How Anthropic Could Have Prevented the “Claude Gift Fraud” With Security 101

At 11:25:04 am, my Claude account purchased a one-month Gift Max 20X subscription.

The plan cost $200. After Indian GST, my card was charged $236.

Eight seconds later, another $236 payment was attempted. Twelve seconds after that, a $118 payment was attempted.

The first transaction succeeded. The next two failed.

When I checked Claude's billing page, I found that the successful gift had already been redeemed by an email address I did not recognise. Anthropic had not detected the fraud or warned me. I discovered it myself.

My Claude account was subsequently suspended. I lost both the money and access to the account.

Similar unauthorised gift purchases have been reported by other Claude users. The Guardian documented cases involving repeated gift charges, suspended accounts and ineffective automated support. Reddit users have described comparable Gift Max purchases, rapid redemption, multiple charge attempts and no corresponding suspicious login activity on their Google accounts.

The exact method used to obtain access may not be identical in every case. A stolen browser session is one plausible route. Malware, a compromised browser profile or another form of account takeover could produce the same result.

But the initial compromise is only part of the story.

For this fraud to succeed, Anthropic's product had to convert access to a Claude account into permission to spend money and transfer value to another account.

That required four separate failures.

Failure 1: A valid session was treated as continuing proof of identity

A logged-in session proves that the user authenticated at some point in the past.

It does not prove that the legitimate user is still controlling that session.

This distinction matters because session theft allows an attacker to bypass the normal login process. The attacker may not need the account password, access to Google, or the ability to complete two-factor authentication. They only need a session credential that the application still accepts.

This is why secure systems do not give every authenticated session unlimited authority.

Reading old conversations is one level of risk. Changing an email address, exporting sensitive data or spending money is another.

The application should treat these actions differently.

In this case, whoever controlled the Claude session could apparently reach a stored payment method and initiate a purchase. The security boundary around ordinary account access also functioned as the security boundary around spending.

That was the first failure.

The correct principle is simple:

An authenticated session should grant access to the product, not permanent authority over every sensitive action inside it.

Failure 2: A transferable purchase did not require fresh authorisation

A gift subscription is not an ordinary renewal.

When a user renews their own subscription, the value remains attached to the same account. A gift purchase moves value from the purchaser's payment method to another account.

That makes it a transfer.

Transfers deserve stronger controls because they create an immediate incentive for account takeover. Once redeemed, the product is no longer under the original account holder's control.

Anthropic should have required fresh authorisation before completing the purchase.

That could have taken several forms:

• reauthentication through Google or Apple;
• a passkey or security-key challenge;
• approval through the account's verified email;
• confirmation from an existing trusted device;
• or re-entry of payment information.

The exact mechanism matters less than the boundary it creates.

Possession of an existing Claude session should not, by itself, be enough to charge a stored card and transfer a $200 subscription elsewhere.

A fresh authentication challenge would also have made stolen-session attacks significantly less useful. An attacker with a copied Claude session might be able to open the account, but they would still need to prove control of the user's primary identity before spending money.

This is standard step-up authentication: low-risk actions continue normally, while high-risk actions require stronger evidence.

Anthropic did not need to require repeated authentication for every Claude conversation. It only needed to require it before a financial transfer.

Failure 3: The transaction and redemption flow had inadequate fraud controls

Even if the first payment passed, the surrounding activity should have triggered an immediate response.

The sequence was:

• a $236 gift purchase succeeded;
• another $236 charge was attempted eight seconds later;
• a $118 charge was attempted twelve seconds after that.

This is a strong velocity signal.

A legitimate user may buy more than one gift, but several high-value attempts within seconds should not be treated as routine activity — particularly when combined with other risk signals such as a new device, unusual location, first-time gift activity or a recipient address linked to previous disputed transactions.

Anthropic did not need an advanced machine-learning model to catch this.

A small set of deterministic rules could have been enough:

• require reauthentication after the first high-value gift purchase;
• temporarily block repeated gift attempts within a short period;
• delay redemption when the purchase has an elevated risk score;
• notify the purchaser immediately with the recipient and amount;
• provide a one-click option to freeze the gift and revoke active sessions.

The immediate redemption of a digital gift creates another problem: it removes reversibility.

