Yeah, happened to me with an account that: * Never used anything above the free tier * Never had a credit card attached * Was only ever logged in from the UK

Yeah, happened to me with an account that: * Never used anything above the free tier * Never had a credit card attached * Was only ever logged in from the UK * Hadn't been used at all in 3 years Naively my root credentials were the same as my Linkedin details (which were all leaked), and one random Sunday, someone from Brazil logged in and spun up 50+ GPU instances across multiple zones. Amazon let that go for around 12 hours before they sent me an email asking me to check that my deployments were working as expected. £2,000 in just those few hours. I did get the fee waived (though they took two weeks to finally decide this), and I accepted that it was my fault for reusing passwords and not enabling MFA (which IIRC may not have been an option when the account was opened) but I was very critical of Amazon for not preventing expensive nodes from being spun up when there wasn't even a card attached to the account.