Tech Insight : Could Your Technology Account Become A Blank Cheque?

Businesses using cloud computing, website hosting and other services charged by usage can face huge unexpected bills when someone else exploits their account or triggers costly activity, so what can they do to protect themselves?

How Does An Account Become An Open Chequebook?

With usage-based services, the bill depends on resources consumed, such as processing time, downloads, API requests or telephone calls. That flexibility lets businesses start small, but it also creates a financial risk if somebody else can generate chargeable activity.

Sometimes criminals steal access and order services through the victim’s account. In other cases, they repeatedly use a public website or form that costs its owner money each time it responds. Understanding that difference matters because securing the administrator’s password will not prevent every type of abuse.

Cloud Mining At Someone Else’s Expense

A real, documented example of this kind of threat is what reportedly happened to Digital River, a Minnesota-based e-commerce and payment processing company. Back in April 2025, former employee Joshua Paul Armbrust pleaded guilty to computer fraud after accessing its Amazon Web Services (AWS) account without authorisation.

US prosecutors said he used cloud computers to mine cryptocurrency (Ethereum) between December 2020 and May 2021, generating more than an eye-watering US$45,000 in costs for the company while receiving just over US$7,000 himself! As well as highlighting the potential scale of this threat, this case also shows how an attacker’s profit can be much smaller than the victim’s bill.

In another example from December 2021, a Missouri technology company received a cloud bill exceeding US$760,000! In the court case, prosecutors alleged that two defendants accessed its account and created servers for cryptocurrency mining. Reporting identified Microsoft Azure as the provider, although the official announcement didn't actually name it and, in fairness, those allegations aren't proof of guilt.

It should be noted here that these cases concern unauthorised use of customers’ accounts, rather than evidence that the providers’ entire platforms were breached.

When A Website Key Opens Another Door

Another way outsiders can run up a business’s bill is by copying an exposed API key, a digital identifier that lets software request services through its account. If the key gives access to more services than intended, someone could use it to generate charges without needing the account password.

For example, businesses may use Google Maps services to display maps or provide address searches on their websites. Some keys used for these features are visible in website code, making restrictions on what they can access particularly important.

Researchers at Truffle Security found that existing unrestricted Google API keys could also gain access to Gemini AI when it was enabled within the same cloud project. Someone copying a key from a website could therefore use it to make paid AI requests charged to the business.

In June 2026, a Brazilian tyre shop operator reported approximately US$14,000 in charges and pending charges after someone used an old website Maps key for Gemini requests. According to the owner, its normal Google Cloud bill was around US$44 a month. Those figures are customer-reported, but the mechanism described matches the weakness independently documented by Truffle Security.

Google subsequently took action, with the researchers reporting that Gemini began rejecting unrestricted standard keys on 19 June 2026. The wider lesson here is that adding a service can change what existing credentials allow, so businesses need to review permissions as their systems develop.

Public Traffic Can Generate Private Costs

Some services can generate unexpected bills simply because outsiders use them repeatedly. For example, if a business pays for each download, message or request, heavy automated traffic can drive up costs without anyone stealing a password or breaking into its account.

In February 2024, a Netlify customer reported a US$104,500 hosting bill following exceptionally heavy traffic to an MP3 file on a small website. Each download transferred data, allowing bandwidth charges to accumulate even though the website itself was relatively simple.

The charges were subsequently reported as waived, and Netlify confirmed that it waives charges related to distributed denial-of-service attacks, which overwhelm services with traffic. Although the public discussion in this case didn't conclusively establish who generated these downloads, the incident illustrates why businesses need to understand what happens financially when traffic rises unexpectedly.

The same principle applies to websites that send verification codes by text. For example, Twilio documents a practice called “SMS pumping”, where criminals repeatedly submit phone numbers to trigger messages, generating costs for the business and earning a share of the resulting revenue through arrangements involving the receiving network. This shows how a normal customer feature can become a way to run up charges, making controls on repeated requests just as important as account security.

A Warning Is Not A Spending Limit

One of the most important checks is whether a configured budget actually stops spending. For example, Microsoft’s Azure guidance says budget thresholds don't stop consumption, while AWS says budget information updates up to three times daily. An email warning should therefore not be treated as an immediate financial barrier.

Controls also change over time. For example, Google now documents spend-cap budgets for eligible services, separately from alerts-only budgets. Businesses should therefore check what a cap actually covers and how it operates, rather than assume that setting a budget prevents further charges.

Reducing The Opportunities For Abuse

Preventing these massive, unexpected bills starts with understanding how someone could generate charges through the services a business uses. Protecting account access is essential, but public website features and telephone systems may also need controls to stop repeated or expensive activity.

For administrative accounts, multi-factor authentication makes stolen passwords less useful, while promptly removing access when people leave reduces the risk of former staff retaining control. API keys need similar attention, with permissions limited to their intended purpose. Google’s Maps guidance recommends restrictions on both the applications that can use a key and the services it can access.

Where customers can request verification texts, businesses should limit repeated requests and enable fraud detection to help prevent automated abuse. Telephone services need their own restrictions, such as blocking premium-rate or international destinations that staff do not need to call.

Those restrictions are important because detecting unusual activity doesn't necessarily stop the bill growing. For example, UK provider Andrews & Arnold warns that stolen VoIP credentials can be used to make expensive calls and that its usage warnings don't automatically block further calling. Businesses should therefore check what their provider will actually stop, rather than assume an alert offers financial protection.

What Does This Mean For Your Business?

For businesses, the priority is to identify which services allow spending to grow and establish who will respond when usage looks wrong. Each account should have a responsible owner, with clear authority to investigate and suspend activity if necessary.

Stopping a website, telephone service or cloud application could interrupt work, so businesses should decide in advance when that disruption would be preferable to allowing charges to accumulate. Where automatic spending controls are available, test how they operate and make sure alerts reach someone able to act.

If suspicious usage appears, stop the relevant activity, revoke compromised access, preserve logs and contact the provider promptly. It's worth remembering that a waived bill in one case doesn't guarantee the same outcome elsewhere. The aim is to enjoy the flexibility of usage-based services while keeping control over who can generate costs and how far those costs can grow.