A short holding period would have given Anthropic time to detect suspicious behaviour and given the customer time to respond. This would not need to delay every gift for hours. The delay could apply only when the transaction carries additional risk.

Recipient analysis could also have helped, but it should be based on measurable behaviour rather than appearance.

Useful signals could include:

• whether the domain is disposable;
• whether the same recipient has received gifts from several unrelated accounts;
• whether those gifts were later disputed;
• whether the recipient was created moments before redemption;
• whether the device, network or country differs sharply from normal account activity.

Anthropic operates both sides of the gift transaction. It can see the account being charged and the account receiving the value.

That gives it considerably more context than a bank or card network has.

The product should have used that context.

Failure 4: Customer support treated a fraud pattern as an ordinary ticket

The security controls failed first.

Anthropic's support system then allowed the damage to continue.

I reported an unauthorised transaction. Anthropic's automated support agent acknowledged the report and said it would escalate the matter to a specialised billing team.

There was no effective resolution. My account remained suspended, the charge was not reversed, and the automated support process did not provide a meaningful explanation of what had happened.

Other reported victims describe similar experiences.

This is particularly difficult to justify because Anthropic already uses an AI support agent called Fin. A company building some of the world's most capable AI systems should be able to recognise a repeated, narrowly defined fraud pattern in its own support queue.

The relevant pattern is not subtle:

• the customer reports an unauthorised Gift Max purchase;
• the gift was sent to another account;
• the gift was redeemed quickly;
• several payment attempts occurred close together;
• the customer reported the incident shortly afterward;
• comparable cases already exist.

Once this pattern became known, Anthropic should have created a dedicated incident workflow.

The first response did not need to make an irreversible decision. It could have:

1. revoked active sessions
2. blocked further gift purchases
3. frozen unredeemed gifts
4. preserved device, session, payment and redemption logs
5. locked the stored payment method
6. prioritised the case for fraud review
7. restored the legitimate user's access after identity verification;
8. refunded transactions when internal evidence matched the known pattern.
9. Most of this does not require AI.

A deterministic workflow would probably be more reliable.

An automated refund should not be issued solely because someone types "fraud" into a support chat. That would create another abuse vector. But Anthropic has access to the account, transaction, recipient, redemption and session data needed to verify whether a report matches the established fraud pattern.

"Support is understaffed" would not explain the absence of this workflow.

Understaffing can explain a slow response to a novel and complicated case. It does not justify repeatedly routing the same recognisable security incident through a general-purpose support bot.

Once multiple users report the same pattern, it is no longer merely a customer-support problem.

It is an incident-response problem.

Security should assume that one control will eventually fail

Anthropic could not guarantee that no customer device would ever be infected with malware.

It could not guarantee that no browser session would ever be stolen.

It could not guarantee that every bank would require an OTP for every international transaction.

It could, however, control what happened inside Claude after an attacker gained some form of account access.

A secure design would assume that passwords, sessions and devices can eventually be compromised. It would then prevent any single compromise from automatically unlocking every sensitive capability.

In this case, access to the account appears to have unlocked:

• a stored payment method;
• a transferable product;
• immediate redemption;
• repeated payment attempts;
• and no effective recovery path for the legitimate customer.

That is why this cannot be reduced to one stolen cookie or one compromised device.

The attack succeeded because several independent safeguards were absent at the same time.

Step-up authentication could have stopped it.

Transaction-velocity controls could have stopped it.

A redemption delay could have stopped it.

Recipient and account-risk analysis could have stopped it.

A competent incident-response workflow could still have contained the damage after the payment occurred.

Anthropic did not need frontier AI to solve this.

It needed defence in depth, separation between authentication and transaction authorisation, reversible high-risk actions and a support process capable of recognising a known fraud pattern.

That is security 101.

There is also an uncomfortable incentive problem.

If Anthropic suspends the victim's account but does not cancel the redeemed gift, suspend the recipient account, and refund the payment, the fraud still produces revenue for Anthropic.

The attacker may keep the subscription, the victim loses both money and account access, and Anthropic keeps the sale.

Without clear evidence that recipient accounts are disabled and fraudulent gifts are reversed, the platform can end up benefiting from the same fraud it failed to stop.