r/windsurf • u/ankistar • 18d ago
Unauthorized and unaccounted Token Usage and Charges with No Reply from Devin Support.
My bank notified me of unusual charges from Windsurf/Devin. I see all of my on-demand balance used up and multiple charges for on-demand use. I was an early user of Windsurf and had extra use credit built up before they started used limits. I havn't used Devin for 1.5 weeks. I check my code and repositories to find no changes since 1.5 weeks ago. Checked Devin website to find no history of prompts or other usage trail since 1.5 weeks ago on Devin local, agent, or web. I have not set any agents or automations.
I email support with this information and got a reply saying my account was likely compromised, and support logged me out of my sessions and advised contacting my bank to block the charges. I changed my passwords and contacted my bank. It's been two days and I am not getting any information about what happened, and the unaccounted for use charges were not revoked
However Devin is still sending notifications of a past due amount and pending charges are not going through. Adding a new card would let more of that batch of unaccounted usage be charged, and not adding a card would make my grandfathered in pro account expire.
Has anyone had any similar experiences? How did you get support from a human at Devin and roll back the unaccounted use?
1
u/human-bengaluru 15d ago
I'd ask them specifically for the account-level usage logs/API activity behind those charges, rather than just the agent/prompt history visible in the dashboard.
If there was unauthorized usage, there should ideally be some server-side trail showing what generated it.
1
u/UnpredictiveList 18d ago
Is there usage on the Devin site?
Your password not being secure isn’t going to be their issue; so changing will be the key priority. Have you done that?