fraud on azure

Create an Azure Billing support request immediately, describe the charges or subscription as unauthorized, and request investigation, cancellation of fraudulent usage, and review of the charges; Azure provides subscription-management support, including billing, without requiring a technical support plan.^1^

Contact Azure Billing Support

1. Sign in to the Azure portal.
2. Select Create a support request.
3. If the Support AI Assistant appears, select Switch to old experience.
4. Enter Billing, select Billing, and choose the affected subscription.
5. Select Create a support request at the top. Do not select a refund shortcut or suggested article.
6. Enter:
   • Summary: “Unauthorized Azure subscription/charges — suspected fraud”
   • The closest available Problem type and Problem subtype
   • When the activity started
   • The affected subscription and charge amounts
   • A statement that you did not authorize the resources, subscription, or usage
7. If recommended solutions appear, select Return to support request, then Next.
8. Under Additional details, select Phone for a callback or Email if you want a verifiable written contact trail.
9. Complete Review + create, then select Create.

This path is specifically used when an unexpected or fraudulent bill gets trapped in the portal’s suggested-solutions loop.^2^

You need Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission on the subscription to open its request. Account changes, ownership transfers, or cancellation may require the billing administrator.^1^

If the Azure account or subscription may be compromised

While the billing case is being created:

• Change credentials for tenant administrators and Azure RBAC owners.
• Enforce multifactor authentication for administrative accounts.
• Review Microsoft Entra sign-in activity and the Azure Activity Log.
• Identify unauthorized resources and prevent them from continuing to generate usage.
• Preserve invoices, charge details, activity logs, resource names, and timestamps for the support case.

Microsoft’s compromise-response guidance calls for securing administrator identities, investigating risky sign-ins and activity logs, removing unauthorized resources, and contacting Azure Support immediately.^3^

Do not delete evidence before recording relevant resource IDs, activity, and timestamps. If stopping or deleting resources could affect legitimate workloads, isolate the suspicious resources first and document them.

If the charge appears only on your card

If the transaction is absent from Azure invoices and Cost Management, do not trust phone numbers or links contained in texts, calls, or emails about the charge. Open the billing request through the Azure portal and select Email as the contact method if caller authenticity is a concern.^4^

Also contact the card issuer through the number printed on the card to report the unauthorized transaction and protect the payment method. Do not post card details, tenant IDs, invoices, or other private information in this public Q&A thread.

References

1. Create an Azure support request
2. I got an unexpected bill and I'm totally unable to contact support - Microsoft Q&A
3. Detect and respond to security alerts
4. Unexpected charges from azure - Microsoft Q&A