Yeah, that was my first thought too, but the card was already expired, and a scammer would probably have known that immediately without testing (since they presumably need the expiry date as well as the card number to charge anything).

I've had mini-charges like these from other cloud providers, too, but then I could confirm the reason for it (some sort of storage I'd missed while deleting the instances).