HN Explorer

Ask HN: SendGrid billed a CC I never typed into their app. How is that possible?

8 points by napsterbr ↗ HN
Hello there, HN,

Last week I was wrongly billed $21 on a SendGrid account I haven't used for three years. They billed me for a "dedicated IP address", but my free account doesn't even have access to that feature.

I contacted their support and they promptly acknowledged the fact that it was an error on their end and the payment was refunded.

Now to the weird part: the credit card they charged was issued on April, 2019. The last time I logged into their website was December, 2017. After I got billed, I logged again and there is no mention of any credit card registered on my account (when I go to "Billing", it asks me to enter my first payment method).

I also never used Twilio, which recently acquired SendGrid.

So, how on earth did they get access to that credit card number? I only register it on services I trust (Google - GSuite, Amazon - AWS, DigitalOcean, Netflix etc), and I generate a virtual credit card number for all one-time payments. The only possible way I can think of is if any of the companies I previously registered that credit card number shared it with SendGrid, which would be completely absurd.

When support notified me I would get refunded, they dodged the CC question. When I asked again, their full answer was:

"Thank you for following up I appreciate your patience. At this time our billing team is still looking into how this happened. Again, I'm very sorry for the inconvenience."

And now, 3 days later, the ticket was closed without additional information.

Do you folks have any idea what may have happened here? Am I missing something? Is there a magic API to get someone's CC number based on a previous one?

7 comments

[ 4.6 ms ] story [ 27.6 ms ] thread
treeman79
Similar issue with Bank of America debit card. Security guy for bofa said if vendor is determined. They can contact MasterCard and obtain new card info.
napsterbr
Wow, had no idea such thing existed. Thanks for the information!

Now I wonder why their support did not say that...

clintonb
The support person probably doesn’t know about this capability.
[deleted]
(comment deleted)
gregjor
This belongs on Reddit along with the “I bought some Pringle’s and almost all of the chips were broken” posts. Call the bank, cancel the charge and report it as unauthorized. End of drama.
clintonb
When a card is updated, the merchant (via payment provider) can request the updated card details. This is meant to avoid disruption in recurring charges, but has the side-effect of surprising unsuspecting customers. If you don’t like this functionality, your bank/card issuer may let you disable, but there are no guarantees.