864-266-3850

Response number used in Microsoft Azure phishing email claiming you have been charged $459.90 for "Windows Defender" and must call this number to dispute the charge. Sent from Azure as a system alert from a throw-away Azure business account.

I keep getting emails from Microsoft Azure stating that I have a a potentially unauthorized charge on my account. Transaction Details: Item name: Windows Defender. Transaction ID: PP456-997A-22B. Amount: 459.90 USD. Date: 03/18/2026.

SCAM ALERT! This is a Fake Alert Invoice  / Refund Tech Support Scam !

Quote:

Your Azure Monitor alert was triggered

Azure monitor alert rule DiskLatency-8670162-A13 was triggered for locker8670162 at March 18, 2026 12:14 UTC.

Alert rule description     MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE. Our system has detected a potentially unauthorized charge on your account. Transaction Details: Item name: Windows Defender. Transaction ID: PP456-997A-22B. Amount: 459.90 USD. Date: 03/18/2026. If you did NOT authorize this payment, contact our 24/7 Microsoft Account Security Support at +1 (864)266-3850. We apologize for any inconvenience and appreciate your prompt response. Microsoft Account Security Team.

Microsoft scam emails, are often sophisticated ones that use legitimate addresses (like Power BI) or impersonate OneDrive/Teams invites to steal credentials, sometimes even bypassing MFA by stealing tokens. These scams use fake invoices, urgent threats, and malicious attachments/links disguised as software to trick users into downloading malware or giving up login details, so always log in directly to your account to check for issues. Scammers are abusing the legitimate Microsoft Azure alert system to send these notifications, making them appear to come from an official azure-noreply@microsoft.com address.

This appears to be a phishing/ refund scam, as I do not have an Azure account and my Windows Defender is a free account without any method of charging me. No company EVER charges someone, then contacts you to dispute or cancel/refund it.  The message is to get you to call and they will pretend to give you a refund, but it is just a trick to get access to your computer.


Scammers want to connect to your computer with remote access, asking you to connect  via a website or download it and give them access. They will lie and say it is a "secure server" or similar to gain your trust in letting them on your computer. They will say you need to fill out an online refund form, then ask you to log into your bank. They pretend to give you the refund, but more than the amount stated. Then they manipulate the HTML to make it seem as if they over paid the amount and want you to reimburse it back by getting gift cards. No money is ever really transferred, but they act as if it was.

Banks transfer money bank to bank direct and never involve a person's personal computer! No business would ever ask you to go get Gift Cards as a payment method and ask you to stay on the phone the whole time. ONLY SCAMMERS DO THAT!!

---

Only a Scammer would want Remote Access to give a Refund.

Never allow anyone Remote Access unless you know them to be reputable and you contacted them first! Scammers can lock you out and hold your computer ransom by changing your username password or with Syskey (Microsoft SAM Lock Tool).

---

Help spread the word and prevent someone from becoming a victim.

Fact:

• ANYONE who calls or emails you and says you have been charged for something, offering a refund is a SCAMMER.
• ANYONE who calls or emails you and says your computer called/contacted them is a SCAMMER.
• ANYONE who calls or emails you and says your online server called/contacted them is a SCAMMER.
• Windows Operating System licenses do not expire on store bought personal computers.
• ANYONE who calls or emails you with a message about your computer having illegal activity, is a SCAMMER.
• Apple will never, ever call you about alleged suspicious iCloud activity.
• Microsoft error and warning messages never include phone numbers. ANY Tech Support Warning pop-ups you get while accessing the internet asking you to call a number or visit a website, is from a SCAMMER.
• Web Browsers DO NOT have the ability to determine and warn you your computer has an error. They can only warn you about a potential malicious website. A Browser is software that allows you to surf the Internet, not diagnose a computer or phone.
• ANY Tech Support company that insists you need their services because of some error, outdated software or tries to convince you that you need to allow them remote access is a SCAMMER.
• Nobody could possibly know if your computer or devices have an issue unless you tell them or gave them access.
• Tech Support companies DO NOT call or email to give out refunds because they are "going out of business", or to "cancel a subscription".  Companies DO NOT give refunds unless they have to.
• Companies DO NOT call to inform you that your subscription will be charged if you don't call back, only SCAMMERS do that. If you have a subscription with someone, they automatically charge you until you cancel it and they don't give a refund.
• Only a Scammer would want Remote Access to give a Refund.
• 3rd party Tech services DO NOT include Email account repairing or password resetting, since they can not access the email server unless it belongs to them.
• ONLY scammers ask for gift cards and NOBODY would ask you to go to the store while remaining on the phone while you do.

Please read about how Tech Support Scammers operate the scams and warn everyone possible about them.
https://en.wikipedia.org/wiki/Technical_support_scam
Microsoft -  Protect yourself from Tech Scams
Apple -Phony support calls, and other scams
Norton - Online Scams 101
How Tech Support Scams Work

Never trust a caller who wants to "help your computer" for any reason (unless you contacted them first), as they are only going to scam you. If you need Tech Support, you should contact a reputable local service.