Anthropic Console overcharged my card 100x due to internationalization input bug

Hey @rsorto – sorry about this! I work at Anthropic and can see that there's a UI/form bug which didn't account for internationalization very well. A typed "5,04" got converted to $504. We're fixing the bug now and the support team will reach out to you directly to address your case, shortly.

Hola Jordan,

Thank you very much for your support with this. I appreciate you stepping in, acknowledging the engineering flaw, and escalating my case.

As additional feedback on the automated support pipeline: I understand the desire to automate and make processes more efficient. However, a person should not have to rely on getting a post to the top of Hacker News just to bypass AI bots and get a human to look at an obvious financial error. Luckily, you were here and acted proactively, which I truly value.

I will await the support team's communication.

Pura vida!

Thanks for the attention and fixing this.

Note to others who are blaming Amthropic in various ways. This is what taking responsibility is.

Note also that Anthropic outsources the billing and metered billing to a third party still, who is doing very well with the growth. It’s a more recent company in the space so it comes with a lot of bugs that are getting learned with time which is why there are so many interesting (at scale) and obvious errors (billing systems are build over years not months) being corrected with time.

Unless they are changing their support process to not require a user to post on a message board and hope a developer sees it, I don't see how it's really taking responsibility.

And why should I give them more leeway for outsourcing to an inexperienced company? Comma/decimals meaning in currency is pretty well-established. If a new company is moving into an established space I would expect them to learn from other folks past experiences. "whoopsy, we don't know our core competency" isn't a defense for a company that's presumably making exorbitant amounts of money from partnering with Anthropic.

I was only encouraging the individual’s good work here vs a lot of the negatively being thrown out. I was noting the rest and not endorsing it. I’ve built payment and billing system at scale in both B2B and B2C contexts. These mistakes would have never been in production and aren’t acceptable from a vendor imo.

Individual’s good work squashing a PR issue.

> Note to others who are blaming Amthropic in various ways. This is what taking responsibility is.

It is way too early to tell if Anthropic is "taking responsibilty" for this. I'll be awaiting the news that they started aggressively hiring human support staff to field user complaints so they don't continue to do shit like this. That is taking responsibilty.

> This is what taking responsibility is

That is very generous considering their strategy is not having any type of customer support and entirely ignoring their users unless the complain on an online forum where thousands of others can see it.

While you’re at it could you please also fix the bug where downgrading a team member from premium to standard, applies the downgrade to the wrong person at the next billing.

I’ve reported this 3 months in a row and nobody seems to be hearing.

Passing that on to the right team! Thank you!

This is the kind of mistake I dread, where a normal human would be able to say "oh, sure of course this is a mistake, sorry about that", but you don't get to talk to a human. A corporation can wait months for resolution, but an individual can't.

Yup. We've been living in a world with ZERO obvious software mistakes and now that these LLM things are running wild, we've got more obvious bugs than ever!

Yes, they are building frontier models and should be responsible to handle basic text input validation.

An additional point here is that Anthropic is hiding behind bots so they don't have to fix it and support humans with real world problems.

It's frustrating to be forced into a financial burden just because they decided to cut corners on traditional software debugging protocols.

It’s more so zero customer support and no accountability that is the issue here, not the existence of that specific bug.

> To make matters worse, there was no confirmation modal or review screen summarizing the final amount before processing the transaction. It was a single-click, instantaneous overcharge.

I may be remembering wrong, but I thought VISA/MC rules require that the user be shown the final amount that will be charged before they are allowed to take the action that causes the transaction to be processed.

I also seem to recall something about having to get acknowledgement from the user that they have seem that final amount, although I'm less sure of that--I may be remembering a requirement that if they are buying something that automatically re-bills they have to acknowledge that.

Anyway, it sounds like the Anthropic purchase flow might be in violation of credit card company rules.

Good that this got fixed over HN, but really, Anthropic should fire Fin and repalce them with a human being. Or consider using an actual Anthropic model instead, that works too ;-).

I pretty much assume that any kind of issue with Anthropic will never be resolved, so I'm very careful what I trust them with.

I'm looking at the "Add credits" screen on https://platform.claude.com and it prominently displays the "total due" as $504.00 when typing `5,04` into the input...

Striking, thanks for the comment,

Please note that I typed 5.04 (with a dot), not a comma.

I was doing a manual account recharge (adding credits), where the user defines an arbitrary prepaid amount. On a localized system/keyboard setup, entering the dot did not alter the total due or warn me of a 100x increase before hitting the submit button.

Also, the core issue is the complete lack of a final checkout/confirmation step for an arbitrary recharge amount. In proper financial UX, clicking the primary button should trigger a modal stating: "You are about to recharge your account with $504.00 USD + $65.52 VAT. Total due: $569.52. Confirm payment?". Executing an instantaneous credit card charge on a single click while silently processing ambiguous inputs is precisely the dangerous design flaw I am pointing out.

Saludos,

It feels more like a writing exercise - too many extraneous details right from the start: "I am a LegalTech Attorney leading a developer team" feel necessary if you're telling a story, but is completely irrelevant if you're reporting an issue. And $5.04?? Who knows their spending requirements to that level of specificity?

Is it possible? I guess, but I doubt they're being honest about what was being displayed on the screen.

