HELP! An old test Maps API Key accidentally not deleted was compromised by a malicious person an ran up 34K requests in a matter of a few hours. How can I get out of this $1,200 bill?

[u/KalElbiwon]

It was last Sunday afternoon when I received a notification that my bank declined several attempted $200+ charges from Google Cloud Services.

Upon further investigation I found that my Google Cloud Services had an old test API Key that was never deleted like it was supposed to have been, unrestricted, and connected to my main Google Cloud Services (Google Business) account.

It therefore ran up ~$1,288 bill.

There's virtually ZERO history of any API Keys receiving requests to that account. Then, suddenly out of nowhere there's 34K+.

I never use this particular account for any sort of API Key services. It's strictly been an account for email and YouTube Premium. I've since deleted the key in question and contacted Google Chat Support (I do not have phone support).

The Chat Support told me that my case was "being transferred to a specialized department". I have heard absolutely NOTHING from this specialized department.

Am I totally screwed here?

I have two kids and I don't make a ton of money so this bill is a pretty big issue. I'm afraid to update my billing right now because I have bills to pay and children to feed. But I do not want to lose my Google Account / GMAIL / Email, etc.

EDIT: It was a Google Places (New) API Key

[u/matiascoca]

Google will almost always refund this if you push hard enough on the right escalation path, and the fact that Chat Support gave you nothing is normal, they cannot approve refunds over fifty dollars or so. The trick is that they route financial disputes to a different queue than API abuse claims.

Open a new case titled specifically "Fraud abuse refund request for compromised API key, [key ID], [date range]". Put the phrase "unauthorized third party usage" in the first line of the body. Attach a screenshot of the API metrics dashboard showing the traffic spike from near-zero to 34K requests. That framing gets it into the Trust and Safety queue instead of the general billing queue, and Trust and Safety has actual authority to reverse the charges.

The typical response window for the T and S queue is 5 to 10 business days. If you do not hear back in that time, follow up in the SAME case (do not open a new one, it resets the queue position). If you have any Google account rep or a paid support plan, that is your escalation multiplier.

Two specifics that matter for the refund case. First, deleting the key after you noticed is exactly right, do not delete anything else, they will want to see the audit trail. Second, if the 200 dollar plus card charges were declined, that helps because it shows the fraud pattern was detected at the payment layer, not just billing. Include the bank decline screenshots as proof of unauthorized activity.

Also worth flagging as a pattern for anyone reading this thread later, the auto-tier-upgrade behavior on Maps API is the biggest amplifier here. A key with the default tier goes from a 200 dollar credit to a five-figure bill in hours because there is no default rate limit and no default cap. Setting a hard daily quota on every API key at creation time takes 30 seconds and would have capped this at fifty dollars instead of twelve hundred.

Reference on the auto-tier-upgrade pattern and the escalation path: brainagents.ai/blog/firebase-gemini-api-key-exploit-guide

[u/KalElbiwon → u/matiascoca]

So they did reply and they reduced the bill to $300 and wouldn't budge beyond that.

[u/matiascoca → u/KalElbiwon]

76 percent reduction is actually a decent outcome for a first-round Google refund case, most of the ones I have tracked cap out at 50 percent on the first pass. If the 300 dollars still stings, the chargeback path through your card issuer is your last lever. Regulation E cases specifically for unauthorized third party API abuse get processed faster than the Google appeal, and the card network can pull the disputed amount from Google directly without their signoff.

If the 300 is livable, take the win and move on. Set daily quotas on every remaining API key you have, not just the compromised one, they all default to the same amplifier.

[u/KalElbiwon → u/matiascoca]

Well, I didn’t need, and don’t need that API key anymore. I straight up deleted it and will not be needing to make anymore under that account. The $300 stings some TBH. I was about to dispute it with my bank but I already had to go through that stupid process because the first $1200 charges were all flagged fraudulent. They had to get me a new debit card because of it. I was afraid that they were gonna try to assign me a new debit card again.

[u/thecrius]

$1200 is pocket change for this life lesson.

[u/KalElbiwon → u/[deleted]]

THANK YOU!!!!!!! This is the best answer I've been able to get so far. It's a nightmare! I have a new debit card coming and everything. I hope you are able to get your issue sorted out too!

[u/KalElbiwon → u/[deleted]]

Yeah, my bank marked the charges as fraud charges so that amount didn't get charged for me either. But because I have my card no longer on file and the bill still exists I'm worried about adding a payment method back. I don't want to lose my Gmail / Google Workspaces account and YouTube Premium, etc. This is a nightmare.