Microsoft Defender subscription invoice scam: a fake order, not a charge
The Microsoft Defender subscription invoice is a fake order confirmation that asks you to call a number to cancel a $399.99 charge that does not exist. Do not call it: Defender is built into Windows, and the call is where the scam takes your money.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Do it yourself · free Remove Microsoft Defender Subscription Invoice scam yourself 2 steps, about 6 minutes, no software needed.
Start the steps
Microsoft Defender Subscription Invoice scam: summary
| Name | Microsoft Defender Subscription Invoice scam (also sent as a "Defender Prime Express" renewal) |
|---|---|
| Type | Scam e-mail: a fake order confirmation with a phone number to call |
| Symptoms | An unexpected invoice or renewal notice for a Defender subscription, about $400, from a free-mail address, with a number to call. Nothing changes on the PC |
| How to get rid of it | Nothing to remove. Do not call, delete the e-mail, report it. If you called or let someone connect, follow the steps for that |
| Our check | Desk check on 5 October 2026 of two 2021 screenshots, Microsoft's guidance and 2026 reader reports. We did not call the number |
| First seen | Our sample is dated 23 April 2021; our report 3 August 2022; the Defender Prime Express wave July 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 10 more facts
| Damage | None from reading it. Money, card details and PC access if you call |
|---|---|
| Evidence | 4 write-ups by security sites; details still limited |
| Arrives as | |
| Pretends to be | Microsoft |
| Claim | You were charged for an order or subscription you did not make |
| Sender domain | gmail.com |
| Asks for | A phone call |
| Amount | $399.99 for a one-year subscription |
| Phone number | +1 (810) 212-2133 |
| Facts checked | 5 October 2026 |
Desk check on 5 October 2026 of two 2021 screenshots, Microsoft's guidance and 2026 reader reports. We did not call the number or hold a 2026 copy of the e-mail.
What the Defender invoice e-mail is and what it wants
The e-mail is a fake order confirmation. Nothing was bought and nothing was charged. The only thing it sells is a phone call.
- 1
It reaches your inbox
The same message goes to thousands of addresses at once. It is headed "Order Confirmation" and the sender is shown as "Windows Defender Store".
- 2
It shows an invoice
A Microsoft Account heading, an invoice number, a customer ID and one line: a one-year "Windows Defender Advanced Threat protection Firewall & Network protection" subscription for $399.99.
- 3
It offers a way out
If you "didn't make this purchase", it says, call a "customer care representative" on a number marked toll free. That number is the whole point of the message.
- 4
The caller takes over
The person who answers asks for card details, may ask you to install a remote-access program, and offers a "refund" that needs more of your money or access.
- Kind of threat
- Scam e-mail: a fake order confirmation that pushes you to call a number (a callback scam). It carries no program
- Claimed price
- $399.99 for one year (2021 sample); about $398 for a "2-Year" plan (2026 reader reports)
- Sender shown
- "Windows Defender Store", sent from a free Gmail address
- The truth
- Microsoft Defender Antivirus is built into Windows. There is no subscription to cancel and no invoice to dispute
Scam e-mails come in three kinds: those that carry malware, those that sell a fake service (this one), and those that steal account passwords. Here the damage starts only if you call, pay or let someone connect. Some readers see the amount and assume the money has already left their account, and that fear is what the sender relies on.
What the Microsoft Defender Subscription Invoice scam message looks like
Text of a fake invoice with a phone number to call, as people saw it
Order Confirmation
Microsoft Account
Invoice No # MS#121424028
Thank You For Shopping With Us on Friday, April 23, 2021.
Billed To
Customer ID - 2102173385
Registered Email Address -
Windows Defender Advanced Threat protection Firewall & Network protection (One Year Subscription) $399.99
In Words - Three Hundred Ninety Nine Dollars and Ninety Nine Cents Only.
If You didn't make this purchase or if you believe an unauthorized person is attempting to access your Microsoft account Call to our customer care representative +1 (810) 212-2133 (Toll Free).
Thanks, Microsoft Account Team
Why this e-mail reached you
Your address is on a list. Nothing on your PC was opened.
- 1
Your address was on a list
Scammers collect addresses from data breaches and lists traded among criminals. Most addresses sit on several.
- 2
That is all they know
The e-mail has no name and no postal address, and its e-mail field is empty.
- 3
They send it in bulk
Only a few of the thousands who get it need to call for the scheme to pay.
Receiving it does not mean your account was hacked. If you clicked or typed details anywhere, expect more phishing e-mails and calls.
How to tell the Microsoft Defender Subscription Invoice scam message is fake
What we checked for this update
No website to open here, so no live site test. We went through our two screenshots, the 2026 reader reports and Microsoft's guidance, and say what we could not check.
