# Stolen AI API key charges: can you get a refund?

URL: https://infro.io/blog/ai-api-key-theft-bill-refund
Author: INFRO Editorial (https://infro.io/blog/editorial)
Publisher: INFRO
Published: 2026-10-21
Last modified: 2026-10-21
Last reviewed: 2026-10-21 (next review due 2026-11-20)
Topic: Security and governance
Format: Guide

> Usually you are liable. OpenAI's, Anthropic's and Google Cloud's terms make the customer responsible for all activity under its account, including API keys, and require prompt notice of unauthorized access; none promises a refund for usage on a stolen key. Each provider has a support route for unauthorized activity, and any adjustment is at its discretion. Revoke the key, report it quickly with evidence, and rely on provider-side spend limits and scoped keys, which are the only protection you control. This is not legal advice.

Key takeaways:
- OpenAI's, Anthropic's and Google Cloud's terms each make the customer responsible for all use of its account, including its API keys.
- Each also requires you to notify the provider promptly of unauthorized access; a fast report is an obligation as well as your best chance of an adjustment.
- Refunds for stolen-key usage are discretionary and case by case; reported outcomes range from adjustments to repeated refusals.
- A chargeback through your bank is not a shortcut: Google documents that a disputed charge it disagrees with can leave your account with an overdue balance.
- Provider spend limits, scoped keys and IP allowlists are the only protection you control, and provider limits can lag by minutes.

**Will a provider refund charges from a stolen API key?** Not as a right. OpenAI's, Anthropic's and Google Cloud's terms each make the customer responsible for all use of its account, including use through its API keys, and none of them promises a refund for usage on a stolen key. Each has a support route for unauthorized activity, and any adjustment is the provider's decision, case by case. Revoke the key, report it quickly with evidence, and treat provider spend limits and scoped keys as your real protection.

> **Note**
> This is a summary of published terms and support pages for engineers and finance teams. It is not legal advice. Your organization may have negotiated terms that differ; read your own agreement and ask counsel.

## What the terms say

The language is close across the three providers: the account holder answers for what happens under the account, and must tell the provider when something goes wrong.

| Provider | Responsibility | Notification duty | Refunds |
| --- | --- | --- | --- |
| OpenAI (Services Agreement) | "Customer is responsible for all activities that occur under its Account" | "promptly notify OpenAI if it becomes aware of unauthorized access to the Account" | Fees "are non-refundable except as required by law or as otherwise specifically permitted"[1] |
| Anthropic (Commercial Terms) | "Customer is responsible for all activity under its account" | "promptly notify Anthropic" if the account "has been compromised" | Customer "is responsible for fees incurred by its account"[2] |
| Google Cloud (Terms of Service) | Responsible for "the security of its passwords for the Account (including any keys for Google APIs) and for any use of its Account" | "promptly notify Google of any unauthorized use" | No stolen-key provision; Gemini API postpay accounts follow the Google Cloud refund policy[3][4] |

OpenAI's own help center states the consequence directly: an exposed key "can allow unauthorized API usage through your account, which can result in charges"[5]. OpenAI's agreement also forbids customers to "buy, sell, or transfer API keys" with a third party[1], so a key you handed to an unvetted tool is not only a security question.

Read the notification duty as practical advice, not only an obligation. The sooner the provider knows, the sooner it can see the pattern, and the fewer hours of usage there are to argue about.

## What support routes exist

**OpenAI.** Delete the key in the API key dashboard, review usage and keep the details, then contact OpenAI Support by opening a chat on any Help Center page, including the activity you did not perform or authorize[5]. For a compromised account or key there is also an Unauthorized Activity webform with the option "Report unauthorized activity involving my account"[6].

**Anthropic.** Revoke the key in the Claude Console and create a new one; if you continue to see suspicious activity or have other concerns, contact the support team through the link in the help article[7].

**Google Cloud and the Gemini API.** Google's billing documentation is the most explicit. For charges after a compromise: secure the account, including rotating API keys; stop or delete resources you do not recognise; then contact Cloud Customer Care to report the compromise and discuss possible billing adjustments, which "Google Cloud reviews … on an individual basis". It also warns that you may still see charges for usage just before and after a suspension[8].

