Prepaid Credits Billing for SaaS and AI: Top-Up Consent and Expiry Law
Prepaid credits billing for SaaS and AI tools: capture the auto top-up consent Visa expects and set credit expiry terms that hold up under gift card law.
Photo: Pixabay
On this page 7 sections
- How Prepaid Credits Billing Works in SaaS and AI Products
- Choosing Between Credit Packs and Metered Billing
- Auto Top-Ups Are Merchant-Initiated Charges
- Can Prepaid Credits Expire? The Federal Rule Is Narrower Than Founders Assume
- Refunding Partly Used Credits: Spend Order Sets the Number
- Stolen Cards Turn Into Compute Bills
- Receipts and Descriptors a Finance Team Recognizes
Key takeaways
- A "send credits to a friend" button or a holiday gift campaign can bring reloadable credits under the federal gift card rule.
- With prepaid billing, a declined top-up just pauses service, so there is no reason to retry hard. Never retry a Visa Category 1 decline.
- If you spend bonus credits first, refunds are bigger, but they are easier to explain and defend. Whichever order you choose, disclose it before purchase.
Prepaid credits billing for SaaS and AI products works like a meter the customer fills in advance. They buy a pack of credits, your ledger deducts credits for each API call or generated image, and the balance is refilled by hand or by an automatic top-up. You collect cash before you pay for compute. In exchange, you take on problems a flat subscription never raises. Automatic refills are merchant-initiated charges with their own card network rules. Balances can fall under gift card law if you market them the wrong way. And a stolen card can become a GPU bill overnight.
How Prepaid Credits Billing Works in SaaS and AI Products
A customer buys a fixed pack with a one-time card charge. A conversion table sets what each action costs, so a large-model call might cost several times a small-model call. The ledger deducts credits as usage happens, usually through an API key with nobody clicking anything. A replenishment rule then decides whether the customer tops up manually or has agreed to automatic refills.
Unlike most digital goods, every credit spent has a real cost behind it: you owe your inference provider whether or not the card charge holds up. A stolen card that buys an ebook costs you one chargeback. A stolen card that buys a large credit pack, which a script drains overnight, costs you the chargeback plus the compute.
Choosing Between Credit Packs and Metered Billing
The billing model decides when you get paid and who carries the risk of unpaid usage.
| Model | How It Bills | Where It Fits | Main Risk |
|---|---|---|---|
| Prepaid credit packs | Customer pays, then uses credits | Spiky usage; products where unpaid compute hurts | Expiry and refund questions; large stolen-card purchases |
| Metered (postpaid) | Usage is measured and charged at cycle end | Business customers who expect an invoice | Unpaid usage after a decline; charges above card limits |
| Hybrid | Prepaid balance plus auto top-up or billed overage | Heavy users who can't afford an interruption | Merchant-initiated charges that need documented consent |
If you lean toward postpaid, our guide to usage-based billing and metering for SaaS covers that side. For credit packs, keep the menu short and say what a credit buys in plain terms. If larger packs include bonus credits, record purchased and bonus credits as separate ledger lines from day one, because the refund math depends on that split.
Your merchant account should also describe what you actually sell. Prepaid software credits differ from gift cards and game currency, and your merchant category code affects both interchange and risk review. Our explainer on how digital goods MCCs 5815 to 5818 change your fees explains why. Never ask for a code that misdescribes your business.
Auto Top-Ups Are Merchant-Initiated Charges
When your system charges a saved card because a balance dropped below a threshold, the networks treat it as a merchant-initiated transaction on a stored credential. The Visa and Mastercard stored-credential framework names this case directly: the Merchant Advisory Group's guide lists accounts that "automatically get refilled when the balance falls to a certain threshold" as unscheduled merchant-initiated payments. Those charges must carry indicators telling the issuer what they are. Most gateways set the flags for you.
