Steam’s Credit Card Check Locks Debit Adults From R18+ Games

Steam now blocks Australian users from R18+ store pages unless a local credit card sits on the account. The prompt arrived with the September 9, 2026 deadline for age checks on app stores, and it was still the only official door through September 12.

The lock is easy to misread as a Valve morals test. It is an eSafety code being enforced through a payment token that many adult players do not carry, while a teenager with a parent’s card still has a path.

A Credit Card Between You and R18+ Steam

Open the store page for an R18+ title on an unverified Australian account and Steam stops you before the trailer, the price, or the reviews. The client cites the Age-Restricted Material App Distribution Services Code and then names one fix.

Valve is required by the Age-Restricted Material App Distribution Services Code to verify that you are 18 or older before accessing mature content. If you wish to do so, please add a valid Australian credit card to your account and afterwards update the Mature Content Preferences.

Steam account prompt, Australia

PayPal is not enough, because a PayPal wallet can sit on a debit card issued to someone under 18. A long-running Steam account does not skip the step, including logins that are older than some of the people trying to use them. The card is meant to stay stored, even if you never buy with it, and Mature Content Preferences still need a manual update after the card clears.

Players have hit the wall on Cyberpunk 2077, Doom Eternal, DOOM: The Dark Ages, Resident Evil Requiem, and Alan Wake II. GTA Online, Red Dead Redemption 2, and Baldur’s Gate 3 sit in the same rated band. The block is a storefront gate, not a disc in a drawer. Search, recommendations, and the product page all go dark until the account is marked adult.

September 9 Was the App Store Deadline

Australia did not invent this rule in the same week the Steam prompt appeared. Parliament passed the Online Safety Act in 2021. Industry groups then drafted Age-Restricted Material Codes, which eSafety registered in June and September 2025 after deciding they offered community safeguards. The codes are mandatory. A breach of a direction to comply can draw penalties of up to $49.5 million per breach.

eSafety Commissioner Julie Inman Grant framed the package as bringing offline age bars online. She said children are kept out of bars, bottle shops, adult stores, and casinos, and that the same kind of barrier had been missing from the places they actually spend time.

We don’t allow children to walk into bars or bottle shops, adult stores or casinos, but when it comes to online spaces where they are spending a lot of their time, there are no such safeguards.

Julie Inman Grant, eSafety Commissioner, 6 March 2026 media release

eSafety research put numbers on the exposure the codes target. Around 10% of children have accidentally found online pornography by age 10, and that share climbs to almost 30% by 13. Two in five young people said their first look happened while they were searching for something else, including a gaming site. Under the codes, users must complete some form of age assurance to access R18+ games classified by the Australian Classification Board. Titles below that rating do not need the extra check.

THE DATES THAT PUT STEAM ON THE CLOCK

1. December 10, 2025: Age-restricted social platforms must take reasonable steps to keep Australians under 16 off accounts.
2. March 9, 2026: Age-Restricted Material Codes become mandatory for app stores, gaming services, social platforms, and related providers.
3. June 27, 2026: Logged-in search engines must have age checks in place.
4. September 9, 2026: App distribution services must check age before an R18+ download, the deadline Steam’s new prompt cites.

The same FAQ that lists those dates also lists methods that count as appropriate age assurance: photo ID matching, facial age estimation, credit card checks, digital identity wallets, a parent confirming age, and AI estimates from other data. eSafety told adults they would keep access to legal adult content, with proof of age that is accurate, fair, reliable, and run by the service, not by the government. Steam picked one item from that list and made it the whole door.

Debit Cards Cover Almost Half of Everyday Payments

The people this gate actually sorts are not only children. They are adults who pay with their own money. The Reserve Bank of Australia’s 2025 Consumer Payments Survey, written up by Scott Kim and Michael Reschke in the May 2026 Bulletin, is blunt about how the country buys things. In that diary sample, debit cards accounted for 49% of payments. Credit and charge cards accounted for 23%. Cash was 15%. All cards together were 73% of payments, a line that does not need to be added up from the two card types because of rounding.

HOW AUSTRALIANS PAID IN 2025

• Debit share: 49% of consumer payments in the RBA diary, more than triple the debit share recorded in 2007.
• Credit share: 23% of payments on credit and charge cards, down from 26% in the 2022 survey.
• Low-income gap: Households in the lowest income quartile used credit for about 8% of transactions, while the highest quartile used credit for over one-third, more than four times that share.
• Younger payers: People aged 18 to 29 put about 80% of their payments on cards, the most card-heavy age group in the survey.

The RBA also noted that lower-income households lean on debit and cash, and that debit’s rise reflects a preference for spending money already in the account rather than borrowed funds. That is the hidden queue at Steam’s gate. A student, a new migrant, or anyone who has avoided a credit line is asked to take on a product they have spent years not wanting, just to read a store page. Younger buyers, the same 18-to-29 group that already lives on cards, are the cohort least likely to hold the specific card Steam wants.

A credit card in Australia is an 18-and-over product issued after a lender checks the applicant. That is why Valve can treat the card as an age token. It is also why the token maps so poorly onto a debit country. The code asked platforms to keep children out of R18+ catalogues. The method Steam chose keeps out adults who never borrowed.