None of the three publishes criteria for when stolen-key usage is adjusted.

## What reportedly happened in real cases

Reported outcomes vary, and none of them is a precedent.

- **OpenCode Console, October 2026.** BleepingComputer reported that OpenCode's email to affected users mentioned the possibility of reimbursement, without details, and that users reported unauthorized charges from several hundred dollars to over $1,700[9]. That is OpenCode's own message about its own incident; it says nothing about what OpenAI, Anthropic or Google will do. [What OpenCode has said](https://infro.io/blog/opencode-console-breach-what-happened) is covered separately.
- **A Google Cloud account, June 2026.** The Register reported a developer charged $11,089.77 over two days, mostly on Gemini image models, after what Google attributed to a compromised service account key. Google suspended the account for "abusive activity consistent with hijacked resources", and the developer said its billing team repeatedly refused to waive the charges, citing its shared responsibility model; Google did not respond to The Register's questions[10].

Forums carry more stories in both directions. Treat them as anecdotes: the outcome depends on the provider, the evidence, how fast you acted, and decisions you cannot see.

## A chargeback is not a shortcut

Disputing the card payment with your bank can feel like the faster route. Google documents what happens: the bank treats it as a chargeback; if Google disagrees and the bank does not side with you, the charge stands; if Google disagrees and the bank sides with you anyway, "Your account will have an overdue balance"[8]. In other words, the chargeback moves money, but it does not settle whether you owe the provider, and an overdue balance on the account that runs your production AI is its own incident. The Register also reported that Google may hold developers liable even after a card issuer reversed charges as fraud[10]. Go to the provider first.

## How to make a request that can be assessed

If you ask for an adjustment, give support what it needs to separate your traffic from the attacker's:

- [ ] **The key**: its name or ID, project or workspace, and who owned it.
- [ ] **The timeline in UTC**: when the key leaked (if known), when you noticed, when you revoked it.
- [ ] **The usage you dispute**: a per-key usage export for the window, with the models, volumes and hours that are not yours.
- [ ] **Your normal pattern**: the same key's usage for a normal week, so the difference is visible.
- [ ] **How it leaked**, as far as you know: a public repository, a third-party tool, a log file.
- [ ] **What you have changed**: the replacement key, limits and restrictions now in place.

Do not overstate. If you cannot show where the key leaked from, say so.

## Why prevention is the only reliable protection

Every route above depends on someone else's discretion. The controls that do not are the ones you set before the leak, and the ones that matter most are at the provider, because a stolen provider key is used directly against the provider:

| Control | OpenAI | Anthropic | Google (Gemini API) |
| --- | --- | --- | --- |
| Hard spend limit | Organization and project hard limits; `429` when reached; "Enforcement is not instantaneous"[11] | Organization limit on the Billing page and workspace limits; `400` when a limit you set is reached[12] | Project spend caps, experimental; billing data can lag around 10 minutes and overages are possible[4] |
| Alerts | Spend alerts, which "do not enforce a cap"[11] | Workspace notifications | Cloud Billing budgets |
| Narrow keys | Project keys, restricted permissions, IP allowlist | Workspace-scoped keys with expiry | API and application restrictions |

Add the habits that make a stolen key worth less: one key per workload so you can revoke it without an outage, expirations, no keys in client code or shared tools, and usage watched per key. [LLM spend limits compared](https://infro.io/blog/llm-spend-limits-compared) goes through each limit's scope and lag in detail, and the runbooks for a [leaked OpenAI key](https://infro.io/blog/leaked-openai-api-key) and a [leaked Anthropic key](https://infro.io/blog/leaked-anthropic-api-key) cover the first hour.

> **Example: What a limit does to the worst case**
> A team's production Anthropic workspace usually spends a few hundred dollars a month. It sets a workspace spend limit at twice its normal month and an alert at its normal month. When a key from that workspace leaks, requests are refused once the workspace limit is reached; the team's argument with support is about a bounded amount, not about everything the attacker could run before the organization's tier cap.

