The AWX*CR AWUS charge on your credit card or bank statement comes from Amazon Web Services, Amazon’s cloud computing division. In banking shorthand, “CR” usually signals a credit or refund rather than a new charge, so this line often represents money returning to your account after an AWS billing adjustment. Similar descriptors such as “AWS*AWSCR” or “AMZN*AWSUS” can appear for either charges or refunds depending on how your bank formats them. If you never signed up for any cloud services, the entry deserves investigation regardless of which direction the money moved.
What the Descriptor Actually Refers To
Amazon Web Services sells cloud infrastructure: server capacity, data storage, website hosting, domain registration, and hundreds of related digital products. The “AW” or “AWS” fragment identifies the cloud platform, and “US” points to Amazon Web Services’ United States billing entity. These entries are unrelated to ordinary Amazon.com shopping orders, which post under different descriptors. Each AWS charge ties to a unique twelve-digit account ID you can use to confirm whether the account is yours.1Amazon Web Services. View AWS Account Identifiers – AWS Account Management
AWS bills on a pay-as-you-go model, similar to a utility. You are charged only for the computing resources, storage, or data transfers your account actually consumed during the cycle. Amounts can shift month to month, and even small residual usage can generate a statement entry.
Why the Charge Appeared
Free Tier Expiration
The most common surprise bill comes from outliving the AWS Free Tier. As of July 2025, new AWS accounts receive up to $200 in credits and a six-month free plan covering over 200 services.2Amazon Web Services. AWS Free Tier Accounts created before that date operated under an older twelve-month structure.3Amazon Web Services. AWS Billing – Trying Services Using AWS Free Tier (Before July 15, 2025) Once the promotional window closes or usage exceeds the free allowances, the system quietly switches to paid billing. A project you set up months ago and forgot about can produce charges you never expected.
Forgotten Resources Still Running
Cloud resources do not shut themselves down when you stop using them. A virtual server left running after a tutorial, an S3 storage bucket still holding old files, or unattached storage volumes can all quietly generate costs. Frequent culprits include Elastic IP addresses that charge when detached from a running server, snapshots whose parent volumes were deleted, and database backups that persist after you remove the database itself.4AWS re:Post. Terminate Active AWS Resources That You No Longer Need These items blend into a monthly bill, and most people never notice until they read the detailed invoice.
Domain Renewals and Marketplace Subscriptions
AWS registers domain names through Route 53, and renewals happen automatically on an annual cycle. A domain you registered and forgot about will renew and hit your card. Third-party software subscriptions purchased through the AWS Marketplace also recur under the AWS descriptor. Both are easy to miss because they renew without the confirmation email a typical online purchase generates.
Unauthorized Account Activity
If none of the above apply and you have never signed up for AWS, someone may have used your payment information to open an account. Cloud resources can be spun up in minutes and used for cryptocurrency mining or other resource-heavy tasks, and the resulting charges can climb quickly. This scenario calls for immediate action on both the AWS side and with your card issuer.
How to Trace the Exact Source
If you have an AWS account, sign in and open the Billing and Cost Management Dashboard. The Bills page breaks out every service used during the cycle, the region it ran in, and the exact quantity consumed. Download the CSV or PDF invoice and match the statement date and dollar amount against the line items to pinpoint the source.
To prevent repeats, set up a budget alert. In AWS Budgets you can specify a dollar threshold and receive an email the moment your spending crosses it, either as a fixed amount or a percentage of a monthly target, and alerts can trigger on actual or forecasted spend.5Amazon Web Services. Configuring a Budget Action – AWS Cost Management A $1 threshold catches unexpected activity before it grows. Up to ten email addresses can receive the notifications.
How to Stop or Dispute the Charge
Through AWS Support
Open a case through the AWS Support Center and choose “Account and billing support” as the category. Include the transaction date, amount, and the service you believe caused it.6Amazon Web Services. AWS Billing and Cost Management – Getting Help With Your Bills and Payments Response times depend on your support plan; the free Basic plan typically returns general guidance within about one business day.7Amazon Web Services. Example: Create a Support Case for Account and Billing – AWS Support
If the charge came from a service you no longer need, terminate the resource through the console and confirm it no longer appears in your active services. Simply stopping an EC2 instance is not enough when attached storage volumes or snapshots remain. Delete or release every associated resource, or the charges continue.
Through Your Card Issuer
If you cannot access the AWS account or you believe the charge is fraudulent, contact your credit card company to dispute it. The Fair Credit Billing Act gives you 60 days from the date the statement was sent to submit a written dispute identifying the charge and explaining why you believe it is an error.8Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors The issuer must acknowledge your dispute within 30 days and resolve it within two billing cycles, up to 90 days. During the investigation, the issuer cannot try to collect the disputed amount or report it as delinquent.
For truly unauthorized credit card use, federal law caps your liability at $50, and many issuers waive even that amount as a matter of policy.9Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card If the charge hit a debit card instead, the Electronic Fund Transfer Act applies, with a similar 60-day reporting window but potentially higher liability if you miss the deadline.10Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers Do not wait. The clock starts when the statement is transmitted, not when you open it.
If You Suspect Your Account Was Compromised
AWS now requires multi-factor authentication on every root user account. From your first console sign-in you have 35 days to register an MFA device before AWS begins enforcing it.11Amazon Web Services. Multi-Factor Authentication for AWS Account Root User AWS recommends a passkey or physical security key over a phone-based authenticator app, because hardware-backed methods resist phishing. Confirm the email address and phone number on the account are current first; those are your fallback if you lose the MFA device.
When compromise seems likely, open a support case under “Account and billing” and include evidence of unauthorized activity such as unfamiliar resources running in your account. Change your root password, rotate any access keys, and review CloudTrail logs for sign-ins from unfamiliar IP addresses. In confirmed compromise cases, AWS support may issue credits for the fraudulent usage.
Closing an AWS Account for Good
If you have no further use for AWS and want to guarantee no more charges, close the account through the account settings page. A few things to know first:
- Outstanding balances survive closure. You remain responsible for charges incurred before the closure date, and AWS sends a final invoice the following month. Reserved Instances and Savings Plans continue billing until they expire even after the account is closed.12Amazon Web Services. Close an AWS Account
- Marketplace subscriptions are not cancelled automatically. Cancel any software you subscribed to through the Manage Subscriptions page before closing.12Amazon Web Services. Close an AWS Account
- There is a 90-day post-closure window. During that period you can reopen the account by contacting support and paying any outstanding balance. If you reopen, charges for resources still in the account restart. After 90 days, AWS permanently deletes the account and its contents.12Amazon Web Services. Close an AWS Account
- Back up anything you want to keep. You do not need to delete individual resources before closing, but anything worth saving should be downloaded beforehand.
Before closing, spend a few minutes deleting storage volumes, snapshots, and any Elastic IP addresses manually. Some of these resources can generate charges during the post-closure period if the account is reopened, and removing them eliminates the risk entirely.4AWS re:Post. Terminate Active AWS Resources That You No Longer Need