Posted October 23, 2016

But now a question. Will Steam revoke this game at some point if it turns out the key was somehow stolen? And how would they find out? And if it is revoked, can I still get my money back since I paid with PayPal?
If the code is linked to illegal money, then the clawback process will start. For example in the case of a credit card, the card owner would see a transaction they didn't make and complain to the card company. The credit card company will refund the owner of the card, then go after steam to get the money back off them. When that happens you can be damn sure steam will send that downstream and claw the game back off you. This kind of answers your other question of how they would find out, it's because someone would take that money back off them.
So in all of this, given that the criminals have got their cash and run off, there's a long game to see who gets left holding the baby, and everyone is geared up to make sure it's you. G2A will certainly have covered themselves in the T&C to make sure it's not them (so no refund) otherwise they wouldn't still be running.
Having said all this, one easy way to be sure that a key definitely is dodgy, is to see if the game has ever been on sale for less than the price of the key. If it hasn't then, barring the odd freebie someone might get along with a new graphics card, there's no way that person could legitimately be making money from that trade, and if there are hundreds of purchases from them, they either buy a lot of graphics cards, or are dodgy as hell.