Never trust anyone and anything is the simple rule.
That includes Windows Defender, by the way.
The thing is, a common practice to scam a user is to create a situation that *forces* the user to change his password so the attacker can intercept the change taking place.
To accomplish this, seeding fake data into data sources which the attacker *knows* are monitored by Microsoft etc. is one of the attack vectors.
In other words, you best course of action -in this case- would have been NOTHING. At least not immediately. The fact the password reported was wrong is actually *good* as it indicates your real PW was most likely not leaked.
It makes sense to change the PW, as a precaution, but not immediately. Or at least not using the usual means - use a different computer etc. etc. If this was not a spear fishing attack by a state-level actor (think China, FBI, etc.), the attacker has limited time budget while he is "watching" for your actions. After a few days he would give up and go worry about "easier" targets.
In general, as already mentioned, the most important is to not reuse passwords between various services. At least for the critical ones like email, your google account etc.