Microsoft Defender invoice e-mail · desk check · 5 October 2026
- SenderShown as "Windows Defender Store" but sent from a Gmail address. Microsoft says a real confirmation comes from the company's own domain.
- Who it is for"Billed To" has a customer ID and a blank e-mail field. No name, no address.
- The productA paid Defender subscription. Microsoft documents Defender Antivirus as built into Windows.
- The way outA phone number. Microsoft says never to call a number or click a link in such a message.
- Links and attachmentsNone in the two screenshots of this one e-mail. That says nothing about other copies; scammers change the wording from wave to wave.
- The phone numberWe did not call it. A call is what the e-mail is built to get.
- 2026 copiesWe hold no 2026 copy. The "Defender Prime Express" wave rests on Microsoft Q&A threads (July 2026) and a BBB Scam Tracker report (September 2026).
Fake, harmless unless you call The invoice is invented and the e-mail did nothing to the PC in our samples. The risk is the follow-up: the call, card details and any remote-access program. Nothing seen on this one sample is not a promise about every copy.
The invoice, line by line
Every line that makes the e-mail look official is also a clue. The table pairs what it says with what is wrong.
| What the e-mail says | What is wrong with it |
|---|---|
| Sender "Windows Defender Store" | The real address is on Gmail. Official senders do not use it. |
| "Microsoft Account" heading and logo | A logo costs nothing to copy. |
| "Thank You For Shopping With Us on Friday, April 23, 2021" | You shopped nowhere. |
| Customer ID and a blank "Registered Email Address" | The sender knows only your address. Microsoft's point: without your name they cannot take money from your account. |
| "Windows Defender Advanced Threat protection Firewall & Network protection (One Year Subscription) $399.99" | Defender Antivirus is built into Windows at no charge. The sum is meant to alarm you. |
| "Call to our customer care representative +1 (810) 212-2133 (Toll Free)" | 810 is not one of the seven US toll-free codes (800, 833, 844, 855, 866, 877, 888). Microsoft says to never call a number in a message like this. |
| Refund "within 48 Hrs" of a monthly charge or "72 Hrs" after a yearly one | An invented deadline. |
The e-mail says "Windows Defender", a name the Windows security program has not had for years. Windows 10 version 1703 (2017) renamed it Windows Defender Antivirus, and the 2004 update (2020) made it Microsoft Defender Antivirus. Our 2022 report put the change in August 2016 with the Creators Update, which was wrong: the Creators Update is version 1703, from 2017. An old name is a clue, not proof.
- Phone number:
+1 (810) 212-2133 - Sender:
gmail.com
Spotting the next invoice scam
Every fake order uses the same hook. A few habits cover all of them.
Do
- Check a charge in your bank or card app, and in the real service by typing its address yourself
- Look at the real sender address, whether a name is on the invoice and whether a phone number is the only way to cancel
- Keep Windows updated and use the built-in Windows Security, which needs no subscription
- Keep a backup of your files on a drive that is not always connected
- Report the e-mail as spam or phishing, then delete it
Don't
- Call a phone number printed in an unexpected invoice
- Click a link or open an attachment in the message
- Let anyone connect to your PC who contacted you first
- Pay for any "refund" or "cancellation" fee, or buy gift cards
- Reply, even to say it is a mistake: a reply tells them the address is live
- Hand over card details, a bank login or a one-time code
Is Microsoft Defender Subscription Invoice scam dangerous? What the senders want
The phone number is the trap
If you know you bought nothing, the e-mail tells you to call. People who call are the ones the scam is built for.
- 1
You call to cancel
Sure you bought nothing, you ring at once. That is where careful people slip.
- 2
You reach the scammers
The agent belongs to the group that sent the e-mail. Microsoft says they ask for your name, address, phone number and very likely card or bank details, "to cancel the order".
- 3
They ask for a way in
Per Microsoft, they ask you to install an application that gives them remote access, so they can pass off normal system messages as problems.
- 4
They ask for money
Fake fixes and a fee follow. Microsoft never asks for payment in cryptocurrency or gift cards.
Remote access can end in malware on your PC. Never let anyone connect unless you yourself contacted a support service you know to be genuine.
The scam over time: 2021 to 2026
23 April 2021
The date on the invoice in our sample
Our sample invoice is dated Friday, 23 April 2021: $399.99 for a one-year "Windows Defender" subscription.
3 August 2022
Our first report
We publish our guide: a bulk scam that wants a payment or a call.
July 2026
"Defender Prime Express" asks Microsoft Q&A
Two readers ask Microsoft's forum (15 and 21 July) about an e-mail for a "Defender Prime Express (2year) Plan" costing about $398. A volunteer moderator answers that it is a scam; eight readers marked "same question".