Lots of space for vibe coding jokes here. And 504 is significant for Costa Rica, it can buy a lot of lattes.

On a more serious note, do these vibe coded chatbot payment UIs accept like one time use Revolut CC numbers?

And on a second serious note, have they heard of 3D secure or you simply can't pay with an european credit card?

Nottorp, don't be fooled, with Starbucks prices here in Costa Rica, $500 will barely get you a couple of weeks of lattes! Joke too :)

Going back to your serious notes, I successfully replicated the exact mechanics of this bug inside the Console, and it is a classic frontend race condition/bypass flaw:

When your system/keyboard is in a locale that uses commas, the input text box still physically allows you to type a dot (like typing 5.04 or 0.5). The catastrophic UX failure happens because if you press the "Enter" key immediately after typing, the form submits the raw, un-sanitized string to the backend before the frontend validation layer can intercept it, block it, or refresh the "Total due" box.

It completely bypasses its own validation rules (like the $5.00 minimum enforced minimum), skips any error prevention, and fires the single-click payment request to the gateway instantly with the misinterpreted value.

I uploaded the live replication screenshot here: https://ibb.co/HTY88MZ3

Haha, I sympathize :). For those who may be confused, the problem is that most i18n on the web is so shit that most people from countries where the comma is the decimal separator will enter a period instead. In many of those countries the period serves as the thousands separator so entering 1.203.456,3 should be interpreted as 1203456.30. But it almost never is so in the few cases when it works (like here) it causes nasty surprises.

This happens everywhere . I'm in Germany (which uses commas) but have my distro set to English (using dots).

I've encountered this problem on many sites, eg Amazon or eBay where I accidentally sell my items for 599,00 instead of 5.99

Donuntdonot,

Thanks for validating my point, and I understand your frustration too. Luckily, in your case, as the seller, you can edit the listing afterward; I can’t. I have to deal with Anthropic, which already charged me $569.52.

Sad....

did this post really need to be written by AI?

Hola, thanks for your reply.

Please note that English is not my native language. I used AI to make sure that my technical explanation of the decimal bug was clear and well structured so that the community here could understand it.

I agree that the text structure might look robotic, but the $569.52 unauthorized charge on my credit card right now is 100% real.

Pura vida!

I think it's a frequent misconception that the AI version is going to be clearer or more well-structured or easier to read or understand than what you would write as a non-native-English speaker. It's probably not.

Your situation is not funny, but it reminded me of an old story from the internet in the 1990's, The Neiman Marcus Cookie Recipe

> My daughter & I had just finished a salad at Neiman-Marcus Cafe in Dallas & decided to have a small dessert. Because our family are such cookie lovers, we decided to try the "Neiman-Marcus Cookie". It was so excellent that I asked if they would give me the recipe and they said with a small frown, "I'm afraid not." Well, I said, would you let me buy the recipe? With a cute smile, she said, "Yes." I asked how much, and she responded, "Two fifty." I said with approval, just add it to my tab.

It ends with them being charged $250 not $2.50 and the author shares the recipe with the world as revenge.

https://www.snopes.com/fact-check/neiman-marcus-cookies/

do you think a human overcharged them or did an AI?

What did you want to accomplish with 5.04??

In Spanish or other European countries 5,04 would’ve been correct?

So 5.04 would either be invalid or 504 like Claude did.

Hola Merb,

To be 100% clear: I wanted to load exactly five dollars and four cents ($5.04) into my account. I typed 5.04.

The core problem here is that in secure financial pipelines, ambiguous inputs must trigger a validation error and reject the transaction, not silently guess the amount and execute a 100x overcharge.

If Anthropic's backend expected a comma due to my regional settings and couldn't parse the dot, the correct engineering behavior is to throw an "Invalid Format" message and disable the pay button. Silently stripping the decimal character and instantly draining $569.52 (including local VAT taxes) from a user's card with zero confirmation screen is a catastrophic failure in error prevention.

Gracias!

Someone above also points out the inverse also fails for a decimal locale:

> I'm looking at the "Add credits" screen on https://platform.claude.com and it prominently displays the "total due" as $504.00 when typing `5,04` into the input...

That's what you get when you vibe code your billing site.

We are now turning HN into a support forum?

UPDATE: I just checked my bank statement and it’s even worse than I thought. Because the system processed the incorrect $504.00 base amount, it automatically calculated local VAT (taxes) on top of it, adding an extra $65.52. The absolute total taken from my card by this single-click bug is $569.52.

Here is the proof of the bank statement pending charge:

https://ibb.co/tMVkf0nx

TECHNICAL UPDATE (BUG REPLICATION): I just managed to replicate the input validation bug inside the console.

As you can see in the screenshot below, when your regional settings use commas for decimals (e.g., my balance shows 430,26), the input field still physically allows you to type a dot (0.5 or 5.04).

The catastrophic UX failure happens when you press "Enter" right after typing. The form instantly submits the raw, un-sanitized input string to the backend before the frontend validation layer can block it or correctly alert the user.

The system breaks its own "USD 5.00 minimum" rule, bypasses proper error prevention, and immediately fires the payment request to Stripe/the gateway.

Here is the replication proof: https://ibb.co/HTY88MZ3