What is “Windows Defender Advanced Threat Protection” email scam

“Windows Defender Advanced Threat Protection” scam is a tech support scam email that claims you’ve been charged hundreds of dollars for using Windows Defender Advanced Threat Protection. The email claims that you’ve been charged for a subscription but can call customer support to refund the charge. If you were to call, you’d be connected to professional scammers who would either try to provide nonexistent tech support services or push a refund scam. Either way, nothing good will come from engaging with the “Windows Defender Advanced Threat Protection” email scam.

 

There are many somewhat different variations of the “Windows Defender Advanced Threat Protection” email scam, though they all work more or less the same. In this particular case, the email thanks you for using Windows Defender Advanced Threat Protection and informs you that your subscription has been renewed. You’re now supposedly due to pay $299.99 for the subscription. The email also claims that they supposedly tried to contact you via your registered number but were not able to get through.

The email contains a phone number for customer support, which the sender encourages you to use if you have any queries or wish to get a refund. The numbers provided in these emails may differ but calling one of them would lead to the same outcome, you’d be connected to professional scammers pretending to work for Microsoft. Alternatively, they may claim that Microsoft outsources their call center. It’s not uncommon for scammers to speak somewhat poor English, so them supposedly being outsourced employees would explain why.

If you were to call the phone number provided in such an email, you’d be connected to scammers. They would first inquire about why you’re calling and then, using a detailed script, guide you through providing them remote access to your computer. Demanding users give them remote access is an essential step in these scams. Their reasons for requesting it are often nonsense but believable enough to trick more gullible users.

If you’re dealing with a tech support scam, scammers would try to convince you that they need to check whether malware is present on your computer. If you agree to give them access, they’ll pretend to find malware and offer to remove it, as well as fix other issues. They’d then pretend to fix your device, while potentially stealing your files/information. They may also password-lock your computer. By the end of these supposed tech support sessions, you’d be asked to pay a couple of hundred dollars. If you refuse to pay, they may refuse to give you the password.

Refund scams work in a similar fashion, though instead of tech support services, scammers offer a supposed refund. The way refund scams work is scammers, using various tricks, make it seem like they accidentally “refunded” a significantly larger sum of money than intended. For example, if the sum they want to refund you is $300, they would claim that they accidentally added an additional zero and sent you $3,000. Because refund scammers request remote access to your computer and ask you to log in to your bank, they can use tricks to display fake transaction pages. For someone unaware, it may actually seem like the sum was transferred to them.

If scammers successfully convince users that they actually sent the money, they would request that users send back the difference. If users agree, they would be transferring their own money because scammers did not actually send them anything. When users are hesitant to send the money or outright refuse, scammers start using various psychological practices to convince users. For example, the scammer may start begging users to send the money because they would supposedly lose their livelihood over the mistake.

Microsoft

Dear Customer

Thanks for using Windows Defender Advanced Threat Protection. This is an invoice for your recent purchase.

We thank you on the Completion of your 1 Year.

We tried to contact you on your registered number for queries but could not get through

Amount Due: 299.99 USD

It’s not uncommon for these types of scams to be successful because the users who call the numbers are usually less tech-savvy. Victims are usually asked to pay via gift cards or wire transfers. This ensures that victims cannot get their money back and the scammers are not trackable. This happens often enough that stores selling gift cards display clear warnings about these scams. Furthermore, store clerks are sometimes trained to recognize people being potentially scammed when they buy high-value gift cards. To avoid someone warning victims that they may be getting scammed, scammers train victims how to answer certain questions asked when buying gift cards.

Unfortunately, victims who transfer money to these scammers can very rarely get it back. And because scammers are often located in other countries, it’s difficult for local law enforcement to track and punish those responsible. Nonetheless, it’s still a good idea to report these scams to authorities.

Emails like the “Windows Defender Advanced Threat Protection” scam are pretty easy to identify as such. Mainly because Microsoft does not send such emails. If you purchase something from Microsoft, the email will not have a phone number for customer support. It may contain a link to customer support options but certainly not a phone number.

Furthermore, these emails are full of grammar/spelling mistakes. And sentences like “We thank you on the Completion of your 1 Year” sound very awkward. That’s an immediate giveaway because legitimate emails from Microsoft will never have mistakes in them, nor will the company’s phrasing ever sound so awkward.

“Windows Defender Advanced Threat Protection” email scam removal

If you receive the “Windows Defender Advanced Threat Protection” or similar email scam, you can just delete it from your inbox. Do not pay attention to its content as it’s a scam. It’s worth mentioning that some of these emails may come with file attachments. It’s never a good idea to open unsolicited email attachments without double-checking them first because they could contain malware. Such emails may also contain links that could lead users to phishing/malware-ridden websites.