Steam and Itch.io use different payment processors, and neither one is a credit card company
Steam uses Valve's own payment system, which accepts credit cards, debit cards, PayPal, and regional payment methods through partnerships with processors like Stripe and local payment networks. Itch.io uses Stripe directly as its primary processor, along with PayPal. Neither platform is owned by or directly partnered with Visa, Mastercard, or American Express — those companies set the card standards, but the actual transaction handling goes through the processors I named.
The reason this matters: when your card gets declined, or you want to know whose servers hold your payment data, you're dealing with Valve or Stripe, not a credit card brand. The card company itself only sees that a charge happened; the processor is who actually moved the money and stored the details.
Key Takeaways
- Steam processes payments through Valve's own system, which routes credit cards through Stripe and other processors depending on your region and card type.
- Itch.io uses Stripe as its main payment processor, with PayPal as a secondary option for both buyers and creators.
- Visa, Mastercard, and American Express are card networks, not processors — they don't directly handle Steam or Itch.io transactions.
- If a charge is declined or disputed, contact the platform first (Steam or Itch.io support), then your card issuer if the platform cannot resolve it.
- Both platforms encrypt card data and use industry-standard security, but Stripe's involvement means your data passes through Stripe's servers during checkout.
How Steam handles credit card payments
Steam's payment system is built and operated by Valve, the company that owns Steam. When you enter a credit card on Steam, Valve doesn't store the full card number on its own servers. Instead, it tokenizes the card — meaning Stripe or another processor receives the card details, encrypts them, and sends back a token that Steam stores instead.
Stripe is the primary processor for most Steam transactions in North America and Europe. In other regions, Valve partners with local processors: for example, Boleto in Brazil, iDEAL in the Netherlands, or regional banks in China and Russia. This is why Steam sometimes offers payment methods you won't see on other platforms — Valve negotiates directly with local payment networks to reduce friction for players in each country.
When you add a card to your Steam wallet, Steam asks for your card number, expiration date, and CVV. That data goes to Stripe's servers, not Steam's. Stripe returns a token, and Steam stores only that token. If Steam's database were breached, attackers would get tokens, not usable card numbers.
How Itch.io handles credit card payments
Itch.io uses Stripe as its sole credit card processor. When you buy a game or pay a creator on Itch.io, your card information goes directly to Stripe, not to Itch.io's servers. Itch.io receives a confirmation that the payment succeeded, but never sees your full card number.
Itch.io also offers PayPal as a payment method. If you choose PayPal at checkout, Itch.io redirects you to PayPal's site, you log in and approve the charge there, and PayPal sends Itch.io a confirmation. Your card details never touch Itch.io's systems in that case either.
Because Itch.io is smaller than Steam and operates on a lower budget, it does not negotiate with regional payment networks the way Valve does. This means Itch.io offers fewer local payment methods — mainly Stripe (which accepts most cards globally) and PayPal. Creators on Itch.io who want to receive payments also use Stripe or PayPal; Itch.io does not issue payments directly.
Why the processor matters more than the card brand
When you use a Visa card on Steam, Visa's role is limited: it provides the network that connects your bank to the processor. Visa does not see your card number, does not approve the charge, and does not hold your data. Stripe does all three of those things. Visa only handles the routing and takes a small cut of the transaction fee.
This is why a charge can be declined even though your Visa card works everywhere else. Steam or Stripe might flag the transaction as unusual (a new device, a different country, a large purchase), and Stripe will decline it before it ever reaches Visa. Your bank never sees the request. Conversely, if Stripe approves a charge but your bank later disputes it, Visa's dispute system handles the reversal, but Stripe is who refunds the merchant (Steam or the creator).
For data security, the processor is also what matters. Stripe is PCI-DSS Level 1 certified, which is the highest security standard for payment processors. Valve, as the owner of Steam, is responsible for securing the tokens Stripe sends back. Itch.io relies entirely on Stripe's security because it never touches the card data itself.
What happens if a charge is declined
If your card is declined on Steam, the first step is to check Steam's payment page. Steam will usually show a reason: "card declined by bank," "incorrect CVV," "address mismatch," or "processor error." If the reason is clear (wrong CVV, wrong zip code), correct it and try again.
