I just realized that you put the credit ID in the lightning invoice. Could you have a different reference ID; probably just keeping track internally of what credit ID equals what reference ID and simply have a different reference ID in the lighting invoice? Otherwise, depending on the circumstances, anybody who sees the lightning invoice also gets the credit ID.