Unauthorized Charge on my Microsoft Account

For a large, unrecognized Microsoft charge that does not appear in any Microsoft account order history, the supported steps are:

1. Investigate the charge through Microsoft’s tools
   • Go to the Manage your payments page of the Microsoft account dashboard and select “Investigate” for the unrecognized charge. This is the official starting point for unexpected Microsoft billing:
     • Manage your payments
   • Review the common causes listed there (recurring subscriptions, family member purchases, in‑app purchases, split/pre‑orders, re‑tried declined charges) to confirm that none apply.
   • Use the troubleshooter linked there to help determine why the charge occurred.
2. Check all Microsoft accounts and order history
   • Sign in to https://account.microsoft.com/billing/orders and verify:
     • You are using the correct Microsoft account (email) for each family member.
     • Under Payment & billing > Order history, set a date range that includes the charge date and look for any orders with Completed or Redeemed status that could match the bank charge, even if the amounts differ slightly.
   • Repeat for any other Microsoft accounts you or your children may have used.
3. Confirm it is not a subscription or recurring billing
   • Sign in to https://account.microsoft.com/services with each possible Microsoft account.
   • Check for any active subscriptions (Microsoft 365, Xbox, etc.) that could generate a high charge.
   • If you find an unwanted subscription, turn off recurring billing and cancel it. If you cancelled very close to the billing date (less than 2 days before), a charge may still occur; verify the subscription end date there.
4. Treat this as potential card theft/fraud
   • Since the card is not on any known Microsoft account and the charge is not in order history, treat this as possible card compromise:
     • The card has already been shut down, which is correct.
     • Follow your bank’s process to dispute the charge as unauthorized once it posts (banks typically cannot fully process fraud disputes while a charge is still pending).
   • Microsoft cannot disclose “who” used the card (that information is not shared with customers), but the bank’s fraud team can investigate using the reference number and merchant data.
5. Monitor for additional misuse and identity theft
   • Review all recent transactions on the affected card and any other cards/accounts for small “test” charges and other suspicious activity.
   • Consider setting up Microsoft Defender identity theft monitoring (where available) to watch for unexpected credit activity and receive alerts about new events affecting credit. This can help detect broader identity theft beyond this single card incident. See Getting started with identity theft monitoring in Microsoft Defender from the context.
6. Documentation for the bank
   • Provide the bank with:
     • Screenshots or printouts from Order history and Services pages showing no matching Microsoft orders or subscriptions.
     • Any results from the Manage your payments → Investigate flow indicating the charge is not associated with your account.
   • This helps demonstrate that the charge is not tied to your Microsoft accounts and supports the bank’s fraud investigation and chargeback process.

Microsoft support and the bank together can help cancel/refund unauthorized Microsoft charges, but only the bank can formally treat this as card fraud and pursue who used the card.

References:

• How to investigate a billing charge from Microsoft
• View your Microsoft Store order history
• What to do if your credit or debit card info is stolen
• Unable to cancel your Microsoft subscription
• My credit card is being used by an unknown person to buy Xbox pass. How do I cancel the monthly payment? - Microsoft Q&A
• fraud charges on microsoft account - Microsoft Q&A
• I think I'm being scammed, but I want to make sure. (Though I may be in the wrong place.) - Microsoft Q&A
• Theft/Fraud Associated with my Office Product Key. - Microsoft Q&A