10 September 2026
A BBB Scam Tracker report
A reader reports an e-mail about a "Prime Express membership" to be charged to the payment method on file, filed as phishing. The sender address ends in onmicrosoft.com, so a Microsoft-looking sender proves nothing.
The wording changes, the pattern does not: an invented charge, a deadline and a number to call. We have not confirmed that the 2021 and 2026 e-mails share a sender.
What can really go wrong
The e-mail alone costs you nothing. Four things can.
- High
Paying the "invoice" or a "refund fee"
The money goes straight to them. Gift cards, cryptocurrency and transfers are hard or impossible to get back.
- High
Letting the caller connect to your PC
Microsoft says scammers with remote access often install malware, ransomware or other unwanted programs.
- Medium
Handing over card or bank details
Said to be for cancelling the order. Used to make real charges.
- Medium
More phishing afterwards
If you clicked or typed anything, more e-mails and calls can follow.
- Low
The e-mail itself
Reading it installs nothing; our two 2021 screenshots show no attachment or link.
What the caller may ask you for
- Your full name and address
- Your phone number
- Card number and security code
- Online banking login
- A remote-access code
- Gift card numbers
- A one-time code sent by your bank
Give none of these to anyone who contacted you first.
"Prime Defender", "Defender Prime Express" and a charge on your card
Three look-alike cases get mixed up. Only the first is this e-mail.
| What you saw | What it is | What to do |
|---|---|---|
| An e-mail about "Defender Prime Express" renewing, with a plan, an amount and a number | The same fake-order pattern as the invoice above. Microsoft's community moderators call it a scam (July 2026) | Do not call, do not click. Check your bank for a charge. Report the message and delete it |
| A line on your card statement reading "Prime Defender" or primedefender.com | A real charge, not an e-mail. primedefender.com sells a digital security service; its Trustpilot page has 29 reviews at 1.5 out of 5, and many reviewers say they met it while paying for parking or signing in elsewhere. The company replies that it is independent of those sites and offers refunds | Dispute the charge with your card issuer if you did not knowingly sign up, and ask to stop recurring payments |
| A call or pop-up saying Microsoft Defender needs a paid plan | Defender Antivirus is built into Windows. A paid-plan demand is the same scam by phone | Hang up and close the page. Do not give a card number |
If you called the number or paid
Act in this order. The bank comes first, because transfers and card payments can sometimes still be stopped within hours.
- 1
Call your bank or card issuer
Use the number on the back of your card, not one from the e-mail or the call. Say a scammer had your details or access, and ask them to block the card, contest the charge and watch for transfers.
- 2
Remove what they had you install
Open Settings > Apps > Installed apps (Windows 11) or Apps & features (Windows 10). Uninstall any program the caller had you install, such as AnyDesk, TeamViewer or ScreenConnect.
- 3
Consider a reset if they had full access
Microsoft says a reset is worth considering if you gave scammers access, especially if fake error messages keep appearing.
- 4
Run a full scan and update
Open Start > Settings > Privacy & security > Windows Security (Windows 11; Update & Security on Windows 10) > Virus & threat protection > Scan options > Full scan. Then install every pending update under Windows Update.
- 5
Change your passwords from another device
Start with e-mail and online banking, then anything you used while the caller was connected. Turn on two-step verification.
What to do about Microsoft Defender Subscription Invoice scam
Do not call the number in the message.
If you already called or let someone connect, follow every step.
Step 1: Stop replying and keep the evidence
Do not reply, pay, or send documents, even to "cancel" or "verify" something: every answer marks you as a target worth more messages. Take screenshots of the messages, the sender address, the phone numbers and any payment details, then block the sender.
If you already sent money or an ID document, the next steps cover what to do. The screenshots work the same on a phone or on Windows 11 and Windows 10, where Windows + Shift + S captures part of the screen.
Full procedure with screenshots: What to do after paying a scammer
Step 2: Report it
A report takes ten minutes and helps take Microsoft Defender Subscription Invoice scam down.
Send it to ReportFraud.ftc.gov in the US (and ic3.gov when money was lost), to Action Fraud in the UK, or to your national police in the EU, with screenshots, sender details and any payment references.
Report the message inside the mail or chat app too. Keep a copy of everything until the case is closed, whether you use a phone or a Windows 11 or Windows 10 PC.
Full procedure with screenshots: Report a cyber attack or scam to the authorities
Questions about Microsoft Defender Subscription Invoice scam
Is the Microsoft Defender subscription invoice e-mail real?
