VPN ghosts: kill the $79–$200 renewal before the intro deal locks in (2026)

A VPN often starts as a short promo: a couple of dollars a month on a two-year deal. The bill that matters is the one after the intro ends.

Current public snapshots put monthly VPN plans around $10 to $15.45, with multi-year intros far lower and renewals much higher. ExpressVPN’s own order page lists a Basic plan that autorenews at $99.95 a year, Advanced at $119.95 a year, and Express Pro at $199.95 a year, after a discounted first stretch. Surfshark’s pricing page shows Starter and One plans billed at $67.23 for the first 27 months (about $2.49/mo on that promo) and One+ at $121.23 for the first 27 months (about $4.49/mo). CNET’s 2026 VPN roundup records NordVPN at $13/month, $60 for the first year, or $83 for the first two years, with one- and two-year plans renewing at $140 a year; Surfshark at $15.45 a month, $48 for the first 15 months then $79 a year, or $60 for the first 27 months then $79 a year; and Proton VPN at $10 a month, $60 for the first year or $108 for the first two years, with those longer plans renewing at $80 a year. These are plan snapshots, not a universal VPN average. 1 2 3

That gap is why a forgotten VPN is worth a statement audit. C+R Research surveyed 1,000 US consumers from April 22 to May 2, 2022. People first estimated that they spent $86 a month on subscriptions; after listing the charges, the average was $219. Seventy-four percent said recurring charges were easy to forget, 42% said they had stopped using a service while still paying for it, and 72% said they put monthly subscriptions on auto-pay. The survey covers subscriptions generally, so use it as a reason to inspect the statement, not as the average price of a VPN. 4

Find the billing owner before you click anything

Pull 13 months of statements from every card, checking account, family payment method, and business card that could have paid for a VPN. Two-year intro plans and annual renewals are the reason twelve months is too short.

Search each term separately. The exact descriptor on your statement wins; a search word is only a net for finding candidates.

NORDVPN
NORD VPN
NORDSECURITY
NORD SECURITY
EXPRESSVPN
EXPRESS VPN
SURFSHARK
PROTONVPN
PROTON VPN
PROTON
MULLVAD
PIA
PRIVATE INTERNET ACCESS
IPVANISH
NORTON
VPN
APPLE.COM/BILL
APPLE SERVICES
GOOGLE *
GOOGLE PLAY
PAYPAL
AMAZON
RECURRING
RENEWAL
SUBSCRIPTION

Then search every inbox attached to those payment methods for:

receipt
invoice
free trial
trial ends
renewal
subscription
auto-renew
VPN

Do not turn PAYPAL, APPLE.COM/BILL, GOOGLE PLAY, or AMAZON into a merchant name. Those strings can be the payment rail while the subscription still belongs to NordVPN, ExpressVPN, Surfshark, Proton, or another VPN brand.

For every hit, record:

The exact statement descriptor, amount, posted date, and card last four.
The receipt email and the account email used to sign in.
The product name: monthly plan, annual plan, multi-year intro, free-trial conversion, dedicated IP add-on, or a security bundle.
The billing owner: direct merchant, Apple, Google Play, Amazon, or PayPal.
The next renewal date, the intro end date if any, and the refund cutoff.
The cancellation result, confirmation email, and a screenshot or PDF.

Use the receipt-owner test: the company or store named on the receipt owns the cancellation button. If the receipt says Apple, start in Apple subscriptions. If it says Google Play, start in Google Play. If it says Amazon, start in Amazon. If it says PayPal, inspect the automatic payment there and then cancel the merchant subscription as well. Deleting the VPN app proves nothing about the billing owner.

Separate the tunnel from the charge

VPN cancellations have a second trap: the app can stay installed, the account can stay open, and the paid period can continue after renewal is off. That is normal. The job is to stop the next charge, not to wipe the account on day one.

Before canceling, write down three dates:

Next charge: the date the next renewal would post.
Access end: whether the provider lets you use the VPN through the paid period.
Refund cutoff: the last day to request a money-back refund, if the plan offers one.

