Picture a familiar scene inside a growing digital agency. A critical Google Ads campaign stops mid-launch because the payment method was declined. The operations manager opens the billing settings and finds no corporate client profile and no enterprise billing agreement. The primary payment method is the agency founder's credit card, added during onboarding three years ago. The backup card belongs to a marketing director who left the client's company six months ago. The domain behind the campaign's landing page is set to auto-renew on a card that has since expired.
This article calls that tangle mixed billing liability: the payment method, the account owner and the person who gets the failure notices are all different people, and nobody has mapped who is who. It is easy to create and hard to see until something breaks.
Here is what mixed billing looks like in practice, why it hurts, and how to run a "Whose Card Is It Anyway?" Audit to fix it. The audit covers mapping payment responsibilities, moving cards to the right owners, using virtual cards where the agency must pay, and writing a fallback protocol into your contracts.
What Actually Happens When a Payment Fails
Platforms differ in how they handle a failed payment, and the differences matter for how much risk you carry.
Google Ads. Google's billing and payment suspension policy lists three triggers: an unpaid balance, suspicious payment activity, and a chargeback. For unpaid balances, Google says it may suspend an account if it has concerns about future payments because of payment method issues or declined payments. The same page says that accounts related to a suspended account, for example those sharing an email, a payment method, or a manager account, will also be suspended. A single bad card can therefore take down more than one client.
Meta. Payment problems are commonly cited among the reasons Meta restricts or disables ad accounts. Third-party recovery guides also warn that repeatedly retrying a failed payment can look like fraud. Treat that second point as practitioner advice, not Meta policy. Either way, you want a valid backup payment method in place before anything fails.
Domains. An expired card on a domain auto-renewal does not make the domain disappear immediately, but the safety net is thinner than most people assume. Under ICANN's Expired Registration Recovery Policy, registrars may offer an Auto-Renew Grace Period of 1 to 45 days, but they are not required to. After a registrar deletes an expired generic TLD name, the registry must offer a 30-day Redemption Grace Period. During that period the name stops resolving and cannot be transferred, and restoring it usually costs more than a normal renewal. Country-code TLDs follow their own rules.
The Hidden Costs and Risks of Mixed Billing
1. The financial float and uncollected spend
When an agency puts ad spend, hosting or software subscriptions on its own card and plans to invoice the client later (pass-through billing), the agency becomes an unsecured lender. If the client disputes an invoice, pays late or becomes insolvent, the agency still owes the card issuer. The larger the client's monthly spend, the larger that exposure.
Management fees are separate from this float. Agency pricing guides commonly cite 10% to 20% of monthly ad spend for percentage-based management, while other agencies charge flat retainers. Either way, the fee covers the work. It does not cover the agency taking on the client's credit risk.
2. Personal card exposure and cascading failures
Founders and account managers often put a personal card on a client account "just to get it running" during an urgent launch. Over time, that card gets attached to ad networks, domain registrars, hosting platforms and software subscriptions.
This creates two problems:
- Departures. When someone leaves, their card often stays on file. If the card is cancelled, expires or is disputed, every service attached to it can fail at once.
- Chargebacks. Google's policy says a chargeback on a legitimate Google Ads balance can lead to account suspension, and related accounts can follow. A cardholder disputing a charge on a card that funds ads can therefore freeze the account, and possibly its neighbors.
3. Payment method and account owner are different things
On most platforms, the party who pays and the party who owns the account are two separate attributes. Audits go wrong when people treat them as one. Some examples:
- Google Ads: A client account has a paying manager, which can be the client or an agency's manager account. You can see it under Billing, then Settings. Google also supports a "Change who pays" process for moving billing between payers or agencies.
- Shopify: A client store can be built in a partner account and transferred to the client. Shopify says that when a development store's ownership is transferred, the partner's credit card or PayPal account is automatically removed from the billing settings. The client must supply their own billing information. The partner can then keep collaborator access.
- Domains: The registrant of record and the card paying for renewal are often different people. Fixing only one leaves a gap.
Step-by-Step Guide: Running the "Whose Card Is It Anyway?" Audit
Step 1: Discover and catalog every client asset
Build a central Payment & Asset Inventory Matrix. Ask account leads, media buyers and developers to list every active client asset in five categories:
- Ad networks: Google Ads, Meta Ads Manager, LinkedIn Campaign Manager, TikTok Ads, Microsoft Advertising.