The consent record is your job. When you first store a card, the framework requires an agreement covering four things: a truncated card number, such as the last four digits; how and under what conditions you'll use it; how you'll tell the cardholder about changes; and when the agreement expires, if it does. It has to be shown separately from your general terms. Visa has required this consent for newly stored credentials since October 14, 2017.
In product terms, auto top-up stays off until the customer turns it on. Before they agree, show the trigger threshold and refill amount, plus any daily or monthly cap. Let them switch it off from the billing page in a step or two, and send a receipt every time a refill runs. State automatic renewal laws can also reach recurring charges, so have counsel review the flow.
Worked Example: The Overnight Loop
Illustrative numbers. Assumptions: a customer's auto top-up charges $50 whenever the balance falls below 500 credits. A bug in their script burns through one $50 refill every 40 minutes, and nobody is watching between midnight and 10 a.m.
With no cap, that's 600 minutes ÷ 40 = 15 identical $50 charges, or $750, by morning. The issuer may start declining the string as suspected fraud, or the customer may dispute all 15. Either way, you've already paid for the compute behind every one of them.
Now add a rule allowing no more than three refills in 24 hours without the customer confirming. The most that can go through is $150. Service pauses and an alert goes out. The customer fixes the bug, and you've avoided 12 charges that would likely have become disputes.
When a Top-Up Declines, Pause Instead of Retrying
Visa sorts declines into four categories. Category 1 means the issuer will never approve the card; lost card (41), stolen card (43) and closed account (46) are examples. Any reattempt after a Category 1 decline counts as excessive and can draw fees, according to Payway's summary of the rule. Other declines are capped within a 30-day window: the April 2026 Visa Core Rules allow up to 20 reattempts, PayKings reports, though many processor help pages still say 15. Building to 15 keeps you inside either number.
Prepaid billing has an advantage subscriptions lack: a customer with no balance isn't consuming anything, so there's nothing to chase. Pause the service and ask for an updated card. Account updater and network tokenization for fewer failed renewals cut declines from expired or reissued cards before they happen.
Can Prepaid Credits Expire? The Federal Rule Is Narrower Than Founders Assume
Federal gift card law doesn't automatically cover every prepaid balance. Regulation E (12 CFR 1005.20) carries out the CARD Act's gift card provisions. For a covered card, funds can't expire for at least five years from purchase or the last load, and inactivity fees are allowed only after 12 months without use, at most one a month. But the rule is aimed at consumer cards bought primarily for personal or household use, and it lists exclusions that matter for software credits.
Two exclusions do most of the work. A product that is reloadable and not marketed or labeled as a gift card is excluded, and so is a promotional or loyalty card that carries the required disclosures.
Here's the part founders miss. The CFPB's official interpretation reads "marketed as a gift card" broadly: any direct or indirect suggestion that the product could be used as a gift for another person. The reloadable exclusion also depends on keeping policies reasonably designed to avoid that kind of marketing. A "send credits to a friend" button or a December campaign pitching credits as a present can pull a balance back inside the rule.
How common designs line up (general information, not legal advice):
| Credit Design | Federal Gift Card Rule | Why |
|---|---|---|
| Reloadable account balance, never pitched as a gift | Likely excluded | Reloadable and not marketed as a gift card |
| Credits bought by businesses for work use | Likely outside the definition | Rule targets consumer purchases |
| Bonus credits labeled "Promotional," expiry disclosed | Likely excluded | Promotional exclusion, if disclosures are made |
| Gift codes or transferable credits sold to the public | Likely covered | Marketed and used like a gift card |
State law is a separate layer and often stricter. California's Civil Code 1749.5 bans expiration dates on most gift cards, and Florida and Washington prohibit them too, with definitions that don't always match the federal one. Where expiration is allowed, state unclaimed property (escheat) laws may still require you to report unused balances and hand them over. Some companies book "breakage," value customers never use, as revenue, but the timing depends on redemption history and those escheat duties. Settle it with a CPA first.
