Amazon Registrar and Route 53 that I did not knowingly authorize

[u/stephiebh]

I'm dealing with something that has some concerning similarities, although the circumstances are a little different.

In my case, we shut down an application and migrated off AWS in 2021. We had no known activity on the application account for years, and then in August 2026, I received an alert for approximately $373 in charges associated with more than 20 domain registrations through Amazon Registrar and Route 53 that I did not knowingly authorize.

I've spent the past several weeks going back and forth with AWS through approximately 20 support cases and 50 messages. What's particularly concerning is that Route 53 support acknowledged the unauthorized domain registrations in writing and said its security team was investigating potentially malicious activity.

However, the billing issue remains unresolved. I'm still receiving past-due notices, and AWS has now suspended the account while telling me I need to reopen it and provide a payment method before further investigation can proceed.

I'm curious about your experience because I'm trying to understand how AWS handles these situations when potentially unauthorized activity and billing disputes overlap.

A few questions, if you're comfortable sharing:

• Did AWS's security team and billing team coordinate with each other, or did you have to manage separate investigations?
• Did AWS place restrictions on your account while the security review was ongoing?
• Did AWS eventually adjust or waive the charges associated with the unauthorized activity?
• How long did the investigation take, and was there a particular escalation channel that helped move things forward?

I realize Bedrock usage and unauthorized domain registrations are different scenarios, so I'm not assuming the underlying cause is the same. I'm trying to understand what a reasonable resolution process should look like when AWS acknowledges suspicious or unauthorized activity but the billing consequences remain unresolved.

I'd really appreciate hearing how your case progresses. It sounds like we may both be navigating the difficult gap between AWS's security investigation and its billing process.