The Register36%
Dev says Google warned him about account hijack – then charged him $11,000 anyway 45%
By Thomas Claburn37%
7/2/2026, 11:08:16 PM
BS Summary: This article contains 24 faulty reasoning types, including Burden of Proof, Appeal to Authority, and Unattributed Quote, with Negativity Bias as the most egregious example at 40% saturation with 277 hits. Analysis detected 1,720 faulty-reasoning hits from 692 analyzed words, generating a BS Score of 47.8% and a BS Rank of 45% (11,728 of 21,230 articles). This article is better (less manipulative) than 55.20% of the article peer group.
During a 48-hour period from June 7 to 8, developer Charles Jones's Google Cloud account registered $11,089.77 in charges - most related to the use of Gemini image-generation models.
Yet Jones, a solo developer who runs programmatic SEO and insurance sites, told The Register that he doesn't have any workflow that generates AI images.
Google suspended his account anyway.
A suspension notification sent to Jones on June 7 justified the decision by stating his account "was engaged in abusive activity consistent with hijacked resources."
"The root cause was attributed to a compromised firebase-adminsdk service account key," said Jones, who provided The Register with documentation of his exchanges with Google Cloud support.
The notification advised Jones to report his concerns if he believed the account was compromised by a third party.
He did so and took the steps required by Google to have his account reinstated.
He disabled the service account and revoked the key.
But the Google Cloud billing team has repeatedly refused to forgive the charges.
As we reported previously, complaints about charges arising from fraudulent API key usage among Google Cloud customers are not uncommon.
In February, a developer based in Vietnam claimed that a Google Cloud API key compromise had resulted in more than $82,000 in charges over 48 hours.
A similar report claiming more than $10,000 in fraudulent charges surfaced a month later on Reddit.
Regardless of where the fault lies – insecure practices by developers or insecure Google infrastructure – Google may choose to hold developers liable for unauthorized charges, even if the credit-card issuing bank has reversed the charge as fraudulent.
At the same time, Google still hasn't publicly released a mechanism to cap Google Cloud spending.
The company introduced Spend Caps for certain services as a private preview but hasn't made the service generally available.
Other cost-limiting measures, like API-specific usage limits "aren't designed to act as a project-wide spending cap."
Similarly, Budget Alerts "don't automatically prevent the use or billing of your services when the budget amount or threshold rules are met or exceeded."
Google provides a workaround by allowing Budget Alert notifications to disable cloud billing, but warns that doing so means "resources might be irretrievably deleted."
In March, Google introduced project spend caps for the Gemini API as an experimental feature, but at the same time the company said that spend caps have a 10 minute delay and customers are responsible for spending during that period – so the company's definition of cap is rather flexible.
What's more, Google said its system "now automatically upgrades you to the next [usage] tier as your usage grows and your payment history matures."
And higher tiers raise spending caps.
This all means it can still be a challenge for Google Cloud customers to avoid unbounded financial obligations in the event of an account or API key compromise.
Escaping that responsibility requires engaging with Google customer service in an opaque appeals process in which the company isn't required to demonstrate customer negligence or an audit trail.
"Here's a question I can't get answered, and I think it's central to the whole pattern," Jones said.
"Google's Trust & Safety was quick to alert me that a service account key was compromised — but I have been given no route, anywhere, to see HOW or WHERE that key was actually exposed.
There is no trace, no log path, no forensic detail offered."
Jones said he was the only person who had access to the VM where the compromised key resided and he insists that he followed the company's recommended security practices.
"So how does a single-access VM produce a leaked service account key — and why is the burden on me to prove I secured something Google itself can't (or won't) show me how I failed to secure?
Google is invoking its Shared Responsibility Model to deny the refund, but that model assumes a customer security failure Google has never demonstrated."
The Register twice asked Google why it would deny a refund and what evidence it has that supports that decision.
We've not heard back.
®
Speakers
3speakers51%attributed speech337writer words
Voice mapSelect a segment to jump to its words
Selected voice
96%flagged-word coverageCharles Jones
206 attributed words58% of attributed speech91% writer coverage
Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.
Loading…
Loading…
Loading…
Loading…
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.