Windows Defender Subscription EMAIL SCAM (Virus removal guide)

What is Windows Defender Subscription email scam?

Windows Defender Subscription email is a refund scam that targets victims through emails with the subject ‘Order Confirmation’. The scam claims that Windows Defender Subscription has renewed. Some of the refund scam emails mentioned Windows Defender Subscription, Microsoft Defender plan, Windows Defender Advanced Threat Protection Firewall & Network Protection, Microsoft firewall defender. We have examined these emails, which are actually part of a well-known “phishing” attack designed to trick recipients into divulging personal information.

The phone numbers listed in some of the Windows Defender Subscription scam emails were +1 (845) 295 5293, +1(845) 315-6872.

It is important to emphasize that these emails are in no way associated with Microsoft and its products. Windows Defender Subscription emails are nothing more than a fake designed to deceive recipients into giving up confidential information.

The goal of the scammers is to trick recipients into calling a fake hotline and claiming a refund for a supposed Windows Defender Subscription product renewal. Finally, the scammers requested bank account or credit card details, claiming that a refund would be processed. In fact, they would take the financial information and try to steal the funds.

QUICK LINKS

• What is Windows Defender Subscription EMAIL SCAM?
• Why am i getting Windows Defender Subscription emails?
• What to do when you receive the scam email?

Windows Defender Subscription Email Scam Example #1

One Windows Defender Subscription scam email we reviewed was from hduejdjw2032@gmail.com. It claimed that an “One Year Subscription” for Windows Defender Advanced Threat Protection Firewall & Network Protection had been renewed. The email also listed the phone number that began with the 845 area code. The phone number and email address are managed by scammers:

Dear Customer

Customer ID – 20920538

Email Address -xxxxxxxxx

INVOICE NUMBER

MS-1714-411104

DATE OF ISSUE

July 09 August, 2022

PRODUCTS ORDERED (1)

Windows Defender Advanced Threat Protection Firewall & Network Protection (One Year Subscription)

Quantity: 1

Product Price $299.99

ORDER DETAILS

Subtotal $299.99
Tax $0.00
Total $299.99

Dear customer,

If You didn’t make this purchase or if you believe an unauthorized person is attempting to access your Microsoft account Call to our customer care representative +1(845) 295-5293 (Toll Free).
This Email confirms payment for the Microsoft Defender listed above. You will be each plan period until you cancel by downloading to the Microsoft Defender plan from your PC.
You May contact Microsoft for a full refund within 48 Hrs of a monthly Subscription upgrade or within 72 Hrs after yearly payment. Partial refunds are available where required by law.
Regards

Microsoft Account Team
Phone: 18452-955293

Windows Defender Subscription Email Scam Example #2

Another Windows Defender Subscription scam email was from “Windows Defender Order kdflweprtoe0934@gmail.com”. It mentioned Microsoft firewall defender. Like the previous one, this email was sent from a suspicious address, and it also contains the fake product name and the phone number that began with the 845 area code. The email address and phone number are part of the scam and are not managed by Microsoft:

Thank you for using our services.

This email is regarding your purchase of Microsoft defender. Please check below for more details of invoice.

Customer Id: xxxxxxxx
Invoice Id: xxxxxxx
Email: xxxxxxxxx
Invoice Date: xxxxxxx

Product
Microsoft firewall defender

Decriptions
1 Year Subscription Valid till 20th Octover 2022

Quantity
1

Amount
$449

Discount
$50

Total
$399

Dear partner if you find above information incorrect please contact our customer service executive to resolve the issue. If you didn’t’ make this purchase or want to cancel you purchase you can contact our customer service executive he’ll help you to get a full refund of your amount. Please contact our customer care representative within 48 hours of receiving this invoice details. Customer service representative contact: +1(845) 315-6872.

Threat Summary

Name	Windows Defender Subscription Email Scam
Type	Refund scam, Tech Support Scam, Phishing, Social Engineering
Email Subject Line	“Order Confirmation”
Fake Claims	Windows Defender Subscription Subscription has been renewed
Scammers Phone Numbers	+1-(845) 295-5293, +1(845) 315-6872
Distribution methods	spam email campaigns
Removal	Links in scam emails can lead to sites or files with viruses or other malicious content. To scan your computer for viruses, find and remove malware, we recommend using the steps below.

