Susan Harvey, a woman from Madera, California, recently filed a lawsuit against Google (PDF) alleging that she lost thousands of dollars over 16 months due to her Google Play store account being hacked. In her complaint, filed in a US District Court in Eastern California, Harvey also says that when she reported the incident to Google, representatives from the company didn't believe her claims. Even after she convinced them that the transactions were fraudulent, Harvey alleges the company never made good on its promise to reimburse her.

In March 2013, Harvey bought her first Android phone and signed in using her existing Google e-mail address. She set up an account with Google using her Bank of America debit card and downloaded a trial version of a game. A little later, she updated the game to the full version. For over a year, Harvey did not notice any issues with Google Play store transactions.

By August 2014, Harvey bought a second Android phone and wanted to transfer an app she purchased in 2013 to the new phone. “Plaintiff logged on to her Google account through her computer and was notified through her Google dashboard that there were one hundred and nine (109) transactions on her account,” the complaint alleges. “Upon clicking on the appropriate tab on Google’s website, Plaintiff was shocked to find approximately six hundred and fifty (650) listed transactions, the majority of which were unrecognizable to Plaintiff, and certainly not transactions conducted by Plaintiff.”

Cross-referencing with her bank records, Harvey found that the fraudulent transactions occurred between April 15, 2013 and May 2014, costing her thousands of dollars, according to her attorney. When she contacted Google and Bank of America, both corporations asked her to file a police report, which she did, but neither company agreed to refund her the money she lost.

Harvey then went to the vendors that were listed erroneously in her transaction history. “Almost every vendor that cooperated with Plaintiff advised her the same thing: they could not identify the transaction numbers as part of their billing and the transactions cited by Plaintiff are Google transactions under which Google is receiving monies,” the complaint states.

Harvey again took her complaint back to Google, and “Google finally acknowledged that she clearly did not effectuate the transactions,” Harvey's lawyers say. Although the company promised to reimburse her, Harvey says she hasn't received a reimbursement yet.

While Harvey is suing for negligence due to Google's slow response after she told the company about the fraudulent charges, she's also claiming that Google insufficiently secured her “e-mail address, password, debit card number, expiration date, and mailing and billing addresses, in accordance with industry security standards.” Harvey alleges that a “security vulnerability” in Google's Play store “allowed hackers to obtain her Information and subsequently post fraudulent transactions” to her bank account.

Google said it had no comment, and Harvey's lawyers did not return Ars' request for comment.

While the name of the app that Harvey downloaded and then updated is unknown, some similar-sounding Android app malware issues have been in headlines in recent years. In 2013, security researchers found that dozens of apps on the Google Play store contained a malicious ad network library called BadNews, which, after being downloaded, would upload phone numbers, unique device identifiers, and other data from the compromised phone, and then ask the user to install fake app updates for legitimate apps. As recently as this February, security researchers at Avast discovered three gaming apps that appear to be normal when a user first downloads them, but then after several weeks begin to cause problems.

In March, Google officially announced that it would be ditching its automated malware scanning and move to a human-driven review of apps and updates.