Microsoft Fixes Windows 11 Phishing Protection Bug in January Update

Pinch yourselves, folks! After two years of circling in the frustrating merry-go-round of toggling the same setting repeatedly, Microsoft has finally addressed a critical yet oddly persistent bug in Windows 11's Phishing Protection. According to the latest information, the January 2025 security update (KB5007651) has squashed the long-standing issue where Windows Defender's Enhanced Phishing Protection kept turning off during system reboots – especially if you were using the oh-so-popular Windows Hello PIN. Let’s deep dive into what this update fixes, why this issue persisted for so long, and what it means for Windows 11 users.

---

The Bug That Wouldn't Die: What Happened?​

Phishing Protection is a vital feature that alerts users in case they mistakenly enter work or personal credentials on shady websites, reuse passwords insecurely, or store them in plain text. Essentially, it's your digital bouncer against credential theft. But here’s the catch: for the last two years, this feature had a bizarre behavior in certain scenarios.
If you logged into your Windows 11 machine using Windows Hello PIN credentials—a widely encouraged security measure—the Enhanced Phishing Protection toggle would switch off after you rebooted your PC. No dramatic warning, no epic fail message. Just quietly… off. For the average user, this not only defeated the purpose of having robust security measures in place, but it also meant you’d need to manually toggle it on every time. Talk about annoying!
Even worse, this wasn't technically a bug. Microsoft’s documentation clarified that the behavior was by design. You read that correctly—designed to confuse and irritate users. The rationale? Phishing protection wasn’t supposed to function the same way when a PIN or biometric sign-in was used, as these credentials aren’t transmitted over the internet like passwords. No password? No phishing alert. Makes sense, right? Maybe…but only if users knew this upfront.
The reality, however, was messier:

• The Windows Security UI left many scratching their heads because it didn’t explain the intended limitations.
• You’d legitimately toggle Phishing Protection back on, believing it was fully operational. Surprise! It would promptly turn itself off after a system restart.
• Frustrated users had little recourse except navigating a maze of help articles. Let's admit it—perpetually resetting security preferences isn’t exactly on anyone’s ideal to-do list.

Microsoft support agents even admitted that the Windows Security app essentially “didn’t know what to do” with the feature in such cases. Ouch.

---

The KB5007651 Update: What Does It Fix?​

Enter the hero update, AKA KB5007651. Released as part of Microsoft’s January Patch Tuesday, this update eliminates the self-switch-off bug once and for all. With the patch:

• Enhanced Phishing Protection stays enabled, even after you reboot. Whether you’re logging in with a PIN, a password, or biometric verification through Windows Hello, the setting now works seamlessly and retains its configuration.
• Improved toggle reliability: The functionality now behaves predictably across all versions of Windows 11, per pre- and post-update tests conducted by various users and reports from Windows Latest.

No more toggling. No more second-guessing. You can now ensure that Phishing Protection stays operational regardless of how you log in, making your system safer from sneak attacks by credential-stealing websites.

---

For Those New to Phishing Protection: Here's How It Works​

Windows Defender’s Enhanced Phishing Protection is part of the Reputation-Based Protection suite, found under Reputation-Based Protection Settings. It’s basically Windows yelling “hey, stop!” if:

1. You enter sensitive credentials (like work passwords) on known malicious websites.
2. Reuse your password in unsafe ways—think logging into random or risky platforms.
3. Save your password in plain text, exposing yourself to accidental leaks.

The feature integrates with Microsoft Defender for Endpoint (MDE) for businesses, meaning IT administrators can monitor and respond to phishing threats in corporate environments. Until now, however, it was mostly limited in application if you opted for PIN-based logins. Those days are over.

---

Why Did It Take Microsoft Two Years to Fix This?​

Now that we’re celebrating victory, let’s unpack the million-dollar question: Why on earth did this take two years?
The biggest reason appears to boil down to a mix of architectural quirks and user feedback that was both late and contradictory:

• A flawed "design approach": Microsoft’s initial design assumed phishing risks were zero for biometric or PIN users (since these methods bypass storing reusable passwords). However, this didn't account for all scenarios—like multi-user systems or legacy setups—where credential alerts remain relevant, PIN-based or not.
• Complex telemetry signals: Phishing telemetry integrates directly with Microsoft Defender telemetry. Handling these alerts differently depending on whether you're using a password or biometric login added complexity.
• Industry pressure & bad PR: Previous years saw Microsoft criticized for unclear messaging around key features. User outcry likely pressured the company into prioritizing this, but software fixes—combined with testing across billions of devices—take considerable time.

---

How to Ensure You’re Protected Post-Update​

Want to make sure your system is benefiting from this critical fix? Follow these steps:

Step 1: Update Your System​

• Go to Settings > Windows Update.
• Click Check for Updates.
• Look for KB5007651 under the available updates and install it.

Step 2: Confirm Phishing Protection Is Active​

1. Open Windows Security (Search for "Windows Security" in the Start Menu).
2. Navigate to App & Browser Control > Reputation-Based Protection.
3. Under Reputation-Based Protection Settings, ensure Phishing Protection is toggled ON.
4. Reboot your PC and verify that the toggle remains on.

Step 3: Test the Feature​

Try entering dummy credentials on a test phishing website (Microsoft has testing protocols available for enterprise users) to confirm alerts are working.

---

What’s Next for Windows and Security Design?​

The fixed Phishing Protection toggle reaffirms Microsoft's commitment to a secure Windows ecosystem—but it also opens up a broader discussion. We’re in an age where cyber-threats like credential phishing are rampant, impact millions of users daily, and relentlessly adapt. Security features like these must be intuitive and feature-rich out of the box.
Moreover, Microsoft can’t afford another two-year debugging cycle for major features—especially with rivals like macOS continuing to up their game in integrated cybersecurity. Feature transparency and clear communication in addition to functionality will be critical moving forward.
With the release of new updates and innovations like Windows 11 Copilot Plus integration, here’s hoping user feedback channels stay open, well-oiled, and less prone to awkward design stumbles. Remember: a frustrated user is a vulnerable user.
What do you think of the update? Were you impacted by this bug? Share your thoughts in the forum. Let’s discuss!

---

Source: Windows Latest Microsoft fixes Windows 11’s two years-old security bug that turns off Phishing protection