Examples of email scams

Windows Defender Subscription email scam is just one of the many types of scam emails that exist. In some emails, scammers use threats to intimidate and bully a victim into paying, others contain links to malicious files. Geek Squad EMAIL SCAM, Norton Subscription Has Expired, Unfortunately, there are some bad news for you, DHL Undelivered Package are some of the scam emails we reported recently.

Why am i getting Windows Defender Subscription emails?

Scammers use different ways to promote the “Windows Defender Subscription” scam, most common of which is usually Email spam campaigns. In addition, the scam can be promoted through social networks (Facebook, YouTube, Twitter, Instagram), deceptive ads and push notifications, as well as Adware and potentially unwanted applications (PUAs).

Adware is type of malware. It can generate numerous additional popup, banner, pop-under and in-text link advertisements; gather your personal data such as login details, online searches, etc; run in the background and drag down your computer running speed; give more chances for other adware, PUAs even malware to get on your PC.

What to do when you receive the scam email?

We advise everyone who receives the “Windows Defender Subscription” scam to follow a few simple steps below. If you receive such emails regularly, then this may be a sign that there is adware, trojan or spyware on your computer. In this case, you need to scan the computer for malware, remove unnecessary and suspicious apps.

• Do not believe this email.
• NEVER share your personal information.
• If there’s a link in the scam email, do not click it.
• Report the scam email to the FTC at https://www.ftc.gov/
• Scan your PC for malware.
• Install an anti-phishing software.

How to scan your computer for malware

If you suspect that your computer is infected with spyware, you accidentally clicked on a link in the scam email, or just want to scan your computer for malware, then use one of the best free malware removal tools. One of these utilities is MalwareBytes Anti Malware. It is a lightweight utility which designed to use alongside your antivirus software, detecting and removing malicious software, adware and PUPs that other security tools miss. MalwareBytes Anti Malware is easy to use, fast, does not use many resources and have great detection and removal rates.

First, please go to the link below, then click the ‘Download’ button in order to download the latest version of MalwareBytes.

When the downloading process is done, close all windows on your computer. Further, launch the file named MBSetup. If the “User Account Control” dialog box pops up like below, click the “Yes” button.

It will show the Setup wizard which will assist you install MalwareBytes on the computer. Follow the prompts and do not make any changes to default settings.

After the setup is complete successfully, press “Get Started” button. Then MalwareBytes AntiMalware will automatically run and you can see its main window such as the one below.

Next, click the “Scan” button for scanning your computer for malicious software and other security threats. A system scan can take anywhere from 5 to 30 minutes, depending on your computer. While MalwareBytes is scanning, you can see how many objects it has identified as threat.

When the scanning is done, the results are displayed in the scan report. In order to remove all threats, simply press “Quarantine” button.

We suggest you look at the following video, which completely explains the process of using MalwareBytes to remove malicious software.

If you are having issues with malware removal, then check out Kaspersky virus removal tool. It can easily remove trojans, spyware, browser hijackers, adware, worms and ransomware with all their components such as files, folders and registry entries. Visit the page linked below to download the latest version of Kaspersky virus removal tool for Windows.

How to protect yourself from phishing, malicious and misleading websites

If you want to protect yourself from phishing sites, install an ad blocking program like AdGuard. It can block malicious and misleading websites, stop unwanted ads and pop-ups while using Internet Explorer, Google Chrome, Firefox and Edge. So, if you like to surf the Internet and want to protect your computer from phishing scams, then AdGuard is your best choice.

Installing the AdGuard is simple. First you’ll need to download AdGuard by clicking on the link below.

After downloading it, double-click the downloaded file to start it. The “Setup Wizard” window will show up on the computer screen as displayed below.

Follow the prompts. AdGuard will then be installed and an icon will be placed on your desktop. A window will show up asking you to confirm that you want to see a quick guide as displayed on the screen below.

Click “Skip” button to close the window and use the default settings, or press “Get Started” to see an quick guidance which will assist you get to know AdGuard better.

Each time, when you start your system, AdGuard will start automatically and stop unwanted advertisements, block phishing, as well as other harmful or misleading websites. For an overview of all the features of the application, or to change its settings you can simply double-click on the AdGuard icon, which can be found on your desktop.

Finish words

If you receive an email that is similar but not the same as the example above, make sure you remove any personal info in this message, then post it as comment on this article. It will help our team monitor the latest scams.