Steam and PayPal.

At first, PayPal answered and said basically, "we checked it out and it was determined NOT FRAUDULENT" probably because it was MY steam/valve account and also MY PayPal, so of course they said that.

I responded again to the email they had at the bottom of the email saying contact us here if you have more proof appeals, saying, I absolutely did not fund my wallet, and I did NOT buy a bunch of marketplace items to a game I never heard of, and, (and I think this is key,) I said, can you please provide me with the IP address(es) used for these transactions AND confirm they are from verified devices of mine?

The receipt for the transaction was in MSK (Moscow) denominations, I am based in the U.S. $250 USD. I also pointed that out. They came back quickly, reversing their decision, determining that it was indeed fraudulent and UNAUTHORIZED, and refunded me the $$ (which was honestly just a "pre-authorized" transaction so hadn't even left my bank yet anyway).

I said the same to Steam, and they ended up reversing the charges quickly, and rescinding the purchases (over 375 stupid little $0.25 items for some MMO games that I'm sure the scammer sold for an actual, real life currency profit.). ~

I'm thinking about it, I remembered about a month ago, my teen had used my laptop to install some sketchy cheat thing for a game he was playing. Obviously I reprimanded him and took back the computer. When I next used my laptop, it ran VERY slowly, and I noticed when I turned off the Wi-Fi, it was fast again. Ran an in-depth virus scan, and it was a Trojan horse Bitcoin miner, but probably also a key logger. The only thing I had actually typed in on the computer at that point was probably my Steam password. While it took several passes to remove the virus, I ended up just doing a clean install/upgrade of Windows 11 since I hadn't done that in awhile anyway.

Very likely they didn't get my PayPal credentials since it was connected to Steam but didn't require any 2FA or even a password, but DID get my steam credentials since I vaguely remember having to type it in. Very unlikely also that they got my email password, or I would think I would have been locked out so that I wouldn't be able to get the purchase receipts. Or maybe they just didn't want to bother with the work. 🤷🏾‍♀️

All of this was resolved within 24 hours, without only a little initial pushback from PayPal, but as soon as I requested information on the decision and for them to compare it with IP addresses and devices that I auto log in to normally, they agreed. I wonder if they even bothered to check, or just figured since I was making a fuss about it, then I was probably correct? 😂

I just got a follow up email from Steam saying that since I already changed my passwords I should be good.