Ask HN: SendGrid billed a CC I never typed into their app. How is that possible?
Last week I was wrongly billed $21 on a SendGrid account I haven't used for three years. They billed me for a "dedicated IP address", but my free account doesn't even have access to that feature.
I contacted their support and they promptly acknowledged the fact that it was an error on their end and the payment was refunded.
Now to the weird part: the credit card they charged was issued on April, 2019. The last time I logged into their website was December, 2017. After I got billed, I logged again and there is no mention of any credit card registered on my account (when I go to "Billing", it asks me to enter my first payment method).
I also never used Twilio, which recently acquired SendGrid.
So, how on earth did they get access to that credit card number? I only register it on services I trust (Google - GSuite, Amazon - AWS, DigitalOcean, Netflix etc), and I generate a virtual credit card number for all one-time payments. The only possible way I can think of is if any of the companies I previously registered that credit card number shared it with SendGrid, which would be completely absurd.
When support notified me I would get refunded, they dodged the CC question. When I asked again, their full answer was:
"Thank you for following up I appreciate your patience. At this time our billing team is still looking into how this happened. Again, I'm very sorry for the inconvenience."
And now, 3 days later, the ticket was closed without additional information.
Do you folks have any idea what may have happened here? Am I missing something? Is there a magic API to get someone's CC number based on a previous one?