Hi Google Cloud Community,
Our Firebase (PII Removed by Staff) (Lipi app) has been hit by two simultaneous fraud attacks and is now SUSPENDED. Support case #72407038 was filed on June 18, 2026.
FRAUD 1 - SMS Pumping Attack (April 8 to June 18, 2026 - 71 days): Bots sent OTP requests to 18+ countries. Zero real accounts created. Fraudulent charges: ~Rs. 1,54,981 in April 2026.
FRAUD 2 - Gemini API Key Abuse (June 17-18, 2026): Firebase API keys were leaked and abused 287,000+ times. Android key: 134,001 calls. iOS key: 153,181 calls. Fraudulent charges: ~Rs. 7,60,079 in June 2026.
Normal monthly cost: ~Rs. 8,000-10,000 (May 2026 was normal at Rs. 8,803). Total disputed: ~Rs. 17,17,411. Outstanding balance shown: Rs. 15,79,233.62.
All fixes applied June 18, 2026: All API keys deleted, SMS region locked to India only, sign-up quota set to 20/hour, all AI/Gemini APIs disabled, budget alert set. Forecasted remaining June cost dropped to Rs. 1,026 confirming fraud is fully stopped.
Current status: Project SUSPENDED, appeal submitted via Google Cloud Console, Case #72407038 filed.
Has anyone experienced similar fraud and received billing credits? Any advice on escalating the appeal faster would be greatly appreciated. Thank you.