SENDER LEGITIMACY - VERDICT

The Microsoft Cashback fee email is probably real. That is exactly what makes it dangerous.

A message says an unused cashback balance will start losing $5 a month. It reads like every phishing email you have been taught to delete. Microsoft's own terms say the fee exists, which means the usual advice, delete anything mentioning money, quietly stops working here.

SB

SafeBrowz Threat Research Security Research · 25 August 2026 · 9 min read

What the email says

The wording varies, but the shape is consistent. It states that your Microsoft Cashback balance has been inactive, and that a monthly account maintenance fee of $5.00 will begin being deducted after a notice period unless you use the account. It arrives looking like ordinary Microsoft billing mail, and in the reports that surfaced through August 2026 the links in it pointed at Microsoft addresses.

Read as a piece of security advice, everything about it is wrong. Money, a deadline, an account you had half forgotten. That combination is the standard phishing skeleton, and most people's trained response is to delete it and move on. Which is why this one is worth stopping on.

Why the instinct fails here

The fee is real, and it has a name. Microsoft's Cashback terms define an Account Maintenance Fee of US$5.00 a month, deducted from the account once it is deemed inactive, and an account counts as inactive if in the preceding six months you have neither earned any cashback nor transferred your balance to a redemption account. The terms also state that Microsoft will never deduct more than the remaining available balance, and that deductions continue until you earn again or move the balance out. A Microsoft moderator restated this on Microsoft's own Q&A site on 11 August 2026, answering a customer who was asking whether their card was about to be charged.

The mechanics matter more than the number:

• It comes out of the balance, not out of you. The deduction is taken from cashback already sitting in the account.
• It cannot exceed what is there. If the balance is zero, there is nothing to deduct.
• It only starts after a long gap. Six months with no cashback earned and no balance transferred out.
• Using the account stops it. Earning or transferring the balance ends the sequence.

So an email announcing a maintenance fee is not, by itself, evidence of anything. That is an unusual thing to have to say on a page like this, and it is the reason this post exists.

The sentence that resolves the contradiction

Microsoft's own Cashback page says the programme is free, with no fees and no credit card required, and adds a line worth memorising: Microsoft will never ask you to pay to access your cashback.

At first glance that contradicts a $5 maintenance fee. It does not, and holding both together is the whole test. The fee is something Microsoft takes from a balance. It is not something you are ever asked to pay. Nothing legitimate in this programme will send you to a payment form, a card confirmation, or a sign-in page reached from the email in order to keep money you already earned.

That gives you a test that does not depend on judging how convincing the email looks:

• Money moving out of a balance you already hold is consistent with the real policy.
• Money, card details or credentials moving out of you is not, in any version of this programme.

The sender address, and why it is confirmation rather than proof

Microsoft states that official Cashback email comes only from [email protected]. That is a genuine Microsoft address on a genuine Microsoft domain, and our own scanner returns microsoft.com as safe.

It is still not proof, for the ordinary reason that a displayed sender is easy to forge. This is the same trap we went through with [email protected], where the address is real and the messages carrying it frequently are not. A matching sender raises your confidence a little; a mismatched one settles it instantly.

The copies take the shapes you would expect. Something like micros0ft[.]com, with a zero standing in for the letter, or a plausible-looking prefix such as mail-microsoft[.]com that is not a Microsoft domain at all. Both are illustrative of the pattern rather than a specific named campaign, and both return danger from our scanner if you click them above. If you would rather not squint at spellings at all, that is a reasonable position, and it is what checking whether an email address is real covers in more depth.

What the phishing versions do differently

Once you know the genuine notice exists, the fakes become easier to place, because they have to add something the real one never contains.

• A payment step. A processing fee, a tax, or a verification charge to release a rebate. Real cashback is not unlocked by paying for it.
• Total loss framing. The balance, or the whole account, will be permanently deleted unless you act now. The real policy is a slow deduction, not a deletion.
• A sign-in that starts from the email. A link to a Microsoft-looking login page. This is the step where accounts are actually lost, and it is covered in the fake Outlook sign-in pattern.
• Card capture dressed as confirmation. Enter your card so we can confirm where to send the balance.
• A phone number to call. The same handoff that drives fake Microsoft support, where the pressure moves to a human voice.

Refund-shaped lures work because being owed money lowers people's guard in a way that being threatened does not. The Amazon Prime settlement refund wave ran on exactly that, and this is the same engine with Microsoft's name on it.

A confident wrong answer is its own hazard

One detail from the August 2026 threads is worth recording, because it changes how much weight to put on a search result.

On Microsoft's own Q&A site, a community advisor answered someone's question about this exact email by calling it phishing, with the reasoning that Microsoft does not charge maintenance fees for its services. That reasoning does not match Microsoft's published Cashback terms, and a Microsoft moderator said the opposite in a neighbouring thread the same week. Community advisors are volunteers, not Microsoft employees, and the answer sits on a microsoft.com address which makes it read as official.

We are not singling out a person, and the advice they gave, do not click, do not hand over details, report it, was sound. The problem is the mechanism. Someone who reads a confident it-is-definitely-phishing answer may ignore a real notice and watch a balance drain; someone who later reads a confident it-is-definitely-genuine answer may sign in to a copy. Neither reader was careless. They both did the reasonable thing and asked.

Which is why the recommendation on this page is not a verdict on the email at all.

The check that works either way, in about thirty seconds

1. Do not use the email as your route. Not the button, not the link, not a phone number in it.
2. Open a browser and go to your Microsoft account yourself, typed or from your own bookmark.
3. Look at the Cashback dashboard. A real notice about a real balance will be visible there.
4. If there is a balance, use it. Redeeming or transferring ends the inactivity clock, which is the actual fix.
5. If the dashboard shows nothing, the message was a copy. Report it as phishing and delete it.

This costs the same half minute whether the email was genuine or forged, and it is correct in both cases. That property is what makes it worth more than any amount of studying the message.

Verify the destination when the email is the only thing you have

Being straight about the limits here matters, because this scam sits partly outside what a browser tool can see.

We cannot tell you whether a specific email in your inbox is genuine. We do not read your mail, and the deciding facts, your balance and your account activity, live inside your Microsoft account. The dashboard check above is the answer to that part, and nothing on this page replaces it.

What is checkable is the link, and that is where people actually lose accounts. Layer 1 reads the shape of a URL locally before the page loads. Layer 2 checks the destination server-side against reputation sources, a brand database of more than 550 names, and our blocklist, which is what places a Microsoft lookalike as impersonation rather than as a login page. Layer 3 is the AI deep scan, a Premium feature with one free scan a day for everyone else, which reads what the page actually serves rather than the logo it wears.

So the honest division of labour: your Microsoft dashboard settles whether the notice is real, and we settle whether the page behind a link is Microsoft at all.