A Reported Billing-Fraud Incident Is a Good Prompt to Audit Your Account Security
A Bay Area Anthropic subscriber reported unauthorised charges — around $315 across multiple gift-style purchases billed in euros — appearing on his account, first flagged to him by his bank rather than by Anthropic. He had been using Claude to help build software for his tech company. Anthropic's stated position was that the issue was not caused by the Claude app itself, pointing instead toward compromised account credentials as the likely vector — a pattern consistent with password reuse or a phished login rather than a platform-side vulnerability.
What this means practically
Whatever the exact cause in this case, credential-based account takeover is the most common source of "unexpected charges" reports across SaaS platforms generally, and Claude/Anthropic accounts are not a special exception. A short, concrete checklist for developers who rely on Claude for real work:
- Enable two-factor authentication on your Anthropic account if you haven't — this alone blocks the overwhelming majority of credential-stuffing takeovers.
- Use a unique password for your Anthropic account, not one shared with any other service — password reuse is the single biggest contributor to account takeover across the industry.
- Turn on billing alerts so unexpected charges surface to you directly rather than being caught first by your bank days later.
- Review connected API keys and OAuth grants periodically — a stale integration you forgot about is a lingering attack surface.
Don't wait for it to resolve itself: change your password immediately, revoke active sessions and API keys from account settings, enable 2FA if it isn't already on, and contact Anthropic support with the specific charge details. The faster credentials are rotated, the smaller the window for further unauthorised use.