Trade holds were implemented by Valve on December 9, 2015. A trade hold is activated only if a person losing items in a trade does not have an SMS/text capable phone number attached to the Steam Guard Mobile Authenticator app and/or they do not also have trade confirmations enabled. When there is a trade hold the items will be held for 15 days, 1 day if the people trading have been friends for a year. Note that only the person losing items must have the above enabled. Let's break it down:

Person 1 has the mobile authenticator applied to his account with a working text capable number and has trade confirmations enabled. Remember, this is the only way to get relatively instant trades.

Person 2 has any combination except the above.

Person 1 trades items to Person 2. Person 2 gives nothing so he is getting items for free. Person 1 then gets a trade confirmation from his mobile authenticator. He confirms it and the items are transferred to Person 2. No further wait.

If person 2 had offered any kind of an item then there would have been a trade hold. It doesn't matter that Person 1 did everything right, because Person 2 doesn't have the security Valve demands and he lost items, thus there is a trade hold.

If both persons have the security of Person 1 before then they can trade whatever and get it instantly, after both have confirmed the trade via the mobile authenticator of course.

Here is me trading with my alt Pun Raccoon. I have everything setup correctly, Raccoon has trade confirmations disabled which is a no-no. As you can see in this first pic I offer an item and everything is fine because I've got everything setup correctly:


In this second pic I pick something from Raccoon who doesn't have it setup correctly and immediately yellow text appears saying this trade will result in a trade hold. Yes, even though I've done everything right, because my partner hasn't we both have to wait:


Here is another pic illustrating this fact:


I already stated it before, but to confirm, the wait here is only 24 hours because I've been friends with my trading partner for over a year.

Valve released a statement about why they implemented trade holds. My favorite part is the 3rd paragraph in the "Here's the tradeoff" section.
http://steamproxy.net/steamstore/news/19618/

Nearly all the text copied here in case the article disappears (character limit apparently):

- Valve
Dec 9
Recently we've seen the community have a good discussion about the pros and cons of trade holds. We thought we'd walk through how we decided to implement them, in the hopes that it helps you understand why they're absolutely necessary.

Compromised accounts and item theft

Account theft has been around since Steam began, but with the introduction of Steam Trading, the problem has increased twenty-fold as the number one complaint from our users. Having your account stolen, and your items traded away, is a terrible experience, and we hated that it was becoming more common for our customers.

Once an account was compromised, the items would be quickly cleaned out. They'd then be traded again and again, eventually being sold to an innocent user. Looking at their account activity, it wasn't too hard to figure out what happened, but undoing it was harder because we don't want to take things away from innocent users. We decided to err on the side of protecting them: we left the stolen goods, and we created duplicates on the original compromised account to replace them. We were fully aware of the tradeoff here. Duplicating the stolen items devalues all the other equivalent items in the economy. This might be fairly minor for common items, but for rare items this had the potential to significantly increase the number in existence.

The number of hijacked accounts continues to grow

This was an unacceptable status quo and we needed to address it. In revisiting our strategy to stop it, we found two things of note.

First, enough money now moves around the system that stealing virtual Steam goods has become a real business for skilled hackers. Second, practically every active Steam account is now involved in the economy, via items or trading cards, with enough value to be worth a hacker's time. Essentially all Steam accounts are now targets.

The "I got hacked" story is told so frequently it's become commonplace. And that makes it easy to forget its significance; compromised security of email accounts and PCs, Steam account violation, and theft. We used to hold the opinion that if you were smart about account security, you'd be protected--it's easy to assume that users whose accounts were stolen were new or technically naïve users who must be sharing their passwords or clicking on suspicious links. That's simply not the case.

What used to be a handful of hackers is now a highly effective, organized network, in the business of stealing and selling items. It would be easier for them to go after the users who don't understand how to stay secure online, but the prevalence of items make it worthwhile to target everyone. We see around 77,000 accounts hijacked and pillaged each month. These are not new or naïve users; these are professional CS:GO players, reddit contributors, item traders, etc. Users can be targeted randomly as part of a larger group or even individually. Hackers can wait months for a payoff, all the while relentlessly attempting to gain access. It's a losing battle to protect your items against someone who steals them for a living.

We can help users who've been hacked by restoring their accounts and items, but that doesn't deter the business of hacking accounts. It's only getting worse.

