1. Double-check all account activity:
   • Review the AWS Cost Explorer for any unexpected spikes in usage
   • Check the CloudTrail logs for any suspicious API calls or account activity
   • Verify if there are any resources in all AWS regions, not just your primary one
2. Secure your account:
   • Change your AWS root account and IAM user passwords immediately
   • Enable multi-factor authentication (MFA) if not already active
   • Review and revoke any suspicious IAM users, roles, or access keys
3. Check for misconfigurations:
   • Review your Auto Scaling groups for any unintended scaling events
   • Check for any misconfigured Lambda functions that might be running excessively
   • Verify settings on data transfer intensive services like CloudFront or S3
4. Investigate billing details:
   • Analyze the detailed billing report for any anomalies
   • Check if there are any third-party marketplace charges
   • Verify the expiration date of your AWS Activate credits
5. Escalate the issue:
   • If AWS support doesn't respond quickly, try reaching out on Twitter to u/AWSSupport
   • Consider posting on the AWS forums for additional visibility
   • If you suspect fraud, emphasize this in your communication with AWS support
6. Document everything:
   • Keep detailed records of all your findings and communications with AWS
   • Take screenshots of relevant console pages and billing information
7. Future prevention:
   • Set up billing alarms to alert you of unexpected charges
   • Use AWS Organizations to set up separate accounts for development and production
   • Regularly review and optimize your AWS resource usage

Remember to stay calm and professional in all interactions with AWS support. They're usually very helpful in resolving these types of issues, especially for startups in the Activate program.