If the reason is vague or says "contact your bank," then Stripe flagged the transaction as risky and declined it before sending it to your bank. In this case, contact your bank and ask if they have any fraud alerts on your account. Tell them you are trying to make a purchase on Steam and ask them to whitelist the transaction. Then try again on Steam.
If the charge goes through on Steam but your bank later reverses it, Steam will lock your account until the dispute is resolved. You will need to contact Steam Support with proof that you authorized the charge (your email confirmation, your device, your account history). Steam will then work with Stripe to resolve the chargeback.
On Itch.io, the process is similar, except Itch.io's support team is usually smaller and slower to respond. If a charge is declined, try the same steps: check the reason, correct any obvious errors, contact your bank if needed. If a chargeback happens, contact Itch.io support with your order number and email.
Regional differences in payment processing
Steam's global reach means it processes payments in dozens of currencies and through dozens of local methods. In the European Union, Steam uses SEPA transfers and local debit schemes. In India, Steam accepts UPI and local bank transfers. In Japan, Steam accepts convenience store payments and bank transfers. None of these methods involve Stripe directly — Valve negotiates with local processors for each region.
Itch.io does not have the resources to negotiate with local processors. It relies on Stripe's global reach, which means Itch.io works in most countries but offers fewer payment options. If you are in a country where Stripe does not operate (a few nations under international sanctions), you cannot buy on Itch.io with a card. You can only use PayPal if it is available in your country.
This is a real limitation for some creators and players. If you live in a country where Stripe and PayPal are not available, you cannot sell on Itch.io or buy from most creators there. Steam, by contrast, has found workarounds for almost every country.
Security and data storage
Both Steam and Itch.io use HTTPS encryption, which means your card number is encrypted in transit — no one can intercept it while it travels from your computer to the processor's server. Both platforms also use tokenization, which means they never store your full card number on their own servers.
Stripe stores encrypted card data on its servers, but only if you choose to save your card for future purchases. If you do not save your card, Stripe deletes the data after the transaction completes. Steam's wallet system stores tokens indefinitely, so you can make purchases without re-entering your card each time. Itch.io does not offer a wallet; you enter your card details each time you buy.
If you are concerned about data storage, the safest option is to use PayPal on either platform. PayPal keeps your card details on PayPal's servers, not on Steam's or Itch.io's. Steam and Itch.io only store a token that links to your PayPal account. If either platform is breached, attackers cannot use that token to charge your card — they would need PayPal's systems, which are separate.
Frequently Asked Questions
Can I use a prepaid card on Steam or Itch.io?
Yes, most prepaid cards work on both platforms because they carry Visa or Mastercard branding. However, some prepaid cards are flagged as high-risk by Stripe and may be declined. If your prepaid card is declined, contact the card issuer and ask them to whitelist Steam or Itch.io transactions, or try PayPal instead.
Does Steam sell my card information to third parties?
No. Steam never sees your full card number. Stripe receives it, encrypts it, and sends Steam only a token. Valve's privacy policy states it does not sell payment data. Stripe's privacy policy also prohibits selling card data. Your information is used only to process your purchase and prevent fraud.
Why does Itch.io not accept as many payment methods as Steam?
Itch.io is much smaller than Steam and does not have the budget to negotiate with regional payment networks in every country. It relies on Stripe, which is global but offers fewer local options than Valve's direct partnerships. If you cannot use Stripe or PayPal in your country, you cannot buy on Itch.io.
If I dispute a charge on Steam, will my account be banned?
Your account will be locked until the dispute is resolved, but it will not be permanently banned if you can prove you authorized the charge. If you dispute a charge you actually made, Steam may ban you for abuse of the chargeback system. Always contact Steam support first before disputing with your bank.
Can I use a virtual card number on Steam or Itch.io?
Yes. Virtual card numbers (generated by services like Privacy.com or your bank) work on both platforms because they are treated as regular Visa or Mastercard cards by Stripe. Some banks also offer virtual numbers built into their apps. These are actually safer than using your real card number because the virtual number can be locked to a single merchant.