Sanmay Ved was using Google's new domain sale service when he tried typing in the well-known address.
He was shocked when it was shown as available to buy, so he clicked the 'add to cart' button.
He said: "I was hoping I would get an error at sometime saying transaction did not go through, but I was able to complete the purchase, and my credit card was actually charged."
After the purchase was completed, he received two emails confirming the bargain.
Ownership was officially transferred to him, but minutes later he received an email from Google saying they had cancelled the order.
Mr Ved - a former Google employee - says he has contacted the firm's security team to alert them to the breach.
The incident has echoes of an embarrassing lapse by Microsoft in 2003, when it forgot to renew its Hotmail.co.uk domain name.
It was returned to the open market when ownership expired, and bought by a member of the public.
Thankfully for Microsoft, they had good intentions and immediately contacted the firm and arranged to hand it over.
Google recently rebranded itself as Alphabet, bringing all of its subsidiaries - including the Google search engine - under one umbrella organisation.
Yet Alphabet.com is owned by car manufacturer BMW, an apparent oversight by the tech giant.
COMMENTS