Windows Defender Security Center e-mail scam: how to spot it and what to do
The "Windows Defender Security Center" pop-up is a fake tech support scam designed to extort money. It falsely claims your PC is infected and pressures you to call a fake support number.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Do it yourself · free Remove Windows Defender Security Center e-mail scam yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Windows Defender Security Center e-mail scam: summary
| Distribution | Shady websites; deceptive ads; freeware installations |
|---|---|
| NAME | Windows Defender Security Center |
| TYPE | Phishing attempt; adware |
| SYMPTOMS | A fake message appears trying to convince users that their system is in danger |
| DANGERS | Scammers can lure out personal information, convince victims to pay for bogus security software, or infect their systems with malware |
| Name | Windows Defender Security Center |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 10 more facts
| Type | Phishing message |
|---|---|
| Symptoms | A phishing e-mail asking you to sign in and a support phone number shown on screen |
| Evidence | 6 write-ups by security sites; no sample analysed yet |
| Arrives as | |
| Pretends to be | Microsoft |
| Claim | Your account needs urgent attention |
| Asks for | Your password |
| Phone number | 865-484-6972 |
| First seen | 12 May 2022 |
| Facts checked | 5 October 2026 |
What the Windows Defender Security Center e-mail scam e-mail looks like
Text of a phishing e-mail asking you to sign in, as people saw it
Windows-Defender - Security Warning
** ACCESS TO THIS PC HAS BEEN BLOCKED FOR SECURITY REASONS **
Your computer has alerted us that it has been infected with a DOSAttack Spyware. The following data has been compromised.
> Email Credentials
> Banking Passwords
> Facebook Login
> Pictures & Documents
Windows-Defender Scan has found potentially unwanted Adware on this device that can steal your passwords, online identity, financial information, personal files, pictures or documents.
You must contact us immediately so that our engineers can walk you through the removal process over the phone.
Call Microsoft Support immediately to report this threat, prevent identity theft and unlock access to this device.
Closing this window will put your personal information at risk and lead to a suspension of your Windows Registration.
Call Microsoft Support: 1-865-484-6972 (Toll Free)
From our report of May 2022 · not reviewed since
Distribution methods
Users rarely stumble upon Windows tech support scams through the search results.
They hide in other shady pages that often engage in illegal activities. Unregulated sites can be full of deceptive ads and sneaky redirects so be careful while browsing the web and do not click on random links and buttons.
Another thing you should note is the danger of peer-to-peer file-sharing platforms, and torrent websites. They are breeding grounds for all kinds of malware. The best you can do is get your software from official developer websites. Even though it might get costly, you will most likely save in the long run by keeping your system safe and healthy.
Your machine could also be infected by adware which is causing this erratic behavior. It is a type of PUP (potentially unwanted program) that can generate commercial content on your device. You may experience pop-ups, banners, and redirects. They can appear without any user input.
Adware is most often spread through freeware distribution platforms. They include additional programs in the installers without clearly disclosing it. Usually, people just skip through the installation process to be able to test the new software as soon as possible and this is the biggest mistake.
To avoid PUPs from sneaking into your system, you should apply certain security measures. Always choose the "Custom" or "Advanced" installation methods, read the Privacy Policy and Terms of Use. The most crucial part is to inspect the file list and uncheck the boxes next to any suspicious or unrelated items.
How to tell the Windows Defender Security Center e-mail scam e-mail is fake
- Phone number:
865-484-6972
From our report of May 2022 · not reviewed since
More from our earlier report on Windows Defender Security Center
- Check your browser for malicious extensions and scan your machine with anti-malware tools
Is Windows Defender Security Center e-mail scam dangerous? What the senders want
From our report of May 2022 · not reviewed since
"Windows Defender Security Center" pop-up scam can cause monetary losses and damage to your system
"Windows Defender Security Center" pop-up is a fake message created by crooks to make a profit from innocent Windows users.
The scam tries to convince people that their system is in danger because it was infected by spyware. Fraudsters use clever deception tactics to scare people into taking action.
Scammers want people to call the provided number. Once on the call, they try to gain remote access to the device by trying to convince users that they will solve the problem. Then they can start performing fake system scans, uninstall trustworthy security tools, and download fake antivirus software. Users' machines can get infected by malware, trojans, and ransomware.
