Amazon Web Services Charged My Card $1,600 Without Authorization

On Sunday, July 26, 2026, at around 5:00 p.m. Turkey time, I discovered that a $1,600 charge had been made to my VakıfBank personal credit card by Amazon Web Services (AWS) without my knowledge or authorization. An additional $1,400 transaction was also attempted from the same source, but it was declined because my available credit limit was insufficient. If my credit limit had been higher, this second amount would clearly have been charged as well. This situation raises serious concerns about a major security vulnerability on both the bank's and Amazon Web Services' side. I do not have any AWS account, yet these transactions were attempted against my credit card.

I became aware of the situation after receiving a “credit limit insufficient” notification regarding the second transaction, and I immediately canceled all of my cards. I then contacted VakıfBank customer service. When I subsequently called the Altunizade branch, I was told that I needed to complete a transaction dispute form. Since I was abroad and unable to have reliable telephone conversations, I reported the situation by email. I signed the transaction dispute form that was sent to me by email and returned it by email as well.

While the dispute process was still ongoing, I noticed that the amount initially shown as pending had already been posted to my credit card statement. I was informed that I would be required to pay this amount, which is approximately $1,856, on the statement due date of August 16, 2026. I do not want to be forced to pay for a transaction that was completely unauthorized and made without my knowledge while my dispute is still unresolved.

I urgently request that the bank and AWS investigate how this amount could have been charged to my card despite the fact that I do not have an AWS account, cancel the unauthorized transaction and refund the full amount to my credit card, and ensure that this illegitimate debt is not charged to me. It is unacceptable that such a large and globally recognized company could allow such an obvious fraudulent transaction to occur, which raises serious concerns about its security measures. I expect my financial loss and the security breach I have experienced to be addressed immediately.