NordVPN says it offers a 30-day money-back guarantee for new subscriptions, that the guarantee applies to the initial purchase, and that a renewed period is no longer eligible under that policy unless local law requires otherwise. Apple App Store purchases follow Apple’s refund path; Amazon purchases go through Amazon; Google Play refunds can go through NordVPN support within the policy window, or through Google Play within 48 hours of payment. 5

Surfshark separates cancellation from refunds: canceling auto-renewal stops future payments and leaves access through the current period; a refund request is a separate step under its refund article, and Surfshark points to a 30-day window for that path. 6 7

ExpressVPN says you keep using the service until the last day of the current subscription cycle after cancellation, and that app-store trials need cancellation at least 24 hours before the trial or next billing date. 8

Proton says a canceled paid plan stays active until the end of the current billing period and does not renew; switching to a different paid plan can take effect immediately. If storage or other Proton limits are over the free-plan ceiling after a downgrade, some features can stop working. 9

That creates a simple order: check the refund clock, cancel the billing rail, then verify the dated end state. Do not confuse an app uninstall, an account deletion, or a device logout with subscription cancellation.

Cancel the rail that owns the charge

NordVPN billed directly

NordVPN’s current help article for direct purchases says to cancel auto-renewal in the Nord Account:

Log in to your Nord Account > open the Billing tab > click Cancel next to auto-renewal > select Cancel auto-renewal.

NordVPN says the auto-renewal status then shows as off, and a confirmation email goes to the registered account email when cancellation succeeds. The same article says the same account path can cover NordPass, NordLocker, Dedicated IP, or bundle services. If the purchase was through Google Play, Apple, or Amazon, NordVPN points you to those store articles instead of the direct billing path. 10

Watch for: a second Nord product on the same account, a family payment method, or a store receipt that makes the Nord Account cancel control the wrong rail.

Counter-script:

I am canceling NordVPN auto-renewal on this Nord Account, not deleting the account and not changing the plan. Please confirm auto-renewal is off, the end date of paid access, and that no bundle add-on remains set to renew.

Save the Billing screen that shows auto-renewal off and the confirmation email.

ExpressVPN billed directly

ExpressVPN’s current cancel guide is blunt on one point: you cannot cancel inside the ExpressVPN app. You cancel on the website or in the app store that owns the charge. 8

For a purchase paid with a card, PayPal, Apple Pay, or Google Pay on expressvpn.com:

Open My subscription in a browser > log in > click Cancel subscription under Automatic renewal > finish every prompt.

ExpressVPN says you will not be billed for another cycle after that, and you can keep using the service until the last day of the current cycle. Bitcoin or Paymentwall purchases, per the same page, do not auto-renew, so there is no recurring cancel step for those rails. 8

Watch for: a retention screen, a plan-change offer, or a page that only says access continues. Access through the paid period is not a renewal signal.

Counter-script:

I am canceling ExpressVPN automatic renewal on this account. Please confirm the subscription will not renew, the last day of paid access, and that the cancel control is complete on the website rail, not only inside the app.

Surfshark billed directly

Surfshark’s current manage and cancel articles use the account Subscription page:

Log in to your Surfshark account > click your email > Subscription > Payments tab > Cancel renewal / Cancel auto-renewal > confirm.

Surfshark says the subscription stays active until the expiration date, no additional charges are made, and you may get a confirmation email. If the cancel control is missing, Surfshark says the purchase may have come through an app store or a payment method that does not support recurring management in the Surfshark account. Live chat is the fallback when the control is absent. 6 7

Watch for: a third-party purchase that never shows cancel controls inside Surfshark, and a refund request that is still a separate job from turning renewal off.

Counter-script:

I am canceling Surfshark auto-renewal only. Please confirm the expiration date, that future payments are off, and whether any third-party store still owns the billing rail.

Proton billed directly

Proton’s current manage-subscription page covers VPN and other Proton paid plans from one account surface:

Go to account.proton.me > sign in > open any Proton service > Settings (gear) > All settings > Subscription > Cancel subscription > Continue > Cancel subscription again to confirm.

Proton says the paid plan remains active until the end of the current billing period and does not renew. Check Settings → Subscription → Your Subscriptions for the renewal date before you leave. If the account is over free-plan limits after the period ends, free-plan restrictions can apply. 9

Watch for: an unpaid invoice that blocks plan changes, and a free-plan storage or feature limit that matters after the paid period ends.

Counter-script:

I am canceling the paid Proton subscription and leaving the account open. Please confirm the end date, that renewal is off, and whether any separate Proton paid product remains active.