People should also be aware that scammers are capable of installing RATs (Remote Access Trojans). They provide the ability to access the machine without the users' knowledge for an unlimited amount of time. Fraudsters can gain control over users' personal files, like photos, videos, documents. The data can be sold on underground forums or used for blackmail.
From our report of May 2022 · not reviewed since
Social engineering techniques
The "Windows Defender Security Center" pop-up scam displays this message:
The page is disguised to look like a legitimate Microsoft alert that warns about danger. Multiple banners show up on the screen to intimidate users even more. People may also see a supposed system scan in process. It is just a fake animation meant to make the pop-up look legitimate.
As you can see, the message gives the impression that users' computers have been blocked because they are infected by spyware. There should be no need to mention that this is not true.
Microsoft will never randomly show alerts while you are browsing the web. If you see such a message, look for grammar and spelling mistakes, as crooks often make them. Also, inspect the URL and determine if it seems legitimate.
What to do after the Windows Defender Security Center e-mail
If you only received the message and clicked nothing, step 3 is all you need.
If you clicked the link or typed anything on the page it opened, do every step, starting with the password.
Step 1: Change the password you typed on the fake page
If you entered a password after clicking the link in the Windows Defender Security Center message, treat that account as known to the sender.
Open the provider's real site by typing its address yourself, not through any link in the e-mail, and change the password there. Choose a new one you have never used before, and change it on every other account that shared the old one.
Then use the option to sign out of all other sessions or devices, if the provider has one. This works the same in any browser on Windows 11 and Windows 10.
Microsoft account, Security page (account.microsoft.com/security): Change password. Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 2: Turn on two-step verification
Two-step verification asks for a code from your phone or an authenticator app whenever someone signs in from a new device. A stolen password alone is then not enough to open the mailbox.
Turn it on in the security settings of the e-mail account first, then for the bank, shop and social accounts that send their reset links to that address.
While you are there, check the recovery e-mail and phone number and the forwarding rules, which attackers sometimes change to keep access. The settings pages look the same on Windows 11 and Windows 10.
Microsoft account: Manage how I sign in, where two-step verification and the sign-in methods are. Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 3: Report the e-mail and delete it
Report the message instead of only deleting it. In Outlook choose Report > Report phishing, in Gmail the three-dot menu > Report phishing; the provider then blocks the same message for other people.
Do not reply and do not click anything else in it. On a work account, forward it to your IT team as an attachment first. Web mail and the mail apps on Windows 11 and Windows 10 offer the same options.
New Outlook for Windows and Outlook on the web: Report > Report phishing. Full procedure with screenshots: Report a phishing e-mail
Step 4: Scan the PC if you opened a file from the message
A page that only asked for a password installs nothing, so most readers can skip this step.
If the Windows Defender Security Center e-mail or the page it opened made you download or open a file, delete it and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
From our report of May 2022 · not reviewed since
Remove possible browser hijackers
The "Windows Defender Security Center" pop-up scam might have appeared because your browser is hijacked.
You can learn more about how browser hijackers operate from the articles we wrote about the most recently detected ones, like Custom Search Bar, Clear Search, and Live-Secure.
MS Edge (Chromium)
MS Edge (legacy)
You should clear your browsers from cookies and cache. Cookies are small text files that can store information such as your IP address, geolocation, websites you visit, links you click on, and things you purchase online. Some websites and browser add-ons can collect this data and later sell it to advertising networks or other third parties.
Use a maintenance tool like for a quick and easy process. This powerful software can get rid of cookies and cache automatically. Besides, it can fix various system errors, corrupted files, and registry issues which is especially helpful after a virus infection.
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all the suspicious plugins that might be related to the unwanted program by clicking Remove.
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the window's top-right).
- Select Add-ons.
- In here, select the unwanted plugin and click Remove.
- Open Edge and click select Settings > Extensions.
- Delete unwanted extensions by clicking Remove.
- Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
- From the list, pick the extension and click on the Gear icon.
- Click on Uninstall at the bottom.
From our report of May 2022 · not reviewed since
Scan your machine with professional security tools
and are great options because they are proven and trusted anti-malware tools.
They can detect most threats hiding in your machine, and eliminate them completely. Security software can also warn users about potential threats before they can make any changes.
Manual removal can sometimes result in the renewal of infection as users fail to eliminate all the related files that are hidden in various folders. Besides, crooks often disguise PUPs as "handy" tools to not cause any suspicion.
