URGENT: Billing Dispute & Invoice Write-off Request – Compromised Tenant Tenant ID / Invoice Case [Moderator note: Personally Identifiable Information removed]

Question

URGENT: Billing Dispute & Invoice Write-off Request – Compromised Tenant Tenant ID / Invoice Case [Moderator note: Personally Identifiable Information removed]

Kiyan Y 0

Dear Microsoft Billing Support Team,

I am writing to provide the exact, concrete details of the hacker's activity regarding the fraudulent ₹20 Lakh charges on my account.

I am currently completely handicapped and locked out of my access. Because I cannot log into the Azure portal to raise a traditional dispute, I am providing all required evidence via this email reply. Please escalate this immediately to the senior Azure Billing Fraud management team:

The Core Evidence & Unauthorized Changes:
1. My Original Account: [Moderator note: Personally Identifiable Information removed]@cloudblast.onmicrosoft.com (Originally the Global Administrator, which the hacker maliciously downgraded to an Exchange Administrator role to strip away my control).
2. The Hacker's Fraudulent Account: [Moderator note: Personally Identifiable Information removed]@cloudblast.onmicrosoft.com (Created entirely by the attacker, who assigned themselves Exchange Admin rights and spun up the massive, unauthorized Azure infrastructure).
3. Guest Accounts: The hacker also added 2 unrecognized guest user accounts to maintain persistence.
4. Cross-Reference With Active Security Ticket: The Microsoft 365 Data Protection Team is actively processing the forensic cleanup and account recovery for this exact compromise under
5. Case ID: [Moderator note: Personally Identifiable Information removed]. The backend logs will completely validate these email addresses and the unauthorized configuration changes.
Urgent Action Requested:
1. Please escalate this file to the Azure Billing Escalations unit to link it directly with the security investigation.
2. Please issue a total credit write-off to drop this ₹20 Lakh balance to zero under the Microsoft subscription hijacking policy.
3. Please contact me via phone immediately to confirm that my billing profile has been temporarily frozen against any automated charge attempts.

0 comments

1 answer

Your answer

Answer 1

Hi @Kiyan Y

I’m sorry you’re dealing with both a tenant compromise and substantial unauthorized Azure charges.

Since the Microsoft 365 Data Protection team is already handling the account-recovery case, I recommend continuing to work with them until you regain control of the tenant. Once access is restored, secure the administrator accounts, review the unauthorized users and resources, and preserve the relevant logs and billing evidence.

You should then open a separate Azure Billing and Subscription Management support request for the disputed charges and ask Microsoft to link it to your existing security case. Microsoft guidance for compromised Azure accounts with unauthorized usage directs customers to submit a billing support request so the account activity and charges can be reviewed.

In the meantime, contact your bank or card issuer immediately, explain that the payment method may be exposed to unauthorized Azure charges, and ask what temporary card restrictions or fraud-protection measures they recommend. Be aware that locking or replacing the card may affect legitimate payments and may not stop transactions that have already been authorized, so follow the card issuer’s guidance.

When you regain access, include the security case ID, billing case ID, affected subscription details, invoice, unauthorized resources, relevant timestamps, and supporting logs in the Azure billing dispute. Only Microsoft Billing can review the charges and determine whether a credit or write-off is appropriate.

Please avoid posting Tenant IDs, account addresses, invoice details, payment information, or case evidence publicly on this forum.

I’m just another user on this forum, not a Microsoft employee, but I hope this helps you separate the account-recovery process from the billing dispute and protect the payment method in the meantime.