Hacker News new | ask | show | jobs
by jeffparsons 845 days ago
Warning: most cloud providers (Google, Amazon, Microsoft) require you to accept unlimited liability to use their services.

If you're running a business and you have lawyers, then fair enough — just play the game. But for individuals, it seems crazy that so many of us accept this sort of thing. Good luck contesting the charge with your credit card company when you already agreed to a contract that said Google could bill you thousands of dollars and then you used thousands of dollars worth of their service.

Big cloud providers are not your friend. They do not care if they destroy the lives of you and your family, unless it's happening so often that it's making mainstream news.

My advice is to go and delete your cloud accounts, and only use services that offer hard spending caps, and ideally prepaid accounts.

Maybe this doesn't leave many options. Oh well. Maybe if you can't afford big lawyers then you also can't afford the risks of using big cloud.

3 comments

This is just a single data point but I had a surprise bill with Google. I talked to the support and got it waived off.

I used Amazon EC2 instances for years and I always felt in control. There were never any surprises. I knew even in the worst case situation I would be okay because I had faith in the Amazon support. With Google I felt insecure. I never played with any of Google cloud services since then.

Amazon's customer first policy is really true. They try their absolute best to make sure there are no surprises to a great extent. Even the UI is very intuitive.

Same here - incidentally was also one of the weirdest interactions with customer support I've ever had. I suspect the first point of contact was some sort of LLM/chatbot that desperately wanted to make sure I was feeling fine and that there was nothing to worry about. When I was forwarded to the billing support team the interaction went back to normal - couple of messages back and forth and some homework to set the real budget limit (the quota is just for alarms) and they waved the charge.
>Amazon's customer first policy is really true.

Which part of customer first drove their egress fee policies?

The part that was ALWAYS there.

Egress is basically all outbound traffic. The fee was always this. Dont act shocked when it doesn't go down when you have buyers remorse.

Same here. GCP waived off a surprise bill of $4,500 when I accidentally left a TPUv1 running for a month many years ago on a personal project (I was just toying around with the new TPU for an hour or so in my own free time, and didn't realize that unlike a GPU, the TPU has to be shut off separately from the CPU/VM or else it keeps charging by the hour.
Amazon definitely also has it's share of billing issues.

A personal example would be that we reserved an instance based on information given by our AWS account manager. Said instance turned out to have issues linked to my original question to the account manager who answered incorrectly.

The reserved instance team then refused to refund us but also refused to tell how much they would prorate if we were to upgrade instead.

Basically a protection racket.

I simply don’t accept this argument, primarily because the way AWS handles NAT gateway fees is really only explainable as something that is designed to be predatory
Yeah, I have spent much more than $14k to date and would have spent much more over time, losing my business isn't rational. I think it's just another "Google can't do customer support to literally save their life" example.
All of the cloud services I have are setup only with privacy.com cards. I have each individual cards limited to just above what the monthly expected spend is. Even if there's a (reasonable) spike I can see it and I have to take manual action before the charge will go through.

Can not recommend privacy.com enough.

That's not what privacy.com does or is for. They advertise it, but I've had transactions blow right through the façade. Specifically, the New York Times, after my trial subscription ended and I watched the stupendously-expensive charges bounce, they kept trying and eventually tried a different way and it went through.

I emailed support, and here's what I got back:

> Hi, $firstname. I've been reviewing your dispute and wanted to touch base with you to explain what happened.

> It appears that the disputed charge is a "force post" by the merchant. This happens when a merchant cannot collect funds for a transaction after repeated attempts and completes the transaction without an authorization — it's literally an unauthorized transaction that's against payment card network rules. It's a pretty sneaky move used by some merchants, and unfortunately, it's not something Privacy can block.

They have a page that says pretty much exactly that, as well: https://support.privacy.com/hc/en-us/articles/360012288214-F...

What's interesting is that they seem to be glossing over the truth. It's not unauthorized, per se, it's using a prior authorization code. And it's intended for processing offline transactions. It seems like 'force' is an industry term and a bit hyperbolic when used in lay discussion.

