Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
Unexpected or fraudulent-looking Microsoft 365 subscription charges and hacked-card concerns must be handled through the official billing and fraud channels; community forums and this service cannot access or change accounts, cancel subscriptions, or issue refunds.
To move this forward, use these steps:
- Investigate the Microsoft charges
- Go to the Manage your payments page of the Microsoft account dashboard: https://go.microsoft.com/fwlink/?linkid=2246882.
- Locate the unrecognized $9.99 charges and select Investigate for each. This workflow helps identify whether:
- A Microsoft 365 subscription has recurring billing enabled.
- A family member or someone else used the card.
- A previously declined charge was later processed.
- The charge is tied to a subscription, in-app purchase, or other Microsoft service.
- Follow the on-screen guidance in the troubleshooter to understand why the charge occurred. You can also start from the billing-charge troubleshooter: https://go.microsoft.com/fwlink/?linkid=2168473.
- Check why charges continued after cancellation or card replacement
- Go to Subscriptions: https://account.microsoft.com/services and check:
- Whether Microsoft 365 Family (or any other subscription) still shows as Active with Recurring billing turned on.
- The end date of the subscription. If cancellation occurred less than two days before a billing date, one more charge can still appear.
- Confirm that the correct Microsoft account is being checked. If multiple accounts exist, sign in to each and review Services & subscriptions and Payments.
- Go to Subscriptions: https://account.microsoft.com/services and check:
- Request a refund for the subscription charges
- After identifying the subscription and charges, review refund eligibility using the Microsoft subscription refund process: https://support.microsoft.com/account-billing/how-to-get-a-refund-on-a-microsoft-subscription-67dca30b-b323-44d5-acc2-e02f9902c472.
- Submit a refund request for the relevant billing periods. The refund tool and support agents will determine what can be refunded based on policy and account history.
- Escalate billing/fraud issues with Microsoft Support
- If the online tools do not resolve the issue, contact Microsoft Support for billing:
- Go to https://support.microsoft.com/home/contact.
- Enter a brief description such as Billing issue – unauthorized Microsoft 365 charges.
- Select Get Help, then sign in and choose the Microsoft 365/Office billing path.
- Use Chat or Call me back to speak with an agent.
- Explain:
- The account was compromised.
- The card was replaced by the bank.
- Charges continued, and Microsoft Defender alerted to compromise.
- Request investigation of the subscription history and a refund for the disputed period.
- If the online tools do not resolve the issue, contact Microsoft Support for billing:
- Work with the bank/card issuer on the hacked card
- Review bank and card statements for the entire period since the known compromise and note all suspicious Microsoft charges.
- Contact the bank or card issuer’s fraud department to:
- Confirm when the old card was actually closed.
- Dispute any charges they classify as unauthorized.
- Ensure the compromised card is fully blocked and replaced.
- Banks and card companies have established procedures to challenge suspicious charges, cancel compromised cards, and issue replacements.
- Protect the Microsoft account and devices going forward
- If scammers or attackers had access to the device or account:
- Uninstall any applications they asked to install.
- Consider resetting the device using Windows recovery options if persistent issues or fake messages appear.
- Run a full scan with Windows Security (Microsoft Defender) to remove malware.
- Apply all Windows security updates.
- Change passwords for the Microsoft account and any other accounts that may have been reused.
- For additional protection against identity theft and credit misuse, set up Microsoft Defender’s identity theft monitoring (where available) to watch for unexpected credit activity.
- If scammers or attackers had access to the device or account:
- If charges cannot be matched to any Microsoft account
- If neither Microsoft Support nor the self-service tools can find the charges under any Microsoft account, treat them as potential fraudulent card transactions.
- In that case, the bank/financial institution remains the primary channel to dispute and recover funds, and they may recommend blocking the card and issuing a new one.
These steps combine: identifying the exact source of the recurring $9.99 charge, stopping further billing, requesting refunds where policy allows, and coordinating with the bank and Microsoft Support on any fraud-related aspects.
References:
- Unable to cancel your Microsoft subscription
- How to investigate a billing charge from Microsoft
- What to do if your credit or debit card info is stolen
- Protect yourself from tech support scams
- Cancel a monthly charge on my visa credit card - Microsoft Q&A
- investigate a billing charge - Microsoft Q&A
- fraud charges on microsoft account - Microsoft Q&A
- I think I'm being scammed, but I want to make sure. (Though I may be in the wrong place.) - Microsoft Q&A
- Theft/Fraud Associated with my Office Product Key. - Microsoft Q&A