How we can stop it

We've worked to improve account security features, closed loopholes, improved how and when we message users that their account is at risk, added self-locking, and created the Steam Guard Mobile Authenticator (two-factor authentication).

Two-factor authorization is the use of a separate device to confirm your identity. The security of this system is based on moving that step from your PC to a device a hacker can't access, such as your smartphone. PCs can be easily compromised, therefore a PC-based authenticator would not provide better security than a password or email authentication.

We needed to create our own two-factor authenticator because we need to show users the contents of the trade on a separate device and have them confirm it there. Requiring users to take a code from a generic authenticator and enter it into a hijacked PC to confirm a trade meant that hackers could trick them into trading away items they didn't intend to. This basically made it impossible to use a generic third party authenticator, such as Google Authenticator, to confirm trades.

Here's the tradeoff

At this time, most people have not protected their account with this increased level of security. Many don't believe that they are actually a worthwhile target for a hacker who's out to make money. Some felt they were smart enough about security to not need two-factor authorization. And other users knew they needed it, but couldn't use it due to reasons beyond their control, like not having access to a mobile phone.

So what if instead of trying to prevent hackers from being able to steal a Steam account that hasn't enabled two-factor authentication, we tried removing their ability to profit from the theft. If hackers couldn't move the stolen goods off the hacked account, then they couldn't sell them for real money, and that would remove the primary incentive to steal the account. Hackers fundamentally rely on trading to offload stolen goods. The Steam Community Market doesn't work well for that purpose, because purchases can't be moved around as quickly (purchased items can't be traded for 7 days), and they can't ensure the items move to an account they control.

One option proposed was to simply remove trading. The Steam Market already accounted for the vast majority of virtual goods exchanged by Steam users. We even generate revenue off those transactions, which helps cover the cost of fraud, unlike person-to-person trades. And removing trading was by far the easiest solution to implement. But we felt that was a bad choice for users. Another easy choice would have been to require two-factor authentication for trading, but that's bad for the same reasons as removing it entirely. It's important that you can give a friend a TF2 weapon when he comes to try out the game, or give a friend the last trading card she needs to craft a game badge.

We felt that two-factor authentication was secure enough that it would protect anyone who enabled it, so the problem was the accounts that couldn't enable it (e.g. no mobile phone access). In the end, we arrived at the changes we're deploying today:

Anyone losing items in a trade will need to have a Steam Guard Mobile Authenticator enabled on their account for at least 7 days and have trade confirmations turned on. Otherwise, items will be held by Steam for up to 3 days before delivery.

If you've been friends for at least 1 year, items will be held by Steam for up to 1 day before delivery.

Accounts with a Mobile Authenticator enabled for at least 7 days are no longer restricted from trading or using the Market when using a new device since trades on the new device will be protected by the Mobile Authenticator.

This means that anyone using the Steam Guard Mobile Authenticator to confirm trades is able to continue trading as always. Users who haven't enabled it, or can't, can still trade, but they'll have to wait up to 3 days for the trade to go through. This gives both Steam and users the time to discover their accounts have been hacked and recover it before the hackers can steal their items.

A difficult balance

Once again, we're fully aware that this is a tradeoff with the potential for a large impact on trading. Any time we put security steps in between user actions and their desired results, we're making it more difficult to use our products. Unfortunately, this is one of those times where we feel like we're forced to inser

On March 1st 2016 Valve released a new statement saying trade holds will be increased from 3 days to 15. Yes, 15. Furthermore market sales will have a trade hold as well. This is despite the fact that they say the current 3 day trade hold has been "even more effective than we'd hoped".

http://steamproxy.net/steamstore/news/20631/

Text copied here in case the article disappears:

- Valve
Mar 1
Recently we walked through our thinking on account security and trading http://steamproxy.net/steamstore/news/19618/, and introduced some new tools for users to protect their accounts. Now that we've had some time to gather data, we'll be making a few more changes to account security, market transactions, and our account restoration process.

Below are the changes that will take place on March 9th. If you are already protected by the Steam Guard Mobile Authenticator (or if you add the security feature to your account today), the first two points below will not impact you:

Trade hold duration will be increased to 15 days (for long-time Steam friends the duration will remain 1 day)

Listing on the Steam Community Market will have a hold of 15 days before an item can be sold

Steam Support will no longer restore items that have left accounts following a successful trade or market transaction (a process that previously created duplicates of original items)


To help understand these changes, we wanted to walk you through the results we've seen so far and our reasoning behind these next steps.