## How INFRO handles spend on stolen keys

INFRO runs on provider accounts you connect and charges a software subscription; it is not part of the money flow between you and your provider, so it cannot refund or absorb provider charges. What it can do is limit traffic that goes through it: [budgets](https://infro.io/docs/org/spend-controls) per organization, project, member and gateway key are checked before the provider is called and refuse with `402` once spent, gateway keys can be limited to IP ranges, providers and one environment, and [spend alerts](https://infro.io/docs/observability/alerts) flag a day that departs from a scope's usual day.

Those controls govern traffic that goes through INFRO. A provider key stolen from anywhere, including from a platform like INFRO that holds customers' provider keys, can be used directly against the provider, and no INFRO budget sees that spend. The provider-side limits in the table above are the backstop. On the Business plan, with usage access on, [reconciliation](https://infro.io/docs/cost/reconciliation) compares OpenAI's and Anthropic's own usage per key with the traffic that passed through INFRO, which can show spend on your keys that bypassed the gateway.

## Summary

Under the standard terms of OpenAI, Anthropic and Google Cloud, usage on your account is your responsibility, stolen key or not, and you are expected to report unauthorized access promptly. Refunds are discretionary and case by case. Report fast, with a per-key timeline and evidence, go to the provider before your bank, and put hard limits and narrow keys in place so that the next stolen key has a ceiling you chose. This is not legal advice.

## Questions

### Do I have to pay for API usage from a stolen key?

Under the providers' standard terms, usually yes. OpenAI's and Anthropic's commercial terms make the customer responsible for all activity under its account, and Google Cloud's terms cover the security of keys for Google APIs and any use of the account. A provider may still adjust charges at its discretion. This is not legal advice.

### How do I report unauthorized OpenAI charges?

Delete the key, then contact OpenAI Support from a Help Center chat or use the Unauthorized Activity webform and choose 'Report unauthorized activity involving my account', with details of the activity you did not perform.

### Should I file a chargeback with my bank?

Talk to the provider first. Google documents that if it disagrees with a chargeback and the bank still resolves it in your favour, your account will have an overdue balance. A chargeback does not settle whether you owe the provider.

### Does a spend limit guarantee I will not pay more than the limit?

No. OpenAI says enforcement is not instantaneous and recorded spend can slightly exceed the limit, and Google's experimental Gemini project spend caps can overshoot while billing data catches up. A limit bounds the damage; it does not make it zero.

## Sources

1. Services Agreement — OpenAI. https://openai.com/policies/services-agreement/ (accessed 2026-10-21)
2. Commercial Terms of Service — Anthropic. https://www.anthropic.com/legal/commercial-terms (accessed 2026-10-21)
3. Google Cloud Platform Terms of Service — Google Cloud. https://cloud.google.com/terms (accessed 2026-10-21)
4. Billing (Gemini API) — Google AI for Developers. https://ai.google.dev/gemini-api/docs/billing (accessed 2026-10-21)
5. Keeping your OpenAI account secure — OpenAI Help Center. https://help.openai.com/en/articles/8304786-how-can-i-keep-my-openai-accounts-secure (accessed 2026-10-21)
6. I'm seeing unrecognized activity on my OpenAI account — OpenAI Help Center. https://help.openai.com/en/articles/8485685-im-seeing-unrecognized-activity-on-my-openai-account (accessed 2026-10-21)
7. What should I do if I suspect my API key has been compromised? — Anthropic Help Center. https://support.claude.com/en/articles/8384961-what-should-i-do-if-i-suspect-my-api-key-has-been-compromised (accessed 2026-10-21)
8. Resolve Cloud Billing issues — Google Cloud. https://docs.cloud.google.com/billing/docs/how-to/resolve-issues (accessed 2026-10-21)
9. OpenCode hack exposes API keys amid AI distillation attacks — BleepingComputer. https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ (accessed 2026-10-21)
10. Dev says Google warned him about account hijack – then charged him $11,000 anyway — The Register. https://www.theregister.com/a/5266234 (accessed 2026-10-21)
11. Spend limits — OpenAI. https://developers.openai.com/api/docs/guides/spend-limits (accessed 2026-10-21)
12. Rate limits — Anthropic. https://platform.claude.com/docs/en/api/rate-limits (accessed 2026-10-21)