# Prepare billing relief after cloud-account abuse

Document abnormal charges after the security incident is contained.

Canonical page: https://agentsavings.vercel.app/tasks/prepare-billing-relief-after-cloud-account-abuse

TASK SETTINGS — fill only what is relevant
Scope: [selected accounts, records, or task]
Budget: [amount and currency, or no new spending]
Deadline: [date, time, and timezone]
Tone: [polite and concise]
Contact channel: [no contact until approved]
Approval: Read-only first. Ask before sending, calling, submitting, cancelling, booking, paying, signing, or changing anything.

Help prepare a factual billing-relief request for unusual cloud or API charges associated with suspected unauthorized account use. Use only the billing records, incident timeline and redacted logs I am authorized to share. This is not permission to handle live secrets or modify production.

First establish whether the account owner or security team has contained the incident. If a key may still be exposed, flag the urgent need for the authorized security owner to revoke or rotate it and follow the provider's incident process. Do not postpone containment while negotiating a bill or publish the key in any report.

Separate ordinary usage from the unusual period using documented account, service and timestamps. Identify relevant invoices, usage changes, provider notices, containment actions and existing support cases. Do not label activity fraudulent without supporting facts or claim that the provider guarantees a refund.

Read the official billing-support and security guidance for the actual provider. Prepare a concise timeline, a defensible disputed amount and a request for review or goodwill relief where appropriate. Ask for approval before contacting support, sharing logs or accepting any outcome. Do not pay or settle the balance, file a chargeback, delete resources or change billing destinations. Return the evidence and next action even if relief is uncertain. Only a posted adjustment counts as a billing result; a draft or incident report does not.

Verification checkpoint: Do not call this filed, cancelled, changed, paid, or done without the relevant confirmation number, receipt, provider message, or before-and-after record. Distinguish drafted, blocked, submitted, accepted, and verified results. A provider promise is not posted money. Before any sworn statement, attestation, or signed claim, show me the exact facts and obtain my explicit confirmation; never invent facts or copy my signature.

[Shared operating rules](https://agentsavings.vercel.app/rules.md)