First, it's worth revisiting our goals behind the two main ways customers interact with in-game economies on Steam: Trading and the Steam Community Market. Our primary goal for Trading is to allow customers to easily exchange items with their friends. Our goal for the Steam Community Market is to provide customers with a way to sell any unwanted goods to other players. Both systems work well for these purposes, but they can be a source of pain if the security of your account is ever compromised.

Account and Item Theft

In December we took steps to improve account security by adding more security features, including the Steam Guard Mobile Authenticator and trade holds.

Since then, we've seen lots of users adopting the Steam Guard Mobile Authenticator (two-factor authentication) for trade and market confirmations, and now roughly 95% of daily trades use the mobile authenticator, with trade volumes as high as ever. The authenticator is the best tool that users have to protect their accounts, and the fastest and most secure way to trade items.

Trade Holds

For users who have yet to transition to the Steam Guard Mobile Authenticator, trade holds provide a way to continue to exchange items. Items in a trade hold are held by Steam for a period of time before delivery. This allows users whose accounts have been compromised to quickly cancel any fraudulent trades to recover their items. Trade holds are effective, but unfortunately the current three-day hold fails to protect users who log in less frequently and who need more time to identify a problem. So we'll be adjusting the system to accommodate the majority of customers by increasing trade holds to 15 days.

If you're exchanging items with a friend, and you've been friends for more than a year, don't worry - the trade hold duration is still one day.

Market Holds

Trade holds have been successful, but until now they've been limited to trades. If the Steam Guard Mobile Authenticator was not enabled on a user's account, it was still possible for a hacker to quickly liquidate a user's inventory through the Steam Community Market. To further protect users who haven't enabled the authenticator, holds will now also apply when you list items on the Steam Community Market. Market listing (like trades) will still be instantaneous if you're using the Steam Guard Mobile Authenticator.

Item Duplication

Since the last account security update, we've made significant progress in protecting accounts. In addition to significantly increasing the size of Steam Support to improve response times, individual accounts protected by the Steam Guard Mobile Authenticator on a separate device turned out to be even more effective than we'd hoped. For customers who have yet to add the Steam Guard Mobile Authenticator, trade holds have been helpful in keeping items secure, and we expect that the added duration and extension of holds to the Steam Community Market will further improve security.

Our work isn't finished, but we've seen enough progress in account security to finally address an old problem: item duplication. Currently, if an account is compromised and items have been lost through a successful trade or market transaction, we would manually restore the items, creating duplicates of the original items in the process. That process of manual restoration and duplication has the negative side effect of changing an item's scarcity - as more copies of the item are created, the value of every other similar item is reduced. In addition, it created a method by which users could be rewarded for faking account hijacks.

While we'll continue to assist users with the recovery of their account if they encounter an issue, beginning March 9th we will no longer be manually restoring items that have left the account due to a successful trade or market transaction.

Balance

There's a delicate balance between account security and the convenience of interacting with the market or trade. Any time we make changes, there's the risk of significant disruption. We recognize that today's changes will be inconvenient for users who have yet (or are unable) to use the Steam Guard Mobile Authenticator. But if you're a high volume trader (who our data shows is likely using the authenticator already), or a trader who likes to exchange items with friends, these changes won't really affect you at all. We believe these steps are necessary to ensure that accounts are made more secure, that users are empowered to identify and solve problems, and that the economic systems enjoyed by millions of customers are not compromised by people with malicious intent.

Account security is an issue that affects everyone, and we hope this post has helped to explain our goals and reasoning as we move forward. Please continue to provide your feedback and account security ideas in the Steam forums and elsewhere on the web.

You need either an iPhone, an Android device, a tablet, or a computer. Really anything that can run the Steam mobile app or emulate it (more on that later). Aparrently Microsoft phones are supported now.

I recommend a smartphone, of which I use Android. It needs to be wifi capable, but nearly all smartphones are wifi capable anyway, but just make sure to be safe. You might think smartphones are expensive, and they certainly can be, but there's a trick: prepaid phones. You can go to Walmart and pick up a decent prepaid smartphone for as little as $20-$30. There are all kinds of guides online about how to bypass the activation screen of a new smartphone. Otherwise I believe you have to pay for a month of service through the service provider that made the phone to get them to activate it (correct me if I'm wrong). Once you've gotten past the activation you now have a device that hopefully has access to wifi. You can use it to download apps such as the Steam Guard Mobile Authenticator. Yes, all this without a number, but you will get one later.