It can be difficult to identify threats if users do not know their exact names. A PUA can look like antivirus software, system optimizer, etc. However, if you still want to do this yourself, you can proceed with the guide below:
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till the uninstallation process is complete and click OK.
Questions about Windows Defender Security Center e-mail scam
Is this Windows Defender warning legitimate?
No. This pop-up is completely fake. Microsoft will never display random security warnings while you browse the web. The message falsely claims your computer is infected with spyware and threatens suspension of Windows registration.
It provides a fake phone number and urges immediate action to intimidate you. The message includes forged graphics mimicking legitimate Microsoft alerts but contains telltale grammar and spelling mistakes. The fake animation of a scanning process is designed to make the pop-up appear legitimate when no actual scan is occurring.
What does the scam message claim?
The fake pop-up claims your computer has been infected with DOS Attack Spyware and that your email credentials, banking passwords, and Facebook login have been compromised. It falsely warns that closing the window will put your personal information at risk and lead to Windows registration suspension.
It displays multiple alarming banners to intimidate users. The message provides a fake Microsoft Support number: 1-865-484-6972. All claims are fabricated to pressure you into calling the number where scammers await to gain remote access to your PC.
What happens if I call the number?
If you call the fake support number, scammers will answer claiming to be Microsoft support engineers. They will request remote access to your computer using tools like TeamViewer or AnyDesk. Once they have access, they perform fake system scans, uninstall your legitimate security software, and install fake antivirus programs.
They may steal your files, including photos, documents, and videos. They can install Remote Access Trojans for unlimited future access. They might trick you into paying for fake security services or asking for banking credentials.
How does this scam get on my computer?
The fake pop-up typically appears when browsing shady websites, clicking deceptive advertisements, or visiting compromised pages. Unregulated websites are often filled with deceptive ads and sneaky redirects. Malicious ads can appear on legitimate websites that have been hacked.
Torrent websites and peer-to-peer file-sharing platforms are breeding grounds for malware and scam redirects. Adware on your system can generate these fake pop-ups. In rare cases, clicking suspicious links in phishing emails redirects to pages displaying this scam.
Should I close the pop-up?
Yes, close it immediately without clicking any buttons or links within the pop-up. The pop-up is a scam, and nothing within it will help you. Simply close the browser tab or window.
If the pop-up prevents you from closing it, use Task Manager to force-close the browser. Press Ctrl+Alt+Delete, select Task Manager, find your browser, and click End Task. If the pop-up appears on every site you visit, adware is likely installed on your system and requires removal with anti-malware tools.
What if adware is causing repeated pop-ups?
Your machine could be infected by adware generating this erratic pop-up behavior repeatedly. Adware is a type of potentially unwanted program that generates commercial content on your device.
You may experience pop-ups, banners, and redirects without user input. Adware spreads through freeware distribution platforms that include additional programs without clear disclosure.
Install reputable anti-malware software and run a full system scan. Check your browser extensions and remove suspicious additions. Clear your browser cookies and cache to remove stored malicious data.
Could a browser hijacker cause this?
Yes. Browser hijackers can display fake security warnings and redirect you to scam pages. Check your browser extensions by opening your browser menu and selecting Extensions.
Uninstall any suspicious or unfamiliar plugins. In Firefox, click the Menu and remove unwanted extensions. In Edge, select Settings and Extensions, then delete unwanted ones.
In Safari, click the Menu, select Extensions, and uninstall suspicious items. Also clear cookies and cache from your browser settings to remove tracking data. Consider using anti-malware software for comprehensive browser cleanup.
How do I clean my system after encountering this scam?
Do not panic if you saw the pop-up but did not click anything. Simply close the pop-up and continue.
However, if you provided credit card information or gave remote access, contact your bank immediately and monitor your accounts. If remote access was granted, reset all passwords from another device and run anti-malware scans on multiple computers.
Install reputable security software and run full system scans. Clear all browser extensions and cookies. Consider taking your device to a professional if you granted remote access to scammers.
Will Fortect remove Windows Defender Security Center?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Windows Defender Security Center, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Proofpoint: What is a Remote Access Trojan (RAT)? (read October 5, 2026)
- Smallbusiness: What Are the Dangers of Torrents? (read October 5, 2026)
- Malwarebytes: Adware (read October 5, 2026)
- Wikipedia, the free encyclopedia: Potentially unwanted program (read October 5, 2026)
- Infosecurity: Tales From the SOC: Dealing with the Dangers of Freeware (read October 5, 2026)