Suspicious Login Issues

How to Identify and Handle Microsoft Defender Subscription Phishing Emails

Maira Mehtab Sep 22, 2026 868 views

Question details

The user received an unexpected email claiming that a Microsoft Defender for Office 365 subscription was purchased and is unsure if it is legitimate.

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Receiving a suspicious subscription purchase confirmation email requesting payment or a refund phone call.
Observed behavior: The email claims a subscription was activated and urges the recipient to call a provided customer support phone number or click links to process a refund or payment.

Before you start

Do not click any links, download any attachments, or call the phone numbers listed in the suspicious email, as these are designed to steal your personal information.

Solution 1Recommended

Report and Delete the Phishing Message

Protect your account and personal information by properly identifying, reporting, and removing the fraudulent email from your inbox.

Scammers often use fake invoices for Microsoft Defender to create a false sense of urgency. Their goal is to trick you into calling a fake support number where they will attempt to steal your financial information or gain remote access to your device.

Verify the sender address

Check the sender's actual email address, not just the display name. Legitimate Microsoft emails will end in '@microsoft.com' or '@accountprotection.microsoft.com'.

Do not engage with the email

Refrain from replying to the email, clicking any of the embedded links, or dialing the refund phone number provided in the message.

Report the email as phishing

Use your email provider's built-in 'Report Phishing' or 'Mark as Spam' button to flag the malicious sender and help improve spam filters.

Delete the message

Once reported, permanently delete the email from your inbox and your deleted items folder to prevent accidental clicks in the future.

Official Microsoft Communication: Microsoft will never send unexpected emails asking you to call a phone number to process a refund, cancel a subscription, or update your payment details.

Free Microsoft Office alternative

Experience a Secure and Reliable Office Suite with WPS Office

Tired of navigating confusing software subscriptions and dealing with related billing phishing scams? Switch to WPS Office, a free, lightweight, and highly secure alternative to Microsoft Office. It offers a familiar interface and seamless document compatibility without the hassle of complex licensing.

1. Download the software: Visit the official WPS Office website to download the free installer for your operating system.
2. Install WPS Office: Run the setup file and follow the on-screen instructions to complete the fast installation process.
3. Open your files: Launch WPS Office and directly open your existing Microsoft Office documents with perfect formatting preservation.

Free to use with a fast and lightweight installation processFully compatible with Microsoft Word, Excel, and PowerPoint file formatsNo complex subscription models or unexpected billing emails to manageBuilt-in document protection and encryption features to keep your files safe

Frequently Asked Questions

What happens if I called the number in the fake Microsoft Defender email?

If you called the number and provided sensitive financial information or allowed remote access to your computer, contact your bank immediately to secure your accounts, change your passwords from a secure device, and run a comprehensive malware scan on your computer.

How can I verify if a Microsoft subscription charge is real?

You can verify genuine Microsoft charges by opening a new browser tab, logging directly into your Microsoft account at account.microsoft.com, and navigating to the 'Services & subscriptions' or 'Payment & billing' sections. Never use the links provided in a suspicious email to check your account.

Why am I receiving these fake subscription emails if I don't use Microsoft Defender?

Scammers send out these phishing emails indiscriminately in massive batches to thousands of email addresses. They rely on the hope that a small percentage of recipients will panic about an unauthorized charge and immediately call the fake support number without verifying the claim.

Microsoft Office Security Issues