If you are really poor (nothing wrong with that) or have lots of alt accounts then you may want to consider having your pc be the "device". How is explained in the section dealing with the app itself.

Steam no longer accepts temporary numbers. I've tried many different numbers from Google Voice and Textnow, and I get the same message each time:
Even my current number associated with my accounts gets the same error when I put it in on a new account. Fortunately because it's already associated with my accounts I can still keep using it!

Apparently this is why they stopped accepting temporary numbers:

I followed the steps the vid shows to check the accounts associated with my number, and fortunately only I am associated with the number (whew). The free text number service shown in the vid is Text Magic which is for marketing for businesses and they freely admit they give out the same number to multiple people. So I expect other sites like the ones I advertised here to be more secure because the number is supposed to only be yours. Even so I highly recommend you do what the vid shows and check the accounts associated with your number. If you see any accounts that aren't yours associated with your number then I would seriously consider getting a new number, which at this point is one you must pay for. It's better than risking a ban in CSGO, TF2, or whatever. If only your accounts are associated with your temporary number then you're safe because even if someone else got a hold of the number and tried to link it to their account Steam will no longer let them.

8-27-16 - Please see the above section because temporary numbers no longer work. It seems you must use a paid for number now :(.

If you want to go the absolutely most secure way (and now the only way) then you would get a data plan from some service provider. But this brings with it a monthly fee. Take note that if you go this route most prepaid phones can't be activated except via prepaid cards. Obviously this route is the most expensive, especially if you're only doing all this so you can trade with relative ease. That's where free numbers come in. The trade off is that you will never lose your number and the confidence that it's securely yours and not going anywhere (so long as you keep paying).

There are several services that offer free text capable numbers. Most notable in my research are Google Voice (which requires another number to be linked to it), Pinger/Textfree, and Textnow. The caveat with these is that your number will expire after a set amount of time if you don't send a text (details in their sections).

All of these free number services have an app you can download on your phone, and a webpage in your browser on your pc. Both options can be used to send and receive texts.



This was the last service I tried but it is by far the best one and the one you should use if at all possible. Unfortunately you must be in the USA to use it. The only other requirement that might stop some people is that you must give Google Voice a working number you have access to, even your home phone number that can't receive texts. Just make sure you uncheck the supplied number wherever you can, unless you actually want to use Google Voice for the forwarding service it's meant for. Once you've done that you can now send and receive texts, even through your browser!


What makes Google Voice the best without contest is that your number only expires after a whopping 9 months of inactivity! Learn more here:
All the way at the bottom under "Account Inactivity"
http://www.google.com/googlevoice/program-policies.html
If you somehow do manage to get your number reclaimed you've still got 30 days to get it back. Amazing!
https://support.google.com/voice/answer/2404002?hl=en



This was the first service I tried. It worked great at first glance. I was able to send and receive texts from a friend. You have to deal with ads in the app, but oh well. Only problem was when I tried to link the number they gave me with one of my Steam accounts. I waited over half an hour and hit the resend button in Steam a dozen times, but I never got a text from Steam in Pinger. Even hours later as I continue to edit this guide. Yes I used the right number, Steam even told me it was a temporary number and do I still want to proceed. It might've been a fluke, give it a try yourself if you can't use Google Voice.

If you can get Pinger to work you need only send 1 text message a month:
https://pinger.zendesk.com/hc/en-us/articles/203619324-Your-Textfree-number-and-minutes-can-expire-

A little over a month later I got an email from them saying my number will expire soon:




This service works very similar to Pinger except I got a response from Steam right away while Pinger was still failing. The downside is that holy crap you have to send a text every day:
https://supportfree.textnow.com/hc/en-us/articles/204253309-Why-Was-My-Phone-Number-Released-And-What-Can-I-Do-
Actually it seems that article is out of date because it took ~10 days for them to give a message on my textnow account in the browser (and I assume in the mobile app) stating that I have 5 more days before my number expires. They're supposed to send you an email too but I'm pretty sure I never got one. Here's a screenie of the messages in the browser:


Don't worry, it's real easy to get another number through whichever service you're using. What you're probably worried about is how it will affect your account. Fortunately changing your number doesn't mess up your account. This is assuming you still have access to the steam mobile guard app, because you remove your number by inputting the current code associated with your account.

