rsorto
Joined 15 days ago
Joined 15 days ago
Thanks for validating my point, and I understand your frustration too. Luckily, in your case, as the seller, you can edit the listing afterward; I can’t. I have to deal with Anthropic, which already charged me $569.52.
Sad....
An additional point here is that Anthropic is hiding behind bots so they don't have to fix it and support humans with real world problems.
It's frustrating to be forced into a financial burden just because they decided to cut corners on traditional software debugging protocols.
Going back to your serious notes, I successfully replicated the exact mechanics of this bug inside the Console, and it is a classic frontend race condition/bypass flaw:
When your system/keyboard is in a locale that uses commas, the input text box still physically allows you to type a dot (like typing 5.04 or 0.5). The catastrophic UX failure happens because if you press the "Enter" key immediately after typing, the form submits the raw, un-sanitized string to the backend before the frontend validation layer can intercept it, block it, or refresh the "Total due" box.
It completely bypasses its own validation rules (like the $5.00 minimum enforced minimum), skips any error prevention, and fires the single-click payment request to the gateway instantly with the misinterpreted value.
I uploaded the live replication screenshot here: https://ibb.co/HTY88MZ3
As you can see in the screenshot below, when your regional settings use commas for decimals (e.g., my balance shows 430,26), the input field still physically allows you to type a dot (0.5 or 5.04).
The catastrophic UX failure happens when you press "Enter" right after typing. The form instantly submits the raw, un-sanitized input string to the backend before the frontend validation layer can block it or correctly alert the user.
The system breaks its own "USD 5.00 minimum" rule, bypasses proper error prevention, and immediately fires the payment request to Stripe/the gateway.
Here is the replication proof: https://ibb.co/HTY88MZ3
Please note that I typed 5.04 (with a dot), not a comma.
I was doing a manual account recharge (adding credits), where the user defines an arbitrary prepaid amount. On a localized system/keyboard setup, entering the dot did not alter the total due or warn me of a 100x increase before hitting the submit button.
Also, the core issue is the complete lack of a final checkout/confirmation step for an arbitrary recharge amount. In proper financial UX, clicking the primary button should trigger a modal stating: "You are about to recharge your account with $504.00 USD + $65.52 VAT. Total due: $569.52. Confirm payment?". Executing an instantaneous credit card charge on a single click while silently processing ambiguous inputs is precisely the dangerous design flaw I am pointing out.
Saludos,
To be 100% clear: I wanted to load exactly five dollars and four cents ($5.04) into my account. I typed 5.04.
The core problem here is that in secure financial pipelines, ambiguous inputs must trigger a validation error and reject the transaction, not silently guess the amount and execute a 100x overcharge.
If Anthropic's backend expected a comma due to my regional settings and couldn't parse the dot, the correct engineering behavior is to throw an "Invalid Format" message and disable the pay button. Silently stripping the decimal character and instantly draining $569.52 (including local VAT taxes) from a user's card with zero confirmation screen is a catastrophic failure in error prevention.
Gracias!
Please note that English is not my native language. I used AI to make sure that my technical explanation of the decimal bug was clear and well structured so that the community here could understand it.
I agree that the text structure might look robotic, but the $569.52 unauthorized charge on my credit card right now is 100% real.
Pura vida!
Here is the proof of the bank statement pending charge:
Thank you very much for your support with this. I appreciate you stepping in, acknowledging the engineering flaw, and escalating my case.
As additional feedback on the automated support pipeline: I understand the desire to automate and make processes more efficient. However, a person should not have to rely on getting a post to the top of Hacker News just to bypass AI bots and get a human to look at an obvious financial error. Luckily, you were here and acted proactively, which I truly value.
I will await the support team's communication.
Pura vida!