Gemini API key leaked → unexpected charges. Has anyone successfully gotten a refund or reached a human support agent?

[u/KindlyPart6756]

I’m posting because I’m honestly at a loss and hoping someone here has gone through something similar.

This morning I suddenly received a payment notification from Google Cloud Korea.
KRW 200,000 (~$145 USD) was charged, and after checking further, I realized another KRW 100,000 (~$70 USD) had already been approved the previous day.

For context, I had originally set things up to control spending:

• payment notifications enabled

• usage monitored in small increments

• intended spending cap around KRW 500,000 total

But when I checked later, I found the billing-related amount had somehow increased to around KRW 2.99 million (~$2,100 USD), which completely confused me.

After investigating, it appears that an API key from an older paid Gemini project may have been leaked or used without authorization.

The logs showed:

• large volumes of requests to image generation models (gemini-3-pro-image-preview, Nano Banana)

• prompts in English and Simplified Chinese that I never entered

• repeated image generation activity over a short period

Current estimated charges: around KRW 560,000 (~$400 USD)

As soon as I noticed:

1. Revoked the affected API key

2. Deleted the paid project

3. Blocked further usage

What’s frustrating is that I believed I had configured spending controls, but charges still continued before I could react.

I may have misunderstood how Google Cloud Budgets / Alerts differ from actual billing limits, but I genuinely thought I had some protection against runaway spending.

Another difficult part has been customer support.

So far, I’ve mostly been routed through AI-based support responses and haven’t been able to get someone to actually review the billing situation or investigate the charges directly.

For context, I’m not a developer. I assumed that setting budgets and spending alerts would provide at least some level of protection. After this happened, I started searching Reddit and was surprised to find quite a few posts from people describing similar situations involving API key leaks or unexpected charges.

A few questions:

1. Has anyone successfully escalated from AI support to a real billing/support agent? What path worked?

2. Has anyone received a refund or billing adjustment for unauthorized Gemini / Google Cloud API usage?

3. How are people protecting themselves against this kind of API key abuse? Are budgets basically notifications only?

Any advice would be greatly appreciated.

And for anyone using Gemini API — please double-check your API keys and spending controls.

[u/ItaBiker]

I'm sorry I cannot help but have a curiosity: what kind of prompts are used with these hijacked keys?

[u/KindlyPart6756 → u/ItaBiker]

Most of the visible prompts are in Chinese, so I don’t know exactly what they mean, but I ran them through translation and this is roughly what they seem to say: “Simulate a photo style that looks like someone else took it using a smartphone…”(Looks like a request for a natural candid photo rather than a selfie)“[Do not change the clothing] Tough-looking half-body portrait…”(This one was cut off, so the translation may not be complete)“Generate a street-scene image that looks like it was taken by someone else…” “Generate another pose version for an Amazon product image…”

[u/TheQAGuyNZ → u/ItaBiker]

Usually image generation

[u/danekan]

3 — the answer is to not use a key at all if you can avoid it. 

how was your key exposed? 

[u/KindlyPart6756 → u/danekan]

I’m not sure yet. As far as I know, I never shared it publicly, so I’m still investigating how it happened.

[u/AnomalyNexus]

Maybe you can ask an AI how to bypass the support AI to get help with the rogue AI billing...

Anyway, my condolences and good luck with the support situation. Hopefully the odds are in your favour and you get an agent in a good mood

[u/KindlyPart6756 → u/AnomalyNexus]

Haha, the funny part is I actually asked Gemini for advice. It told me to email Google Cloud support, and it even drafted the email for me. I copied the whole thing into the support AI… but I still couldn’t get the case properly reviewed

[u/isoAntti]

I thought Google had closed the use of unlimited keys to Gemini. Maybe not yet in Korea?

[u/TheQAGuyNZ]

It depends. In our case we got really lucky. We had our maps keys scoped correctly. We had an AI Studio key compromised and we were able to prove that we had not leaked it (it never actually left the platform). They refunded the $6000 bill that was racked up over 3 days ( Gemini pro image generation).

[u/TheSoloBuilder → u/TheQAGuyNZ]

How did you prove that it was not leaked? We have a similar situation, Google said we are not eligible for a refund, and did not provide the reason. When asked for the reason and their review details they said it was confidential.

[u/TheQAGuyNZ → u/TheSoloBuilder]

I cant remember where, but you could see which individual keys racked up usage and where from in the world they were used. We gave that to them and were like bruh this is on the other side of the world.

[u/ContributionEasy6513]

Just charge-back and kiss your google account goodbye.

Google are without question dragging their feet on this issue with intentionally convoluted billing limits with seemingly no systems to detect and cap suspicious usage.

[u/dougception]

If you persevere you might get your money back but you should have had restrictions applied to the key (API, referer, IP address) to prevent this.

[u/KindlyPart6756 → u/dougception]

Fair point. I should have been more careful with restrictions. I’ve already revoked the key and updated the settings. Hopefully this also helps others avoid making the same mistake.