How to Identify a Fake Microsoft Defender Subscription Email

Inspect the 'From' address in your email client. Legitimate Microsoft emails will typically originate from an official '@microsoft.com' domain, not generic providers like Gmail or unusual web addresses.

Do not call the phone number provided in the email. Instead, visit Microsoft's official website and check their customer-service listings to see if the number matches their documented support channels.

Scan the email body for poor grammar, spelling mistakes, or a false sense of urgency (e.g., 'Your account will be charged immediately if you do not respond'). Official communications are professionally written.

Open the suspicious message in your email app. In Outlook, double-click the email to open it in a new window, then click File > Properties.

Look for the 'Internet headers' box at the bottom of the Properties window. You can scroll through this text or copy it into a text editor.

Search for the 'Return-Path' and 'Received' fields. These fields reveal the actual server that sent the email, which will usually point to a non-Microsoft server if it is a phishing attempt.

In Outlook, select the suspicious email, go to the Home tab on the ribbon, and click 'Report Message', then select 'Phishing'.

Right-click the fraudulent email in your inbox list, navigate to 'Junk', and click 'Block Sender' to prevent future emails from that specific address.

Move the email to your Deleted Items folder, then empty the folder to ensure no accidental clicks happen later.