How to remove Microsoft Defender Subscription Invoice scam

Microsoft Defender Subscription Invoice scam attempts to make users pay for fake services

Microsoft Defender Subscription Invoice is a scam email you may one day find in your inbox, just like numerous other people. It is a typical email that targets Microsoft Windows users in order to make them pay for the fake subscription service or believe that their email account was hacked. In reality, none of this is true and should be ignored at all costs.

Email scams are incredibly common – they either want to infect users with malware, make them pay for fake services (as is the case with the Microsoft Defender Subscription Invoice scam), or provide account credentials so they could be stolen. In all three cases, users end up being victims with rather harsh consequences. We recommend you check out the information below on how to deal with a situation and take adequate precautionary measures.

The scam message and the red flags

Scammers want to confuse users by claiming that they have purchased (or were forced to do so) an antivirus subscription for $399.99, which is an atrocious amount of money for something like an antivirus subscription. Nonetheless, some people may believe that they have already been charged and need to pay – this is precisely how crooks extort money from innocent users. Here's the main message of the scam email:

Microsoft Account

Invoice No # MS#121424028

Thank You For Shopping With Us on [date]

Billed To

Customer ID – 2102173385
Registered Email Address – [email]
Invoice Number – # MS#121424028

Windows Defender Advanced Threat protection Firewall & Network protection (One Year Subscription) $399.99

In reality, Microsoft Defender is a free antivirus, and it comes together with any copy of the Windows operating system. If you proceed with the instructions and pay the required sum, it would go directly to scammers' pockets, so you should refrain from doing that.

To recognize the signs of deception, these are a few pointers you should pay attention to (you can also adapt these observations and use them for other emails of dubious nature):

1. All invoices should have your personal information included, such as your full name and address.
2. Even though the sender is shown as “Windows Defender Store,” the real email used for this comes from a Gmail account, which official parties would never use.
3. The official name for the security software that comes free with Windows is called “Microsoft Defender” and not “Windows Defender.” The latter name has been used for many years before but was changed in August 2016 along with Windows 10 Creators Update release.^[1]
4. Windows logo is outdated.

It is worth noting that there is a backup plan within the Microsoft Defender Subscription Invoice scam email. When checking the rest of the fake “invoice,” which claims that users who believe that the email was sent to them by mistake should contact an alleged Microsoft support via the phone, which is allegedly toll-free.

This is another step where some users may slip, as they would immediately know they haven't purchased anything and call the number immediately. Unfortunately, they would be calling the same cybercriminals who created the Microsoft Defender Subscription Invoice scam, and they could try convincing you to pay the required sum or that your system is infected.

In the worst-case scenario, they may ask you to provide remote access to your PC, which could result in malware^[2] infections. Under no circumstances should you allow anyone to connect to your computer remotely unless you yourself contacted a legitimate support service and know that people are trustworthy.

What to do now?

First of all, you may have a question: why did they send this scam email to me? The answer is relatively simple – cybercriminals buy a bunch of email account names from underground forums (these go for very cheap) that were leaked from some data breach or in some other way. These things happen all the time, and most people's emails can be found in the databases of cybercriminals.

However, that's all they know – that's why there's no name or address attached to the scam email. Some users might get scammed using this information, and the Microsoft Defender Subscription Invoice scam is just one of many examples of how they are trying to trick vulnerable people.

If you have interacted with the email – clicked links, and entered your personal information, be wary that more phishing^[3] attempts might come your way, including phone calls or scam emails. Therefore, be extremely wary and do not provide any personal information or pay for fake services when dealing with suspicious calls or emails.

Likewise, we recommend you check your system for malware infections with SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to make sure that no infections are present. Additionally, you should change your passwords if you think that your email account could have been leaked, especially if you reuse passwords. Cleaning web browsers and other junk files from the system is advisable – FortectIntego can be employed for that. The app can also fix virus damage if such has occurred during the infection.