One Card, Ten Ad Accounts: Why Platforms Read That as Fraud
The setup nobody decided on
Most teams run every ad account off one company card. Nobody chose it. It happened because getting a card used to take a week and a signature, so the card became a shared resource and everything was pointed at it.
It works. Right up until the account gets restricted, and then it fails everywhere at once.
What the platforms actually say
This is not a theory about risk scoring. TikTok's own Business Resource Centre states it plainly: one card used across multiple Business Managers or payment profiles matches known fraud patterns. Their recommended fix is a dedicated card per account.
Read that again, because the implication is uncomfortable. The pattern is not "suspicious if combined with other signals". The pattern *is* the signal. Your intent is irrelevant — fraud systems match shapes, and your shape is identical to the shape of someone farming ad credits across throwaway accounts.
The same logic runs on every major platform. They differ in thresholds and in how loudly they tell you, not in the principle.
Three failures that arrive together
Everything stops at once. A shared card is a shared failure. When it gets blocked, ten campaigns pause in the same hour, usually the hour you are not watching.
You cannot attribute spend. Your statement shows one line per platform charge, with no account attached. Want to know what a client or a project actually cost? Open each ads manager and add it up by hand, then reconcile a total that never quite matches the statement.
Removing one person means reissuing for everyone. Anyone who ever attached the card has seen the number. Revoking one person's access means killing the card and re-attaching a new one to every account — while campaigns are live.
All three come from the same root: the card is scarce, so it is shared. Change the scarcity and all three go away.
The boundary that matters
More cards is not automatically better. Cards should follow a boundary of responsibility, and in practice there are three worth using:
- Per ad account — the direct answer to the fraud-pattern problem. If you only pick one, pick this.
- Per person — each operator owns their own limit. Good when one person runs several small accounts.
- Per client — agencies get clean cost reporting with no manual splitting.
Pick one and hold it. Mixing all three recreates the original mess with more moving parts.
Limits are the other half
Splitting cards without setting limits does half the job. The limit answers the only question that matters after a leak: *what is the maximum we can lose here?*
A workable rule: set the limit to that account's budget for the period, plus a small buffer. An account running $8,000 a month gets a $9,000–10,000 limit. Loose enough that one heavy day does not pause the campaign, tight enough that one exposed number does not reach the other eleven accounts.
Do not set the limit to your full balance. That turns every card back into a key to the whole vault, which is the thing you were trying to stop.
Migrate one account at a time
The one real risk in this change is doing it all at once.
Every ad platform wants to see a successful charge before it treats a payment method as settled. Swap ten accounts in an afternoon and you have created ten simultaneous points of failure, on a day when your payment history looks unusual to every fraud system watching.
Move one account, let it run through a full billing cycle, then move the next. Slower, and it never produces a bad week.
The test
Here is the question that tells you whether your current setup is fine:
Someone leaves this afternoon. How long until their card stops working?
If the answer is measured in days, or involves a phone call to a bank, or requires re-attaching cards for people who had nothing to do with it — the problem is not your offboarding process. It is that you only have one card.
