Canva Shuts AI Credit Loophole After Scammers Harvest Tokens From Free Accounts
Synopsis
The fraud relied on seat cycling across Canva Business trials linked to Leonardo.ai, whose plans provided thousands of monthly AI tokens and rollover credits for generative AI tools.
Canva AI credit fraud has led the Sydney-based company to restrict access to Leonardo.After Business trial accounts were exploited several times to accumulate AI credits, and their ownership was transferred to gray-market resellers, business trial accounts were repeatedly used to collect AI credits and resell them on the gray market.
The scheme, referred to as seat cycling, involved taking advantage of separate allocations of credits to each eligible team member. This allowed the scammer to create new seats and transfer their credits to them, thereby completely emptying the accounts and allowing the cycle to continue with new seats.
How the Canva AI Credit Scheme Worked
Eligible Canva Business trial users received 8500 fast tokens per month and 25500 slow tokens per month on Leonardo Ai’s Essential plan.
These credits could be used to access generative artificial intelligence, including models from Leonardo Ai, Seedance (ByteDance), Veo (Google), Kling (Kuaishou), and other partners. Empty accounts containing thousands of tokens were then put up for sale on online forums.
Canva advised the publication that it had taken action to combat the abuse of accounts using AI, including those using fraudulent payment methods, and temporarily suspended Leonardo’s production access for business customers.
Canva’s AI Expansion Raises Cost and Abuse Risks
Canva expects to pay $320 million in 2024. The Australian company generates revenue of $3.5 billion for Leonardo.Ai in 2025 and reports 260 million monthly users as of 2025.
Recent public reports suggest that costs related to AI development have exceeded expectations and impacted the company’s financial performance. Canva revised its full-year revenue growth forecast in August 2026 to around 20% for the year, compared to about 35% annual revenue growth in 2025, due to higher-than-expected investment in artificial intelligence.
The broader technology industry faces similar challenges, with growing concerns about account abuse. According to internal research results released by Stripe in March 2026 and updated in May 2026, 7.4% of all customer account openings at AI companies were classified as multi-account abuse as of March 2026.
In May 2026, the figure was more than 1 in 6 account openings for AI companies on the network in Stripe.
The case of Canva illustrates the risk for businesses in Australia and the United States to provide users with free credits and tokens that can be withdrawn and resold on multiple accounts.
Source: InformationAGE
Pooja Malik is a business journalist with over six years of experience covering startups, entrepreneurship, and emerging trends. She has previously worked with leading media platforms such as YourStory Media and BW BusinessWorld, where she reported on business, policy, and market developments. Currently, she serves as Editor at The Inspirepreneur Magazine, where she writes and edits stories across business, lifestyle, and travel, with a focus on clarity, accuracy, and reader relevance.