Now you have a device (smartphone, computer, or tablet), and have a text capable number. Next you need the mobile authenticator itself.

The most obvious and most secure way is to download the Steam Guard Mobile Authenticator to your iPhone or Android device. That's the whole intention of all this; to force 2-step authentication on people. With your account secured on a mobile device that only you and the masked guy with a gun have access to will make it incredibly difficult for any hacker to get access to your account. Even if your pc became infected with keyloggers and such, the only way the thieves could take your items is if they also had access to the mobile guard app which ideally should be separate from your pc.

If you don't want to spend $30 on a phone or have several alt accounts there is an extremely useful tool recently made for the pc that emulates the steam mobile app. It's called Steam Desktop Authenticator. Don't worry it's completely safe and is not against any kind of rule. You can find it here:
https://github.com/Jessecar96/SteamDesktopAuthenticator
Make sure you download the whole application, it will be a zip file you can find under the releases section. After you've downloaded it and started it it tells you what to do. After you've gotten your account(s) linked to it it's strongly recommended you "setup encryption" which is applying a password to the program. This will make it harder to get fully hacked if you pick up a keylogger, but because the extra security that's supposed to be separate from your pc is on your pc it will just be that much easier to get hacked if it happens to you. But this is the only option if you can't get access to a phone (unless you want to go through the huge hassle of emulating an android device itself using something like Bluestacks and then loading the steam mobile app into it).

Another reason this program is useful is because the steam mobile app is stupid when it comes to multiple accounts. Yes you can link any number of accounts to a single phone number and be able to see the ever-changing code for all accounts you linked to the steam mobile app. However if you want to trade between them and have the trades be relatively instant then they will need trade confirmations enabled. This means you will need to sign into that account and confirm the trade. Then sign back into your main. Then sign back out and into another alt if you're trading with them. It's incredibly tedious what with no copy/paste on a phone and typing with the midget digital keyboard is far slower than a real keyboard. What's great about the desktop authenticator is that you can see trade confirmations for all accounts linked to it at the same time because all are logged in. I've got my main linked to my phone for maximum security, and my far less valuable alts use the desktop authenticator for the incredible convenience it offers.

I've seen various people express annoyance that they think they have everything setup properly, wait over a week, and still have to deal with trade holds. Under the section discussing how trade holds work I have pictures showing how to tell if you or someone else will enact a trade hold when losing items. Here Are some pictures that show how to double check if you have the mobile guard setup correctly.

If you are using a phone you should see this under Steam Guard>Settings:


If you are using the desktop authenticator it's important to associate your phone number with your account via the client FIRST. If you setup your account via the desktop authenticator and don't already have a number associated with your account, the DA will ask you to supply one. But for some reason when you look in the client afterwards it says you are protected by mobile guard but it doesn't list the number you gave to the DA. You then have to do the process of adding your number and getting the text with a code again. Quite weird. So to check your number is in fact associated with your account click your username in the top right and click account details:


You should see this in the client on your pc under "steam" (top left) then clicking settings:


If you are using the desktop authenticator then as long as you went through the process to setup your account and have it listed with a code that is randomly generated you did it right. Still, double check with the 2nd, and 3rd pictures to make sure.

Valve has removed your ability to opt out of trade confirmations as it is permanently on for everyone now.

To recap and quickly tell you how to get setup for trade holds without spending a dime except for what I assume you already have:

1. A pc with access to the internet.

2. Get a free number from Google Voice if you live in the USA and have any other working number even if it's not text capable (such as a landline):
https://www.google.com/voice
Or from Pinger if you can get it to work:
http://www.pinger.com/content/home.html
Or Textnow if you can't:
https://www.textnow.com
All of these have a web interface you can use to make and receive texts.
As of 8-27-16 no longer applicable.

3. Download the Steam Desktop Authenticator from here:
https://github.com/Jessecar96/SteamDesktopAuthenticator

4. Use the above program and follow its steps to get your account protected by Steam mobile guard.

5. Wait the 7 days.

6. ???

7. Profit.