Microsoft Defender emailed a renewal charge, is this a refund scam?
Last reviewed: 2026-08-01 · Checked with Hunch’s on-device engine, the same one inside the extension. How Hunch checks →
Part of our guide: How to avoid online shopping scams →
Yes. A "your Microsoft Defender subscription auto-renewed for $349.99, call or dispute within 24 hours" email that links to microsoft-billing.example is a tech-support refund scam. Microsoft doesn't bill you through look-alike domains or push you to call a number to "cancel." The oversized charge is bait: the fake dispute leads to a caller who "refunds" you and then tricks you into giving remote access or sending money back.
Got a message like this? Paste it here →
This targets people who trust the Microsoft name and worry about an unexpected charge, often older users less sure how to check a subscription. The scary total pushes them to "dispute" fast, and the microsoft-billing.example link or phone number hands them to a scammer who turns a fake refund into remote access or a wire transfer.
Illustrative example of the pattern, not a real message someone received.
How to verify it yourself
- Don't call the number or click the link. Check real subscriptions at account.microsoft.com typed by hand.
- Read the domain: Microsoft uses microsoft.com, not microsoft-billing.example or any add-on host.
- Microsoft never asks you to call a number in an email to get a refund, and never needs remote access to your PC to issue one.
- If a "refund agent" asks you to install software or open your banking, hang up. That's the scam's core move.
Common questions
is microsoft-billing.example a real Microsoft site
No. Microsoft billing lives at microsoft.com and account.microsoft.com. microsoft-billing.example is a fake set up to start a refund-scam call.
did Microsoft Defender really charge me $349.99
Check account.microsoft.com before believing it. If no such subscription or charge exists, the email invented it to get you to call or click.
how does the Microsoft renewal refund scam work
You call to "cancel," the agent offers a refund, then claims they sent too much and needs remote access or a transfer back. That's how they steal from you.
how do I check my real Microsoft subscriptions
Sign in at account.microsoft.com yourself and review Services & subscriptions. Anything real appears there; a fake renewal won't.
If you already responded
- If you let anyone connect to your computer, disconnect from the internet and run a full security scan or get local IT help.
- Call your bank using the number on your card to reverse any transfer and watch for further attempts.
- Change passwords for anything you accessed while they were connected, and report it at reportfraud.ftc.gov.
Source: FTC, How To Recognize and Avoid Phishing Scams
Hunch is not affiliated with Microsoft. Microsoft is named only to describe a scam that impersonates it; the real Microsoft does not send these messages.