More discussion here: https://www.tidalcommerce.com/learn/force-sale-credit-card

It's the equivalent of a payment processor claiming a dog ate their homework.
>It's literally an unauthorized transaction that's against payment card network rules. It's a pretty sneaky move used by some merchants, and unfortunately, it's not something Privacy can block

Have you found a site that does "block" this? Did you communicate with your credit card company about this? I am wondering

Use a prepaid card that you bought at a grocery store a few cities away from your hometown with cash while wearing a mask and not bringing any phones with you or driving a car that logs its location or beacons any identifying signals.

I think that might finally allow you to pay for the New York Times on your own terms and not worry about their hounds sniffing you down.

Having talked to credit card issuers about this, what they told me was to close the account. They said they had no way to ever stop the charges from coming in.
In my case, even closing an account wasn't sufficient. A charge posted to a credit card I'd closed more than a year prior, and the card issuer was legally obligated to process the charge because of the renewal contract that apparently I had signed with the merchant. This led a single late payment, which, in turn, caused my credit score to tank by ~90 points just as I was applying for mortgages. I try not to think about what that, and waiting a year, until mortgage rates climbed to nearly 6%, will have cost me if I'm lucky enough to outlast my thirty-year-fixed mortgage.

Edit: and the dark Lord surely reserves a particularly unpleasant circle of hell for loan officers who encourage borrowers to consider a 5-1 variant rate because "we know rates will fall next year."

This is interesting because it means potentially your estate would be liable for such charges indefinitely after your death.
Doesn't stop them from trying to collect after the transaction is declined. It's not a prepaid service, you're agreeing to pay the charges _after_ you've used the service.

Will they pursue? Do they have enough info to purse? Who knows, but they can if they want to.

This is very much not what privacy.com is for, and it won't protect you from $14k in BigQuery bills. There is no clause in the GCP contract (or any other contract, for that matter) which says "if your payment method is invalid when we go to collect what you owe us, we forfeit all right to be paid."

For small charges they might just give up because it's not worth it, but when dealing with a $14k bill you should assume that they will at the very least hand the debt off to a collections agency if you try to just ignore it.

You're still liable to Google/whoever for the full amount, so it is only a temporary reprieve. Which can be useful, but does not solve the main problem.
Yup, I'm already having to pay legal fees - which is why you have a biz lawyer on retainer to start with - but I'm not sure I have any standing.
IANAL, but if this happened to me I would be gathering as many examples as I could of this having happened to other people. The angle being: Google knows this is a huge issue. Effectively, they know that they have (presumably accidentally) created a really dangerous trap for small players, and have chosen to do nothing about it.

In some jurisdictions I think that reduces the legitimacy of their claim that you actually owe them money.

EDIT: Even better, focus on the examples where Google "forgave" the debt; you could argue that those examples prove that Google knows it's at least partly their fault.

The FTC is already investigating: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/202...

I think we (the developer community) need to start pushing back against this abuse, it's getting out of control.

The thing that bothers me the most is I caught this $14k charge b/c I'm a small fry and that money matters to me. How many big accounts just wouldn't notice that? I can't help but think a very non-trivial % of all cloud revenue is just obscure fees that nobody notices - engineers doing the engineering, accounts receivable pays the bills, and the cloud providers get fat.

I would love to see an example of this working.

I know that if it did work it would change the opportunity cost of forgiving debt in these cases dramatically

I honestly think it would be better if they didn't have the option to "forgive the debt" — at least without following up by eliminating the trap that created said debt.

How often is one of these accidental debts created? How often do customers just pay up because it's small enough that it's not worth fighting? How often does AWS (or Google or whoever) decide whether to forgive the debt based on PR damage control rather than the legitimacy of the debt? Jeez I hope someone leaks those numbers one day.

It reminds me of all those horror stories of hospital visits in the USA, where the first bill you receive is just a test to see if they can squeeze that much out of you, but if you know what you're doing or just can't pay then the actual bill is way lower. It's all just yucky.

If big cloud providers couldn't selectively choose which of these debts to enforce, I bet there would be a media shitstorm and then they would suddenly discover that it's not all thaaaaat hard to implement real time billing and hard caps after all.

Well, the "trap" is the lack of hard limits which, if implemented, would enable some companies to blow up their businesses. Which arguably is a better outcome than people who can't afford it getting big bills. But it is a tradeoff even aside from the providers arguably collecting some money people didn't intend to give them.