The lowest-risk policy is simple. Purchased credits don't expire, or last a long time; only promotional credits expire, and they're labeled that way. Put the terms on the checkout page and repeat them on every receipt. Send reminders before anything expires, apply policy changes only to new purchases, and have an attorney check your terms against the states your customers live in.
Refunding Partly Used Credits: Spend Order Sets the Number
A published refund policy for unused balances holds up better than case-by-case calls. Our piece on whether "no refunds" holds up for digital products explains why a flat no tends to produce chargebacks.
Your ledger needs a spend order, and that one decision changes the refund. Illustrative example: a customer pays $100 for 10,000 purchased credits plus 2,000 bonus credits and has used 4,000 in total.
If bonus credits go first, the customer has used all 2,000 bonus credits and 2,000 purchased ones. The 8,000 purchased credits left are 80% of what they paid for, so the refund is $80. If purchased credits go first, they've used 4,000 purchased credits and have 6,000 left, so the refund is $60 and the bonus credits are forfeited.
Spending bonus credits first costs you $20 more here, but it's easier to defend and simpler to explain. Spending purchased credits first is legitimate too, if you disclose it before purchase. Either way, refund only to the original payment method and remove the refunded credits from the ledger at once. Before sending anything, check for an open dispute on the same charge so you don't pay twice.
Stolen Cards Turn Into Compute Bills
AI credits attract fraud because they convert quickly into resellable API access. The usual patterns are card testing with the smallest pack, large purchases minutes after signup, one card spread across many accounts, and swarms of new accounts farming free credits.
The controls that work all slow down an account's first few days. Cap pack sizes until there's payment history. Rate-limit new API keys so a stolen card can't be drained in an hour. Hold very large first purchases for review, and let customers rotate leaked keys instantly. Our guide to stopping stolen cards on digital goods covers the same playbook for license keys, and 3-D Secure 2 and fewer fraud chargebacks walks through authentication tradeoffs. MannyPay supports 3-D Secure authentication for online merchants. Fraud disputes count toward network monitoring programs, so watch your chargeback ratio thresholds as volume grows.
Receipts and Descriptors a Finance Team Recognizes
Many credit disputes aren't fraud. Teams often pay with a shared corporate card, so whoever reconciles the statement may never have used your product. Put the product name customers know in your billing descriptor rather than the parent company's legal name, and add a support URL or phone number where your processor allows it.
Every receipt should say whether the charge was a manual purchase or an auto top-up. For top-ups, include the trigger ("balance fell below 500 credits"), the credits bought with any bonus, the balance after purchase, and a link to switch auto top-up off. Those records double as evidence against subscription chargebacks in recurring billing.
Start with the overnight loop. Run the worked example against your own billing settings; if nothing stops the 15th charge, add a refill cap before you change anything else. MannyPay works with SaaS and software businesses and offers online payment processing for e-commerce and SaaS, along with payment gateways including Authorize.net and NMI. To talk through your credit model, request a free quote; a MannyPay specialist responds within one business day.
Sources
- 12 CFR § 1005.20, Requirements for Gift Cards and Gift Certificates (Cornell LII)
- CFPB, Regulation E § 1005.20 With Official Interpretations
- Blackgarden Law, A Guide for Businesses Selling Gift Cards Under the Credit Card Act's Gift Law
- Wrapped Gift Cards, Gift Card Expiry Laws by Country
- Purchy, Do Gift Cards Expire? 2026 State-by-State Legal Guide
- Legally Explained, Is It Illegal for Gift Cards to Expire?
- Merchant Advisory Group, A Guide to Visa and Mastercard's New Mandate for Stored Payment Credentials
- Chargeback Gurus, The Visa & Mastercard Mandate for Subscription Transactions
- Verifi, Visa's Stored Credentials Program
- Payway, Understanding Visa's Excessive Reattempts Rule
- PayKings, Visa and Mastercard Card Retry Rules
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
