Why am I being charged $300 for Defender Express

"Defender Express" does not appear as a standard Microsoft security product name in the provided information. To understand why a $300 charge is appearing and whether it is related to a Microsoft security/Defender offering, use Microsoft’s billing investigation tools and subscription view:

1. Check what the charge is for
   • Go to the Manage your payments page of the Microsoft account dashboard using the link in the article How to investigate a billing charge from Microsoft.
   • Find the $300 transaction and select Investigate (as described in the article). This walks through the most common causes:
     • An active Microsoft subscription with recurring billing enabled (for example, a Defender/endpoint security plan bundled in Microsoft 365).
     • A purchase made by a family member or someone else with access to the card.
     • A previously declined charge that was retried.
     • A split order or pre-order that has now been billed.
     • An in-app or in-product purchase.
2. Check active subscriptions and licenses
   • Sign in to the Microsoft 365 admin center (for business/organization accounts) and open the Licenses page to see which security products (for example, Microsoft Defender for Business, Microsoft 365 Business Premium, Microsoft 365 E3/E5, Defender for Endpoint plans) are currently assigned and could be generating security-related charges.
   • For personal accounts, sign in to the Services & subscriptions section of the Microsoft account to see if any Defender or other security-related subscription is active and matches the $300 billing cycle.
3. Consider Defender/endpoint security plans
   • For organizations, Defender-related charges may come from:
     • Microsoft 365 Business Premium or Defender for Business (for up to 300 users).
     • Microsoft 365 E3/E5 or standalone Defender for Endpoint Plan 1/2 when the organization grows beyond 300 users.
   • If the organization recently grew or changed plans, the billing amount may reflect a move to enterprise Defender plans that include Defender for Endpoint.
4. If the charge still cannot be identified
   • Use the troubleshooting flow in How to investigate a billing charge from Microsoft to narrow down the cause.
   • If it still does not match any subscription or order, contact Microsoft Support via the billing support paths referenced in the Q&A examples to have an agent look up the charge by card details, date, and amount.
   • If there is any suspicion that the card or account is being used without authorization, contact the bank/card issuer immediately to report the charge and consider blocking or replacing the card.

These steps will show whether the $300 is tied to a legitimate Microsoft Defender/endpoint subscription under the account or if it is an unrelated or unauthorized charge.

References:

• Microsoft Defender for Business - Frequently asked questions and answers
• Common questions about Defender for Servers
• Unable to cancel your Microsoft subscription
• How to investigate a billing charge from Microsoft
• investigate a billing charge - Microsoft Q&A
• My credit card is being used by an unknown person to buy Xbox pass. How do I cancel the monthly payment? - Microsoft Q&A
• refund please - Microsoft Q&A