Cybercrime<\/p>\n
Left hand, meet right hand<\/p>\n
During a 48-hour period from June 7 to 8, developer Charles Jones’s Google Cloud account registered $11,089.77 in charges – most related to the use of Gemini image-generation models.<\/p>\n
Yet Jones, a solo developer who runs programmatic SEO and insurance sites, told The Register that he doesn’t have any workflow that generates AI images.<\/p>\n
Google suspended his account anyway. A suspension notification sent to Jones on June 7 justified the decision by stating his account “was engaged in abusive activity consistent with hijacked resources.” <\/p>\n
“The root cause was attributed to a compromised firebase-adminsdk service account key,” said Jones, who provided The Register with documentation of his exchanges with Google Cloud support.<\/p>\n
The notification advised Jones to report his concerns if he believed the account was compromised by a third party. He did so and took the steps required by Google to have his account reinstated. He disabled the service account and revoked the key.<\/p>\n
But the Google Cloud billing team has repeatedly refused to forgive the charges.<\/p>\n
As we reported previously<\/a>, complaints about charges arising from fraudulent API key usage among Google Cloud customers are not uncommon. In February, a developer based in Vietnam claimed that a Google Cloud API key compromise had resulted in more than $82,000 in charges over 48 hours<\/a>. A similar report claiming more than $10,000 in fraudulent charges surfaced a month later on Reddit<\/a>.<\/p>\n Regardless of where the fault lies \u2013 insecure practices by developers or insecure Google infrastructure \u2013 Google may choose to hold developers liable for unauthorized charges, even if the credit-card issuing bank has reversed the charge as fraudulent<\/a>.<\/p>\n At the same time, Google still hasn’t publicly released a mechanism to cap Google Cloud spending. The company introduced Spend Caps<\/a> for certain services as a private preview but hasn’t made the service generally available.\u00a0<\/p>\n Other cost-limiting measures, like API-specific usage limits<\/a> “aren’t designed to act as a project-wide spending cap.” Similarly, Budget Alerts<\/a> “don’t automatically prevent the use or billing of your services when the budget amount or threshold rules are met or exceeded.” Google provides a workaround<\/a> by allowing Budget Alert notifications to disable cloud billing, but warns that doing so means “resources might be irretrievably deleted.”<\/p>\n