For more than a year, my card has been charged both my legitimate AWS bill of about $0.83 per month and a separate recurring charge of roughly $60–$80 that never appears in my AWS invoices or Cost Explorer. The unexplained charges now total more than $1,000.
After comparing my card statements with my AWS billing history, I opened a support case and provided the statements, invoice history, and the first six and last four digits of the card. Support said they identified the AWS account associated with the larger charges, but they would not disclose its details or remove my card because of account-privacy rules. They said they contacted that account holder and suggested I check other email addresses, but I do not have another AWS account or email address.
Support ultimately told me to dispute the charges with my credit card company. My first dispute was rejected because I had not included supporting documentation, so I resubmitted it with the card statements and AWS billing records. It is currently pending, but I would prefer to stop the charges at the source rather than repeatedly dispute them.
I am considering moving my legitimate AWS payment method to another card and asking my credit card company to block future charges from AWS, or replacing the compromised card entirely. Is there a better way to sever the unknown account's connection to my card, and what is the best way to recover the money already charged?
3 Answers
There may be billing arrangements where usage from one account is charged to another account, such as requester-pays services or third-party products billed through AWS. That could explain why the charges do not appear in your own Cost Explorer, although an account compromise is also possible. Either way, AWS may be unable to reveal the other account’s information, so the card issuer is likely the only party that can permanently cut off the payment method and recover the funds.
Continue working through the credit card dispute and provide a clear timeline showing that the charges do not appear in your AWS account invoices, that AWS identified a different account, and that you did not authorize its use. The card issuer—not AWS—usually has the practical ability to reverse the transactions and prevent future authorization attempts.
If you believe the card is being used by someone you do not know, treat the card as compromised. Ask the issuer to replace it, dispute every unauthorized transaction, and request that the old account number not be migrated to the replacement card. A merchant block can help, but replacing the card is usually more reliable. Keep copies of the statements, the billing records, and the support correspondence for the dispute.
That is what I am doing now. The first dispute was denied because I did not attach documentation, so I resubmitted it with the statements, invoice history, and the information AWS requested.