No, it is a scam. Nothing was bought and no subscription exists. The e-mail is built to look like a Microsoft order confirmation, but the sender shown as "Windows Defender Store" writes from a Gmail address, the invoice has no name or address, and the only way to dispute it is a phone number printed in the message.
Microsoft's guidance on fake order scams says never to call a number or click a link in such a message. Microsoft Defender Antivirus is part of Windows and needs no paid plan. Report the e-mail as phishing and delete it.
Was I really charged $399.99 for Microsoft Defender?
No. The amount is invented to make you worry, and nothing was taken from your account because of this e-mail. Check your bank or card app to be sure: you will not find a Microsoft Defender charge there unless you bought something separately.
You can also sign in to your Microsoft account by typing the address yourself and check your orders. The e-mail knows only your address, which is why its "Billed To" section has no name and a blank e-mail field.
Should I call the number in the invoice?
No. Calling is the one thing that turns a harmless e-mail into a loss. The number leads to the scammers who sent it, not to Microsoft. Microsoft's tech support scam page says its warning messages never include a phone number, and that it does not make unsolicited calls or send unsolicited e-mails to ask for personal or financial information.
On the line, the agent will ask for card details and may ask you to install a remote-access program. To check a charge, use your bank app.
What is Defender Prime Express, and is the renewal e-mail a scam?
Defender Prime Express is the name on a wave of fake renewal e-mails in 2026, and the e-mail is a scam. Readers wrote to Microsoft's community forum in July 2026 about a "Defender Prime Express (2year) Plan" that would charge about $398, and a volunteer moderator answered that it is a scam.
A BBB Scam Tracker report from 10 September 2026 files it as phishing. It follows the same pattern as the older invoice: an invented charge and a number to call. Do not call or click anything; report and delete it.
Is Prime Defender legit, and what is a Prime Defender charge on my card?
A "Prime Defender" charge is a real card charge, so it is a different problem from the e-mail, and we cannot call it legit or fraud. The company at primedefender.com sells a digital security service.
On Trustpilot it has 29 reviews at 1.5 out of 5, and many reviewers say they reached it while paying for parking or signing in elsewhere and were then charged.
The company replies that it is independent and offers refunds through its support. If you did not knowingly sign up, dispute the charge with your card issuer and ask to stop recurring payments. We have not tested the service.
Is Microsoft Defender free?
Yes, Microsoft Defender Antivirus is built into Windows and does not need a paid plan. Microsoft's documentation describes it as built-in antivirus and anti-malware protection, and you manage it in the Windows Security app.
If you install another antivirus program, Defender can step aside or run in passive mode next to it. An e-mail that demands payment for the Defender that came with your PC is a scam. Open Start > Settings > Privacy & security > Windows Security to see it yourself.
I called the number and gave them details. What should I do now?
Call your bank or card issuer first, using the number on your card, and say that a scammer had your details. Ask them to block the card, contest any charge and watch for transfers.
Then uninstall any remote-access program the caller asked you to install, run a full scan in Windows Security, install Windows updates and change your passwords from another device. If you gave scammers access, Microsoft says a reset may be safest. Report the call, and pay nobody who offers to recover your loss for a fee.
How do I report the Microsoft Defender invoice scam?
Report it in three places, and keep the original e-mail until you are done. Report it as phishing or spam in your mail program. In the United States, send the case to ReportFraud.ftc.gov, and forward a phishing e-mail to the Anti-Phishing Working Group at reportphishing@apwg.org, as the FTC advises.
Microsoft takes tech support scam reports at microsoft.com/reportascam. If you lost money, tell your bank the same day and add the number, the amounts and how you paid to the report. Elsewhere, use your national police or fraud service.
Will Fortect remove Microsoft Defender Subscription Invoice scam?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Microsoft Defender Subscription Invoice scam, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Microsoft Support: How to spot a "fake order" scam (read October 5, 2026)
- Microsoft Support: Protect yourself from tech support scams (read October 5, 2026)
- Microsoft Learn: Microsoft Defender Antivirus in Windows overview (read October 5, 2026)
- Wikipedia: Microsoft Defender Antivirus (1703 and 2004 renames) (read October 5, 2026)
- Microsoft Q&A: Receiving email about Defender Prime Express (15 July 2026) (read October 5, 2026)
- Microsoft Q&A: Defender Prime Express (21 July 2026) (read October 5, 2026)
- BBB Scam Tracker report 1419707 (10 September 2026) (read October 5, 2026)
- Trustpilot: primedefender.com reviews (29 reviews, 1.5 of 5) (read October 5, 2026)
- FTC: How to recognize and avoid phishing scams (read October 5, 2026)
- FCC: What is a toll-free number and how does it work (read October 5, 2026)