- Infrastructure and hosting: AWS, Google Cloud, Vercel, WP Engine, Cloudflare, Liquid Web, Webflow.
- Domains and DNS: GoDaddy, Namecheap, Squarespace Domains (formerly Google Domains), Network Solutions.
- MarTech and SaaS subscriptions: HubSpot, Klaviyo, Zapier, Typeform, Semrush, ActiveCampaign.
- Creative and plugin licenses: premium WordPress plugins, Canva, stock media accounts.
Payment asset inventory template
| Client | Asset / platform | Card (last 4) | Cardholder and entity | Auto-renew | Billing admin email | Account owner | Risk |
|---|---|---|---|---|---|---|---|
| Acme Corp | Meta ad account | x-4102 | Agency founder (personal card) | On | billing@agency.example | Client | Critical |
| Acme Corp | Domain registrar | x-8819 | Former CMO (client) | On | former.cmo@acme.example | Client | High |
| Acme Corp | Klaviyo | x-1120 | Acme corporate card | On | ops@acme.example | Client | Compliant |
Add a column for the renewal date and billing cycle so the same sheet doubles as your renewal calendar.
Step 2: Audit auto-renewals and expiration schedules
The most common failure is the "silent renewal." For each domain, software license and annual agreement, record:
- The exact renewal date.
- The billing cycle (monthly, quarterly or annual).
- The payment method linked to that specific line item.
- Who receives the billing and renewal emails.
Also check for accounts where the primary card is the client's but the backup card quietly reverts to an agency card. That is mixed billing in its sneakiest form.
Step 3: Flag high-risk billing patterns
Classify every asset into one of three levels:
- Critical (red): A personal card of an agency founder or employee is live on a client-owned account, or an unknown or former employee's card is active.
- Moderate (yellow): The client's card is active but billing notices go to an agency staff member, or the card expires within 90 days.
- Compliant (green): The client's corporate card is primary, billing contacts are client-owned, and the agency has access through partner or manager tools (for example Google Ads manager access or Shopify collaborator access).
Note a special case: an agency that is deliberately the paying manager on Google Ads, for example under monthly invoicing, is a legitimate arrangement but a different risk profile. The agency is then the payer. Google's "Sequential Liability" setting names the advertiser as a secondary payer if the agency does not pay the invoice. Decide that on purpose, and put it in the contract. Do not drift into it.
Standardizing Payment Architecture: Best Practices for Agencies
There are two defensible models. Pick one per asset and write down which.
| Model | When it fits | Who carries payment risk |
|---|---|---|
| Direct client billing | Ad spend, hosting, domains, most SaaS | Client |
| Invoiced pass-through | Small tools, bundled retainers, reseller arrangements | Agency, so it needs controls |
1. Make direct client billing the default
- Ad accounts: Have clients enter their own payment details in Google Ads, Meta and TikTok. Agencies work through manager accounts, partner access or business-portfolio sharing. After setup, check the paying manager or payment owner shown in each platform's billing settings.
- Domains: Register domains under the client's legal business name with the client's contact email and payment method.
- Hosting and cloud: Be careful with AWS Organizations. Every organization has a management account that pays the charges of all member accounts, so a client's workload in your agency's organization is billed to you. If the client should pay, have them create their own AWS account and give your team cross-account access. AWS also offers billing transfer, which lets one management account manage and pay another's consolidated bill, but that is for deliberate reseller-style setups.
- Shopify: Build stores in a partner account, then transfer ownership to the client. The client supplies billing and you retain collaborator access.
2. Use client-specific virtual cards when the agency must pay
If you must pay for tools, media or hosting on a client's behalf, avoid a shared physical card. Spend-management platforms such as Ramp, Brex and Mercury offer virtual cards with configurable controls, though the feature sets differ. Ramp, for instance, documents vendor-specific virtual cards with spending limits, expiration dates and merchant restrictions. Check whichever provider you choose for the following:
- One card per client, so an incident or offboarding affects one client only.
- Spending caps with headroom. A cap set exactly at the budget can decline a legitimate charge and cause the very failure you are trying to avoid.
- Expiration dates tied to the end of the contract term.
