Phishing emails related to Azure orders

Question

Phishing emails related to Azure orders

Michael Rothermel 50

I received two emails "Azure Moniter alert was triggered." First one says "Activated" Payment Received. The second one says "Deactivated". Phone numbers are listed to call if I did not make an order for Azure. Are these phishing emails? What do I do now?

John Ruble 10 Reputation points

2026-03-09T18:55:41.53+00:00

I received the same two emails and tried to contact Microsoft support but was told to ask here instead. Here is more information about the two emails I received (anything within brackets [] is redacted by me, just in case it's legitimate info):

Sender address: azure-noreply@microsoft.com
Subject (email 1): Azure: Activated Severity: 2 Payment Received Invoice [invoice #]
Subject (email 2): Azure: Deactivated Severity: 2 Payment Received Invoice [invoice #]

Main text:

Alert rule description: MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE (REF: [reference code]). Our system has detected a potentially unauthorized charge on your account . Transaction Details: Merchant: Windows Defender . Transaction ID: [transaction code] . Amount: 349.90 USD . Date: 03/09/2026 . To prevent possible account suspension or additional fees, please verify this transaction immediately . If you did NOT authorize this payment, contact our 24/7 Microsoft Account Security Support at +1 (808) 216-8505 or +1 (805) 258-4288 . We apologize for any inconvenience and appreciate your prompt response . Microsoft Account Security Team

Can anyone confirm if this is legitimate? I suspect it's a phishing attempt but the @microsoft.com domain is making me unsure.
Yvette Bigelow 0 Reputation points

2026-03-10T10:22:41.53+00:00

How are we supposed to detect email spoof from microsoft.com??? yikes. (Weird content triggered googling the phone numbers, but still...)

Answer accepted by question author

0 additional answers

Your answer

John Ruble 10 Reputation points

2026-03-09T18:55:41.53+00:00

I received the same two emails and tried to contact Microsoft support but was told to ask here instead. Here is more information about the two emails I received (anything within brackets [] is redacted by me, just in case it's legitimate info):

Sender address: azure-noreply@microsoft.com
Subject (email 1): Azure: Activated Severity: 2 Payment Received Invoice [invoice #]
Subject (email 2): Azure: Deactivated Severity: 2 Payment Received Invoice [invoice #]

Main text:

Alert rule description: MICROSOFT CORPORATION BILLING AND ACCOUNT SECURITY NOTICE (REF: [reference code]). Our system has detected a potentially unauthorized charge on your account . Transaction Details: Merchant: Windows Defender . Transaction ID: [transaction code] . Amount: 349.90 USD . Date: 03/09/2026 . To prevent possible account suspension or additional fees, please verify this transaction immediately . If you did NOT authorize this payment, contact our 24/7 Microsoft Account Security Support at +1 (808) 216-8505 or +1 (805) 258-4288 . We apologize for any inconvenience and appreciate your prompt response . Microsoft Account Security Team

Can anyone confirm if this is legitimate? I suspect it's a phishing attempt but the @microsoft.com domain is making me unsure.
Yvette Bigelow 0 Reputation points

2026-03-10T10:22:41.53+00:00

How are we supposed to detect email spoof from microsoft.com??? yikes. (Weird content triggered googling the phone numbers, but still...)

Answer 1

TP 152.1K Volunteer Moderator

Hi Michael,

DO NOT call the phone numbers in those emails. Delete the messages, scammers are trying to get you to call.

It appears what is happening is bad actors get access to an Azure subscription, set up Alerts with potential victim's email address (your email) set as recipient, then trigger alert. In the text of the alert they mention things like Fraud Prevention System, Windows Defender, some substantial $ amount, account suspension, Fraud Resolution Hotline, etc., and their goal is for you to call a phone number.

DO NOT call any phone number in the email and DO NOT click on any links. They want you to call them so they can scam you.

NOTE: In a sense, the emails are "legit" in that they are coming from a real Microsoft email address, however, the text contained in the alert emails are written by scammers trying to trick you into calling them.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

John Ruble 10 Reputation points

2026-03-09T19:01:33.8866667+00:00

Thanks for this confirmation; I had the same question.

Do I understand correctly that these emails do not necessarily indicate that our accounts have been breached (or any other security concern, other than that they've somehow identified our Microsoft accounts as targets)?

Is there any action we need to take other than deleting the emails and changing Microsoft account passwords as a precaution? I just received a 3rd and 4th email about this; is there anything I can do to prevent future emails (other than blocking the sender, which seems non-optimal since it's a legitimate Microsoft email address)?
TP 152.1K Reputation points Volunteer Moderator

2026-03-09T19:18:16.7233333+00:00

@John Ruble I don't recommend blocking the sender since these scam messages are coming from legitimate Microsoft address and email system. You are correct it doesn't (by itself) indicate your account has been compromised.

In the email you can see the Azure subscription ID of the subscription that is being used to send you messages. Look for Rule ID: /subscriptions/<Subscription ID>

If you (or a company you work for or associate with) has an Azure subscription, you should check if this subscription ID matches any of your/their subscriptions. If it does match you know you/they have security issue.
Michael Rothermel 50 Reputation points

2026-03-09T19:18:38.2633333+00:00

That's what I thought! I was about to block them in my email account, but if this is from a legit Microsoft email address, what is the best thing to do?
Nicholas Szrejter 0 Reputation points

2026-03-10T04:24:13.4666667+00:00

I've rec'd 3 of these so far though the dollar amounts vary.....
DL 5 Reputation points

2026-03-10T16:51:40.7566667+00:00

I also received the back-to-back emails 3/9/26 (9:14 AM EDT & 10:07 AM EDT). I have no MS Azure subscriptions. My question is: WHAT IS MS DOING ABOUT THE BAD ACTORS?
Hercules Mazucato 0 Reputation points

2026-03-11T02:42:27.2466667+00:00

Thank you for this response. The email is legit from Microsoft but scammers are working around Azure services to make you believe that it is something related to your account and adding in the alert a custom message to trick you believe that the phone numbers are from Microsoft as well. To anyone who visits this in the future: DO NOT CALL THE NUMBERS, NO MATTER WHAT THE MESSAGE SAYS!

Share via

Phishing emails related to Azure orders

0 additional answers

Your answer