My Azure account had roughly $10,000 in promotional credits. While I was hospitalized, I received unexpected one-time-password emails that I did not act on. When I checked the account later, I found approximately $550,000 (about ₹5 crore) in charges accumulated over 9–13 days, apparently from unauthorized Claude usage purchased through Azure Marketplace.
I did not create or approve these deployments. I have disabled the resources and contacted Azure Support, but the initial support representative said they had not yet identified confirmed fraudulent activity. I am a college student with only my name and a debit card attached to the account, and I cannot afford anything remotely close to this amount.
Has anyone dealt with unauthorized Azure Marketplace charges at this scale? How are these cases investigated, and can the bill be reversed or waived if the activity is confirmed as account compromise? Could the marketplace provider as well as Microsoft be involved? What billing, fraud, or security teams should I contact, and what evidence should I preserve?
5 Answers
Immediately secure the account: remove unfamiliar users and role assignments, rotate passwords, API keys, secrets, and service-principal credentials, review MFA methods, revoke active sessions, and disable every unrecognized resource or deployment. Cancel or replace the attached debit card through the bank and notify the bank that the charges may be unauthorized. Do not delete logs or resources until support confirms they have captured what they need.
Preserve evidence before changing anything that might erase useful history. Export Azure Activity Logs, sign-in and audit logs, billing details, Marketplace transaction records, resource and deployment histories, OTP emails, and screenshots showing the unexpected workloads. Also record your hospital documentation and the exact dates and times. Contact the Marketplace publisher as well as Microsoft, since the usage may involve both the cloud billing channel and the publisher's service.
A charge this large is likely beyond what ordinary customer service can resolve on the spot, so keep requesting a written escalation and billing investigation. Whether anything is waived depends on the provider's investigation, account terms, security findings, and possibly the Marketplace agreement; nobody in a forum can guarantee the outcome. Because the amount is enormous, consider speaking with a qualified lawyer or consumer-protection adviser, and do not admit liability or agree to a payment plan before understanding your position.
Going forward, set spending alerts, budgets, quotas, and deployment restrictions wherever Azure supports them, and check activity regularly. Those controls may not erase the current bill, but they can limit future exposure. Most importantly, get medical help if the stress is affecting you—this situation needs to be handled through documented support and professional advice, not by risking your health.
Open an urgent billing and security support case and clearly describe it as suspected account compromise and unauthorized Marketplace consumption. Include the full timeline, the unexpected OTP messages, your hospitalization, when you discovered the charges, and every action you took afterward. Ask for escalation to the account-compromise and billing-dispute teams rather than relying only on general support. Save the case numbers and all written responses.
I contacted support, but the first response was that they had not identified confirmed fraud. I am gathering the timeline and asking for a formal escalation.