Will do, thanks for the advice. The only thing they did was validate the API count, but I was not disputing this, only that I made the calls.

The call volume itself looks suspicious. No calls for well over a year and then suddenly an incredible amount? You would think Google would have some algorithm to detect this?

Yeah exactly. But the key is not to say “lower my bill”, but rather “these charges aren’t mine”.

If they send it to collections you can dispute it. A lot of laws and things around that.

It sounds like it hasn’t been charged off yet though, since they want you to pay Google, not them.

I wish you luck. :)

Can you get any information about the party who stole your credentials? What were the domains and urls? What is the domain whois (probably private), their IP's? Where are they hosting? This information might help you make a case of fraudent abuse of your GCP account.

Will try to ask, seems unlikely they have tools out of the box for billing support to do this. I bet they have to have an SWE grep logs. Thanks for the advice!

Google doesn't have any burden of proof here. You're responsible for your api keys and any use that occurs with them.