Fake "Microsoft 365 subscription expired" emails: how to check if yours really ended

"Your Microsoft 365 subscription has expired. Update your payment details within 24 hours to avoid losing your emails and files." Microsoft really does send renewal notices, so this lure is believable to the person who pays for Microsoft 365 and to everyone who just uses it. This guide shows how to check a subscription in under a minute, what really happens when one ends, a sample fake, and what admins should do when the email reaches staff.

Is the "Microsoft 365 subscription expired" email real?

Usually not. A "Microsoft 365 subscription expired" or "license expired" email that asks you to click a link to update payment, sign in to "reactivate", or phone a number to cancel is a phishing email. The link leads to a fake Microsoft sign-in or billing page that steals your Microsoft 365 password, MFA code or card details.

Real notices exist. Microsoft Learn says that as a business subscription nears its end date, admins "receive a series of notifications via email and in the admin center" (Microsoft Learn). That's exactly what makes the fake believable. The difference is where you act: a real renewal is handled by signing in to the admin center or your Microsoft account yourself, never from a link or a phone number in an email.

This guide covers subscription, billing and license lures. For fake "your password expires today" emails, see fake Microsoft login pages. For "mailbox full" and "account suspended" emails, see mailbox full phishing.

Common versions of the lure

Example of a fake Microsoft 365 expiry email

This is an example written for this guide. It is not a real Microsoft email.

From: Microsoft 365 Billing <billing@m365-renewal-center.com>
Subject: Final notice: Microsoft 365 Business subscription expired

Hello jane@yourcompany.com,

We were unable to process the renewal payment for your
Microsoft 365 Business Standard subscription.

Your organization's mailboxes, OneDrive files and Teams
data will be permanently deleted within 48 hours.

To keep your services active, verify your account and
update your billing information below.

      [ Reactivate subscription ]

Questions? Call Microsoft Billing Support: +1 (8xx) xxx-xxxx

Microsoft Corporation, One Microsoft Way, Redmond, WA

Red flags: a sender domain that isn't Microsoft's, data "deleted within 48 hours", a reactivate button and a phone number for "billing support". The check below works even when the fake looks perfect.

How do I check if my Microsoft 365 subscription really expired?

Check the subscription yourself, by typing the address into your browser. Don't use any link, button or number in the email.

For business subscriptions (admins and billing contacts)

1. Go to admin.microsoft.com and sign in. You need a billing role; Microsoft Learn says Microsoft Online Services Agreement customers need at least Billing Administrator, and Microsoft Customer Agreement customers need a billing account or billing profile role (Microsoft Learn).
2. Open the subscription list. In the Dashboard view, go to Billing > Your products. In the Simplified view, select Billing. Paths at the time of writing (November 2026).
3. Select the subscription and read its status, end date and whether Recurring billing is on. Microsoft Learn says you can view the expiration date on the Your products page.
4. Compare with the email. If the subscription is active, or renews automatically, the email is fake.
5. If it really is near its end, renew it from that page, not from the email. You can turn recurring billing on from Edit recurring billing on the subscription details page.

If you're a user rather than an admin, you don't need to check anything. Licenses are your IT team's job. Report the email and tell IT.

For Microsoft 365 Family and Personal

1. Go to account.microsoft.com/services and sign in with the Microsoft account you use for Microsoft 365.
2. Look under Services & subscriptions. Microsoft's support page says a circular arrow means the plan renews automatically, with the next charge shown, and "Expires on [date]" means it ends on that date unless you renew (Microsoft Support).
3. If you don't have a Microsoft 365 subscription at all, the email is phishing.

Real Microsoft renewal notice vs fake expiry email

What really happens when a Microsoft 365 subscription expires?

When a Microsoft 365 for business subscription ends, it doesn't vanish overnight. Microsoft Learn says it moves through Active > Expired > Disabled > Deleted (Microsoft Learn). For most offers, in most countries and regions:

Global or billing admins can reactivate the subscription in the admin center during Expired and Disabled. Some agreements work differently. Microsoft Learn notes that as of February 9, 2026, the Expired status no longer applies to license-based subscriptions bought directly through a Microsoft Customer Agreement, and Enterprise, Volume Licensing and CSP subscriptions have their own timelines. Check your own subscription page rather than relying on general rules.

