$13,946 in unauthorized Gemini API charges — Google's own Trust & Safety flagged the project, billing review concluded "no evidence of abuse"

Gemini API
, ,
1

Small Polish company running a live taxi dispatch service on GCP. Posting here because this
case contains a direct internal contradiction I cannot resolve from the outside, and the July
billing period is invoiced in about a week.

What happened — 10 July 2026, all times UTC

  • 01:05–02:35: 1,041,183 requests to generativelanguage.googleapis.com in 90 minutes
    (~193 rps, ~33% errors consistent with sustained rate limiting). $13,946.00. Breakdown:
    940,369 GenerateContent, 62,548 StreamGenerateContent, 18,832 CreateCachedContent,
    18,505 DeleteCachedContent, 929 BatchGenerateContent. Traffic before and after this window
    is effectively zero.
  • Metrics Explorer (serviceruntime.googleapis.com/api/request_count, resource
    consumed_api, grouped by credential_id): 100% of that volume came from one service
    account    . That account held exactly one IAM role, roles/dialogflow.client, which
    confers no permission on generativelanguage. It was created following Google’s own
    Dialogflow setup docs for an evaluation ~18 months ago and never used afterwards. It was
    never part of our Gemini calling path.
  • The paired 18,832 CreateCachedContent / 18,505 DeleteCachedContent calls are deliberate
    context-cache management by an automated client — not a misconfigured app of ours.
  • Google stopped the traffic, we didn’t. It ceased abruptly at 02:35 with the automated
    quota reduction. Notification reached us at 03:15 — forty minutes after the incident had
    already ended. We were asleep throughout. Our first remediation action appears in the audit
    log at 07:31.
  • Admin Activity shows no CreateServiceAccountKey events at all, and no SetIamPolicy or
    other administrative action by any principal other than our owner account, in every case
    from our own IPs. One leaked credential, no project takeover.

The contradiction

Google opened security case 73119898 on 10 July at 03:09 UTC stating our project “may have
been compromised and used for violations of the Google Cloud Terms of Service (section 3.3C)
and Gemini API Terms of Service, such as unauthorized reselling or model distillation on AI
Studio”, warned of suspension within 24 hours, and reduced our quotas on that basis. Access
Transparency logs record Google Support reading our Security Command Center findings, our
project IAM policy and the gcp.restrictServiceUsage org policy at 03:06–03:07 UTC that
morning, under case 72951659.

The internal billing review then concluded that “no evidence of abuse or unauthorized
activity exists” and denied the claim.

For scale: the last eight invoices on this billing account, covering all our projects, were
$230–$346 per month. Gemini spend in the affected project was $37 in April, $34 in May, $72 in
June. The disputed amount is roughly 42x the largest invoice this account has ever produced.

We submitted a full re-review on 30 July with the credential attribution and IAM evidence
above, extracted from Google’s own audit logs. None of it was in front of the first reviewer —
our own initial description of the account name was inaccurate, which may explain why the
first review found nothing.

What I’m asking for

  1. Security cases 73119898 and 72951659 formally linked to the billing dispute, so the
    reviewer has to address Google’s own compromise determination.
  2. The disputed amount placed on standstill in writing while the case is open.
  3. Review before the July period is invoiced (around the fifth business day of August). A
    credit in the open period is far simpler than a correction afterwards.
  4. A technical explanation of how a principal holding only roles/dialogflow.client was able
    to consume $13,946 of Generative Language API capacity. Whatever the mechanism, it is not
    one we had any lever to restrict — the account was already scoped to the single role its
    purpose required.

Project 466025146.. (taxi-copilot-433707). I can supply the Metrics Explorer exports per
credential_id and per response_code, and complete Admin Activity and Access Transparency
extracts, to anyone at Google who can act on this. Happy to join a call.