Neither is perfect, but it's hard to do worse than "you have to be logged in with an account associated with your payment details".