The practical point: no genuine Microsoft process deletes a business's mailboxes "within 48 hours" of a missed payment. When users' apps do lose their license, Microsoft Learn says the apps move into a reduced-functionality mode and show "Unlicensed Product" notifications inside the app itself, not in an email with a sign-in link.

Why do scammers fake Microsoft 365 renewal emails?

A Microsoft 365 work account is worth more than most passwords. It opens email, OneDrive, SharePoint and Teams, and it can be used to send convincing invoices to your customers. A stolen account is often the first step in business email compromise.

The lure works because of how billing is set up. Most staff don't know who pays for Microsoft 365, when it renews or what a real notice looks like. A message saying "your license expired" sounds plausible and urgent to them. Owners of small businesses, who often hold the billing role themselves, get the card-theft version.

The renewal-and-refund version is a phone scam. A fake receipt for a large renewal gives a number to call. The "agent" then asks for remote access to "process the refund". Microsoft says it "will never proactively reach out to you to provide unsolicited PC or technical support" and that "Genuine Microsoft error messages never include a phone number to call" (Microsoft Support). Our guide to callback phishing covers this pattern.

What should I do if I clicked or entered my details?

If you only opened the page and typed nothing, close it and report the email. If you entered anything:

1. Tell IT now if it's a work account. Say what you entered: password, MFA code, card or remote-access approval.
2. Change your Microsoft 365 or Microsoft account password by typing the address yourself, and change it anywhere you reused it.
3. Call your bank if you entered a card, using the number on the card.
4. If you let a caller connect to your computer, disconnect it from the internet and have it checked before you use it again.
5. Report the email. In Outlook, select Report message (or Report) and choose Phishing. In Outlook.com, use Junk > Phishing (Microsoft Learn). Report phone scams at microsoft.com/reportascam and to the FTC at ReportFraud.ftc.gov.

The full checklist is in what to do after clicking a phishing link.

What should a Microsoft 365 admin do about fake expiry emails?

Treat it as a campaign against your tenant: block, remove, then secure anyone who clicked.

1. Confirm your real status. Check Billing > Your products so you can tell staff with confidence that nothing has expired.
2. Block the sender. In the Microsoft Defender portal, open the Tenant Allow/Block List at security.microsoft.com/tenantAllowBlockList, select Domains & addresses, then Add > Block. Microsoft Learn says blocked senders' email "is marked as high confidence phishing and quarantined" (Microsoft Learn). Block entries expire after 30 days by default. Our guide to blocking a sender or domain in Microsoft 365 includes the PowerShell equivalent.
3. Find and remove every copy. Use message trace to see who received it, then remove it with Threat Explorer or Real-time detections. See removing a phishing email from all mailboxes.
4. Secure anyone who entered a password. Revoke sessions, reset the password, remove unknown MFA methods and check for malicious inbox rules and forwarding. The full sequence is in Microsoft 365 compromised account remediation.
5. Tell staff who handles licenses. One sentence in your onboarding, "IT manages Microsoft 365 billing; you'll never need to renew anything", removes most of the lure's power.

Keeping the emails out

Microsoft 365's built-in filtering catches many of these emails, and its anti-phishing policy settings catch more when they're tuned. Some still get through, especially from new lookalike domains or abused cloud services. An MX-level filter in front of Microsoft 365 checks inbound mail for spam, phishing and spoofing before it reaches users and holds suspect messages in a quarantine each person can review. See how iBlockSpam works with Microsoft 365.

Next steps

1. Check Billing > Your products today, note your renewal dates and confirm recurring billing is set the way you want.
2. Tell staff: "We'll never ask you to renew Microsoft 365. Report any email that says your license expired."
3. Make sure the Report button is available in Outlook and that reports reach someone.
4. Run the free DMARC Checker on your domain, and if fake Microsoft emails keep reaching staff, see how iBlockSpam protects Microsoft 365 at the MX level.

Browse our other phishing and threat guides.