I've been charged $321.80 every month for the past seven months, but I only recently noticed the payments. I briefly used Amazon Web Services for a class several years ago, though I haven't knowingly used any AWS services since then. When I sign in to the account I remember using, I don't see active resources or billing activity that explains the charges. I understand AWS may be able to trace the payments using the transaction number from my credit card statement, but reaching the right support team has been difficult. How can I determine whether these are charges from an old account or fraudulent transactions, and what steps should I take to stop them?
3 Answers
An old resource may have continued running after the free tier ended, especially if it was created for a class. Sign in to every AWS account you may have used and check the billing dashboard, invoices, linked payment methods, and the region-by-region list of active resources. If nothing matches, open a billing support case and include the transaction dates, amounts, and the reference number from your card statement.
AWS billing support is the best route if the payment is legitimate but tied to an account you can’t locate. Ask them to search using the exact transaction reference and merchant descriptor from your statement. Keep records of each case and payment while your bank investigates, since the charge may belong to a different account or organization than the one you originally used.
If the charges don’t appear in any account you control, treat them as potentially unauthorized. Contact your card issuer immediately, dispute the recurring payments, and ask whether the card should be replaced or have the merchant blocked. Also secure any AWS accounts you find by changing passwords, enabling multifactor authentication, and checking for unfamiliar users or access keys.
I’m leaning toward replacing the card because I haven’t noticed other suspicious purchases, but these AWS charges are the only ones I can’t explain.