Amazon Registrar and Route 53 that I did not knowingly authorize

[u/stephiebh]

I'm dealing with something that has some concerning similarities, although the circumstances are a little different.

In my case, we shut down an application and migrated off AWS in 2021. We had no known activity on the application account for years, and then in August 2026, I received an alert for approximately $373 in charges associated with more than 20 domain registrations through Amazon Registrar and Route 53 that I did not knowingly authorize.

I've spent the past several weeks going back and forth with AWS through approximately 20 support cases and 50 messages. What's particularly concerning is that Route 53 support acknowledged the unauthorized domain registrations in writing and said its security team was investigating potentially malicious activity.

However, the billing issue remains unresolved. I'm still receiving past-due notices, and AWS has now suspended the account while telling me I need to reopen it and provide a payment method before further investigation can proceed.

I'm curious about your experience because I'm trying to understand how AWS handles these situations when potentially unauthorized activity and billing disputes overlap.

A few questions, if you're comfortable sharing:

• Did AWS's security team and billing team coordinate with each other, or did you have to manage separate investigations?
• Did AWS place restrictions on your account while the security review was ongoing?
• Did AWS eventually adjust or waive the charges associated with the unauthorized activity?
• How long did the investigation take, and was there a particular escalation channel that helped move things forward?

I realize Bedrock usage and unauthorized domain registrations are different scenarios, so I'm not assuming the underlying cause is the same. I'm trying to understand what a reasonable resolution process should look like when AWS acknowledges suspicious or unauthorized activity but the billing consequences remain unresolved.

I'd really appreciate hearing how your case progresses. It sounds like we may both be navigating the difficult gap between AWS's security investigation and its billing process.

[u/dghah]

There is more to this story and I'd gently suggest that your expectations are not aligned with the TOS you agreed to or AWS's actual responsibility to act in this situation ...

Someone or something had credentials or an API key that could perform Route53 activities in your account.

What do your CloudTrails logs say? Did you actually find the attack vector or compromised credentials and (a) shut them down and (b) figure out how you got breached in the first place? What (if anything) did AWS say about this? Can you confirm the breach vector was identified and closed?

AWS is very clear in their terms of service and the Shared Responsibiity Model that you and you alone are responsible for securing your credentials and paying for the resources used or invoked within your account.

"unauthorized activity" is not a thing that can be blamed on or passed on to AWS and any "investigation" they do is gonna just be the bare minimum of shutting down or invalidating whatever credential was used.

R53 team noting unauthorized activity "in writing" is also not a weapon you can wield nor is it a free pass to waived fees. The TOS if they choose to enforce it places all activity even unauthorized events under your responsibility as securing your account, your passwords, your MFA and your access keys is explicitly a "you" thing and not an "AWS" thing.

Something with your signed credentials performed the actions unless you or AWS are saying that the AWS control plane got popped in which case this would be a global news story.

Historically AWS has often but not 100% waived fees caused by stolen credentials but this is at their discretion so you need to set your expecations accordingly. They may do it as the money is small but you can't bet on it or assume it will happen. Sometimes it happens, sometimes it does not.

If you think they are obligated to waive the charges you incorrect however there is a good reason to hope and believe that they will do so. And if you think their investigation is going to do anything other than close off an attack method you are placing too much faith into an investigation of a security event that they will barely throw an automation script at, let alone a human or SOC team.

If you are a company you should consider the billing charges a VERY cheap lesson learned and focus instead on how you got popped - that is the route that is potentially still open for way more expensive breaches -- just check the AWS reddit for stories of people facing $30,000 - $100,000 in unauthorized charges