- Merchant restrictions where supported, so a card meant for one vendor cannot be charged elsewhere.
3. Use partner programs where they fit
- Shopify: As described above, transfer the store and keep collaborator access.
- HubSpot: Clients pay HubSpot directly. HubSpot says solutions partners earn a 20% commission on deals they source, and its commission FAQ says commissions are paid based on what the customer pays HubSpot. Unpaid client invoices therefore affect your commission, but not your card.
Designing Fallback Payment Protocols
Even with direct billing, payments fail. Cards expire, fraud filters trip and billing emails go unread. Define what happens next before it happens.
Primary payment fails
|
v
Billing alert reaches agency and client contacts
|
v
Stage 1: Client updates card or uses secondary card on file
| (if unresolved)
v
Stage 2: Defined resolution window (for example 24 hours)
| (if unresolved)
v
Stage 3: Agency pauses affected campaigns or services per contract
Protocol checklist
- Require a primary and a backup payment method on every client-owned billing portal.
-
Route billing notices to a shared alias such as
client-billing@youragency.example, plus a named client contact. Forward that alias into a team channel, and set it up before any card fails. - Define a resolution window in the contract (for example 24 hours) after which you may pause campaigns on the failing account. Do not quietly cover the gap with agency funds.
- Check card validity quarterly. Confirm that every card has at least 90 days of life before peak periods such as Black Friday and Cyber Monday campaigns.
- Do not retry failed payments repeatedly. Fix the underlying cause first. Repeated declines can look like suspicious activity to ad platforms.
Contractual Protections and Legal Safeguards
Update your Master Services Agreement (MSA) and Statements of Work (SOW) so that payment ownership is explicit. The sample language below is a starting point only. Have a qualified attorney adapt it to your jurisdiction and your agency's actual practices.
1. Direct third-party expense clause
"Client agrees to maintain valid payment credentials directly on all third-party platforms used to deliver the Services, including advertising networks, domain registrars, hosting providers and software services. Agency is not obligated to advance funds or use Agency payment methods for Client expenses. If Agency agrees in writing to pay a third-party expense on Client's behalf, Client will reimburse Agency [within X days of invoice / by prepaying the estimated monthly amount before launch], plus any agreed handling fee."
2. Right to pause for payment failure
"If a payment method on any Client-owned account is declined and not corrected within [24] hours of notice, Agency may pause affected campaigns or services until the issue is resolved. Agency is not responsible for lost revenue, campaign performance effects or domain expiration resulting from payment failures on Client-controlled payment methods."
3. Offboarding and credential migration
"On termination, Agency and Client will complete a billing and credential handoff. Client will replace any Agency-held credentials or payment methods on Client accounts within [ten (10)] business days of notice, after which Agency may remove its payment methods without liability for resulting service interruption."
Action Plan: Executing Your Audit This Week
| Day | Task |
|---|---|
| Day 1: Inventory | Compile the Payment Asset Inventory Matrix from billing portals, accounting records and your password and access records. |
| Day 2: Flag risks | Mark every founder, employee or former-contact card on a client platform. |
| Day 3: Client outreach | Send clients a short request with steps to add their own corporate cards and backup cards. |
| Day 4: Migration | Remove agency and personal cards. Issue capped virtual cards for any pass-through expense you will keep. |
| Day 5: Governance | Update MSA templates, adopt the fallback protocol, and set a quarterly review. |
Summary checklist for agency leadership
- Catalog every ad account, domain, hosting plan and SaaS tool across all clients.
- Record the paying party, the account owner and the billing contact for each asset.
- Remove personal cards belonging to current or former staff.
- Confirm each client-owned account has a primary and a backup card.
- Move cloud workloads into client-owned accounts, or accept the payer role deliberately.
- Issue dedicated virtual cards with limits and expiry dates for any pass-through expense.
- Route billing alerts to a shared inbox and a client contact.
- Update your MSA with payment-ownership, pause and offboarding clauses, reviewed by counsel.
Auditing "whose card is it" is dull work, but it prevents a bad week. When every asset has a named owner, a named payer and a named person who receives the failure notice, a declined card becomes a routine task and not a client-facing outage.
Originally published at https://instarenewal.com/blog/the-whose-card-is-it-anyway-audit-untangling-mixed-billing-responsibilities-in
Top comments (0)