Extra Doors on Epic, Xbox and Discord

Other stores facing the same September deadline did not bet the catalogue on a single card product. Epic Games Store told Australian players they would need to prove they are 18 before buying or downloading R18+ titles from September 9, with games already owned left alone. Checks run through Epic’s Kids Web Services stack: a Yoti selfie for age estimation, a Stripe card path that authorises five cents without a charge, a Veriff pass on a government ID, and a ConnectID bank check due later in September. Xbox began its Australian rollout in late August and offered email, a face scan, a card, or a government ID. Microsoft said apps and games already owned would not be cut off.

HOW THE BIG STORES CHECK AGE IN AUSTRALIA

Discord is not a store, but it is the other large gaming hangout already running Australian age checks. From December 9, 2025, Australian accounts got a teen-by-default setup, with age-gated spaces locked until an adult check. Discord’s path is facial age estimation or a form of identification handled by k-ID, with ID images deleted after the check and the status hidden from other users. That is a different privacy trade than storing a credit card as a payment method. It is still a door that does not require a credit file.

Valve’s bet is the opposite trade. No selfie. No passport upload. No third-party face vendor. The cost of that choice lands on people who refuse, or cannot get, a credit product. Epic and Xbox accepted more vendors so a player without a credit line could still pass. Steam did not.

Britain Already Lived This Credit Card Check

The Australian prompt is not a new design. On August 29, 2025, Steam put UK users through the same card ritual to comply with the Online Safety Act. Valve’s support page for that market still says a UK account stays age-verified for as long as a valid credit card is stored. Ofcom had listed credit-card checks as a highly effective measure because a UK card is an adult product. Valve then spelled out the debit problem in one line: debit cards do not qualify for age assurance, because they can be issued to minors.

The company also said keeping the card on file is meant to deter people from sharing one Steam login. In the UK it argued that among the age checks it reviewed, the card path kept the most user privacy, because the data looks like any other stored payment method and does not tell a bank which games you want. That argument travelled. Australia got the same token, the same “keep the card” rule, and the same cold shoulder for debit, even though eSafety’s own method list is wider than Ofcom’s credit-card example.

Britain had already shown the social shape of the fight. Plenty of adult players there live on debit. Plenty of Australian players do too. Copying the UK tool into a market where debit is the everyday card was a predictable mismatch, and it arrived on the day the app-store code came due rather than with a local FAQ that named a second method.

What Happens to Games You Already Own?

The scare line is that R18+ libraries go dark. That is not what the storefront is doing. Games already paid for still launch from the library. The cut is at discovery and checkout. Without a passing card, you cannot open the R18+ product page, you cannot buy the next 18+ title, and in some clients you cannot even stare at the shop listing for a game you already finished.

WHAT STILL WORKS, AND WHAT STOPS

• Owned copies: R18+ games already in the Steam library still launch without a new card check.
• Store pages: Unverified accounts cannot open R18+ listings, including pages for games already owned.
• New buys: Checkout for a fresh R18+ title stays closed until a qualifying Australian card is stored and preferences are updated.
• Lower ratings: Games below R18+ do not need this extra age step under the codes.

That split matters for anyone staring at a sequel, a season pass, or a new campaign in a series they already play. Cyberpunk 2077 can still boot. The store page that sells the next bit of it may not. The same pattern will sit in front of every future R18+ release on Steam in Australia, which is how a compliance step becomes a permanent two-speed catalogue: verified adults on one side, everyone else looking at a blank wall.

Workarounds have already shown up around the edges. Some players have added a virtual card, let Steam place a tiny authorisation hold, then killed the virtual number so a token remains on the account without a living credit line. Others have bought keys from third-party shops that are not Steam. Neither path is a Valve option, and a key from elsewhere still leaves the official store page locked. The prompt’s own logic is simple. If a card product can prove adulthood to the payment network, Steam will treat the account as adult. If it cannot, the shelf stays closed.

The Bank Flag Behind Working Debit Cards

Steam’s on-screen text says credit card, and that is the method Valve is willing to document. In practice the check is running through card networks that can return a yes-or-no adult flag without handing Steam a date of birth. That is why the debit story is messy instead of binary. User tests have had Mastercard debit from Commonwealth Bank, Westpac, and Macquarie go through, while cards from Bendigo, St George, Revolut, ANZ, and most Visa debit have failed. Treat that list as a snapshot of early tests, not a bank-by-bank ruling. The pattern underneath it is stable. A debit product the issuer has marked as adult-only can look like a credit card to the check. A debit product that is also issued to minors cannot.

Banks and schemes become the silent age office. Valve does not see a passport. eSafety does not see the transaction. The issuer that already decided whether you were old enough for that piece of plastic now also decides whether you can browse DOOM. Players who picked a bank for fees, not for Steam, find out after the fact that their everyday card is the wrong flavour of plastic.

That is a crude fit for a code that listed half a dozen methods and promised adults they would keep lawful content. A face scan, a licence, or a bank identity wallet would still exclude children. They would not force a debit-only adult to open a credit account to read a store page. Valve has reasons to hate those other methods, and it said so in Britain: more personal data, more vendors, more chance of a shared login. The Australian prompt just imports that preference and lets the local card mix do the damage.

Through September 12, Australian users were still posting the same wall. Valve had not published an Australian help page that named a second check, and eSafety had not carved Steam out of the app-store duty. The catalogue that remains is the one a credit card, or a debit card a bank has quietly flagged as adult, can open.