Hi all,
I’m posting here because I’m in the middle of a confusing and stressful billing situation, my support case is open and Google is investigating, and I’m hoping people in this community who have been through something similar can share what they’ve learned. I’ll lay out the timeline as clearly as I can.
April 30, around 11pm IST. I received an email from google-cloud-compliance@google.com titled “Immediate action required: Your project is being suspended.” The body stated that my project was “engaged in abusive activity consistent with hijacked resources.”
Looking at the dashboard, my April 30 spend was around ₹28K - higher than usual, but I had been actively using the API that day on my project. Realistically my usage that day should have come out closer to ₹15K or below, so the gap was a bit more than I’d expected, but not so far off that I immediately suspected something external. I assumed I had unoptimized loops or something I could explain, and submitted an appeal on May 1 in good faith describing my heavy usage that day.
My account was reinstated soon. I was relieved and assumed everything was fine, maybe the suspension had been a false positive triggered by my elevated usage. I did not rotate keys at this point, partly because I assumed if anything had genuinely been compromised, the reinstatement flow would have flagged that or required key rotation. In hindsight, I wish I had rotated everything proactively. That’s one of the things I’d want other developers reading this to take away.
May 4. At EOD, I opened the billing dashboard and saw ₹8,31,807.77 accumulated in roughly a 2-hour window on that day itself. The Cost Anomaly dashboard captured it as:
- Actual cost: ₹831.8K
- Expected cost: ₹2.92K
- Deviation: >1000%
- Top contributor SKU: Generate_content image output token count for Gemini 3 Pro Image — ₹445.7K actual vs ₹1.77K expected on that single SKU
- Region: global
I deleted my API keys immediately to stop further charges. In retrospect I should have grabbed request-level logs first, but I panicked. I’ve asked support for the audit trail since Google has the logs on their side.
I opened a billing chat with Google Cloud Support. The agent confirmed the ₹8.3 lakh charge from my account, and then mentioned that “a lot of users are seeing a spike in the usage for the Gemini API services” and that an internal team is working on the issue. She told me my case is now under investigation and that I’ll receive an update by email. I appreciate that the case has been logged and is being looked at, and I want to give the investigation a fair chance to run.
In parallel, I’ve taken a few protective steps on my side: I blocked the credit card to prevent any pending charges from settling while the investigation runs (separately, around ₹1.5 lakh from earlier had already settled on the card before I blocked it). I’m also planning to file an FIR with the cyber crime cell, given that this is documented unauthorized access with substantial financial loss and the FIR creates a parallel legal record while the platform-side investigation is ongoing. I want to be clear that I don’t see these as adversarial steps against Google — they’re just necessary self-protection while the case works through the system, and I think most developers in this situation would do the same.
Why I’m posting here
I’ve been reading similar threads on this forum from the last 2–3 weeks and noticing what looks like a pattern — unauthorized Gemini API charges, sometimes via Firebase-provisioned keys, sometimes after a suspension/appeal/reinstatement sequence, often with the Gemini 3 Pro Image SKU as the major contributor. The support agent’s note that this is affecting many users matches what the forum is showing.
I’d genuinely value input from this community on a few things:
- Has anyone been through this kind of charge dispute and gotten a refund? I’d love to hear what worked — what evidence helped, how long it took, whether escalation past first-line support was necessary.
- For anyone who went through a suspend → appeal → reinstate sequence and then saw a second incident: what did you do differently the second time? Should I have rotated keys after reinstatement even without being asked to? It feels obvious in hindsight but I don’t think it’s documented anywhere.
- For Indian developers specifically: has anyone here filed an FIR for an API key abuse case? Any advice on how to frame it, which sections to cite, whether the cyber crime cell engages meaningfully with platform-side cases?
- For Google staff who monitor this forum: is there any guidance on the right escalation path for cases of this size? I’m currently working through the standard billing support flow but I’d appreciate any pointer on whether there’s a more appropriate channel for charges in this range.
- More general: is there anything I should be doing right now that I’m not? I want to make sure I’m handling this responsibly while the investigation runs.
If this thread can also help other developers understand the ways API keys can be abused on this scale, and the protective steps to take (key restrictions, hard budget caps via the Cloud Billing API rather than just budget alerts, key rotation after any suspicious-activity flag) — that would be a positive outcome too.
Evidence on hand
I have screenshots of: the April 30 suspension email, the May 1 appeal-received confirmation, the Cost Anomaly dashboard with the SKU-level breakdown, and the support chat. Happy to share with Google staff or with anyone in the community trying to triangulate the pattern (with my account identifiers redacted).
Thank you to anyone who reads this and shares advice or experience. I’ll update this thread as the case develops.
