Fake Microsoft Defender Renewal Call
If you received a phone call that looks like a Microsoft Defender renewal call following a fake email invoice, you are looking at one of the most repeated scam patterns of the year. These messages succeed because they impersonate something familiar and pile on urgency, pushing you to get remote access and trick you into wiring or buying gift cards before you have time to verify with the real source.
The real Microsoft does not contact customers this way - and even when Microsoft does send you a legitimate notice, you can always confirm by ignoring the call and checking your real Microsoft account at account.microsoft.com instead of acting on the message itself. FakeOrLegit is not affiliated with Microsoft; this guide is independent consumer-safety information.
Below we walk through the warning signs you can check yourself, the exact steps to take if you have already engaged, and the most common follow-up questions we see in our checker.
Warning signs
- The caller demands an immediate action and refuses to let you hang up and call back through an official number.
- The caller asks for payment in gift cards, wire transfer, cryptocurrency, or by reading a verification code. No real institution requests payment this way.
- Urgency or fear language pushes a deadline within 24 hours. Real organizations almost never time-bomb account actions that fast.
- There is a request for payment, login credentials, a verification code, or sensitive identifiers (SSN, full DOB, full card number). None of these are ever needed to resolve a legitimate notice.
- Spelling, grammar, or formatting is slightly off in places a real brand would catch. Scammers iterate but rarely match design systems exactly.
- The wording matches scam reports posted on Reddit's r/scams or in recent local-news headlines. A quick search of the exact phrase is one of the fastest checks you can do.
- The message references Microsoft but the link or sender is not on Microsoft's official domain. Microsoft-related actions should always be confirmed inside Microsoft's official app or website.
What to do
- Hang up. If you want to verify, look up the real number from the official site yourself and call back.
- Never read back any verification code or one-time passcode to anyone who calls you.
- Run any link from the message through FakeOrLegit. The checker matches the URL against our heuristics and brand-impersonation database.
- If you already entered credentials, change the password and turn on two-factor authentication immediately. Sign out of all other sessions.
- If you already paid by credit card, dispute the charge with your bank within 60 days. Speed matters, earlier disputes win more often.
- Report to the FTC at reportfraud.ftc.gov. If you lost money, also file a local police report so an official case number exists.
- Watch for follow-up scams referencing the same Microsoft pretext. Scammers often re-contact under a "refund" or "support" persona within 24-72 hours.
FAQ
Run a check now
If a specific link or message triggered this guide, paste it for an instant risk report.
Related guides
Fake Microsoft Tech Support Pop-Up
Browser pop-ups claiming your computer is infected and to call Microsoft are scams. Here is how to dismiss safely.
Fake Apple Tech Support Pop-Up
Fake Apple support pop-ups target Safari users with fake virus warnings. Here is what to know.
Fake Norton Antivirus Renewal Invoice
Fake Norton or McAfee renewal invoices include a scam customer-service number. Here is what is real.
Fake McAfee Renewal Invoice
Fake McAfee renewal emails follow the same playbook as Norton. Here is the pattern.
Fake Google Chrome Virus Pop-Up
Chrome pop-ups claiming a virus or that Chrome needs updating from a third-party site are scams. Here is how to recognize.
Disclaimer
FakeOrLegit provides automated risk signals based on publicly observable patterns. We do not guarantee that any site, email, or message is safe or unsafe. Always use your own judgment, and contact the real institution directly to verify any request before sharing personal or payment information.
FakeOrLegit is not affiliated with Microsoft. Microsoft did not send and does not endorse this analysis.