Apple App Store billing

If the statement or receipt points to Apple, use one of these paths:

iPhone, iPad, or Apple Vision Pro: Settings > your name > Subscriptions > select the VPN subscription > Cancel Subscription.
Mac: App Store > your name > Account Settings > Subscriptions > Manage > Edit > Cancel Subscription.
Web: sign in at Apple’s account page and manage subscriptions there.

Apple says to search email for "receipt from Apple" or "invoice from Apple" to find the correct Apple Account. If there is no Apple receipt, identify the billing company on the statement instead. For a free or discounted trial, Apple says to cancel at least 24 hours before the trial ends. If there is no Cancel Subscription button, or a red expiration message appears, Apple says the subscription is already canceled. 11

ExpressVPN’s store path matches that pattern: App Store profile > Subscriptions > ExpressVPN > Cancel Subscription. 8

Counter-script:

I am canceling the paid VPN subscription on this Apple Account. Please confirm the expiration date and show that the renewal control is off. I am keeping the Apple Account.

Google Play billing

If the receipt shows Google Play:

Google Play subscriptions > find the VPN subscription > Manage > Cancel subscription > choose a reason > Continue.

Google says uninstalling the app does not cancel its subscription. After cancellation, access generally continues through the period already paid for, and the subscription will not renew after that period. 12

ExpressVPN’s Android path is the same store surface: Play Store profile > Payments & subscriptions > Subscriptions > ExpressVPN > Cancel Subscription. 8

Counter-script:

I am canceling the VPN subscription in this Google Account, not uninstalling the app. Please confirm the end date and that the subscription will not renew after the paid period.

PayPal automatic payment

PayPal can sit between you and the VPN provider. Its current instructions are:

PayPal Settings > Payments > Subscriptions and saved businesses or Automatic Payments > select the merchant > Cancel the automatic payment. 13

PayPal says the automatic-payment page can also show the merchant’s contact information. Use it to identify the subscription, then cancel the VPN provider’s membership too. Turning off the PayPal authorization controls the payment permission; it does not necessarily close the underlying VPN contract.

Counter-script:

I have canceled the merchant’s VPN subscription and the PayPal automatic payment. Please confirm both: the merchant renewal is off, and the PayPal automatic payment is canceled.

Build the proof packet before you leave

Create one folder per subscription. Keep:

the original statement line
the receipt or invoice
the account email and billing owner
the plan name, intro end date, and next renewal date
the final cancellation or expiration screen
the confirmation email
the refund request and response, if any
a note showing whether VPN access remains through the paid period

The final states you want are Canceled, Auto-renewal off, Will not renew, Expires on [date], or a store screen with a dated end. These states are stronger than:

App deleted: the subscription may still be active.
Account deleted: the receipt rail may still need a cancellation action.
Logged out on one device: other devices and the billing rail may still be live.
Refund requested: future renewal may still be scheduled.
Payment method changed: the membership may still renew on another method.

If another charge lands

Start with the receipt owner. Send the descriptor, amount, posted date, account email, order number, and cancellation proof. Ask for a refund review and written confirmation that future billing is inactive.

For an automatic debit from a bank account, the CFPB says you can revoke authorization with the company, then contact your bank or credit union and follow up in writing. A stop-payment order may carry a fee. The CFPB also says stopping the payment does not cancel what you owe under an ongoing contract, so complete both jobs: cancel the VPN subscription and stop an unauthorized future debit. 14

For a credit-card billing error, call the issuer quickly and send a written billing-error notice within 60 calendar days after the charge appeared on the statement. The CFPB says to keep copies and call dates. A phone call without the written notice does not protect that deadline. 15

The FTC’s consumer guidance covers free trials, auto-renewals, and negative-option subscriptions as offers where the terms and cancellation method matter. Describe the event accurately: a trial that converted, a charge after a recorded cancellation, and an unauthorized transaction are different facts. Keep the receipt and cancellation record instead of labeling every unwanted renewal fraud. 16

The prevention mechanic: the 45-day VPN renewal-price gate

Set a calendar reminder 45 days before every VPN renewal. Put these fields in the event title or notes:

billing owner
plan name
next charge
intro end date, if any
renewal price after the promo
annualized cost
account email
devices still using the VPN
cancellation path

At the reminder, run this gate:

Am I still using it? Name the devices and the trips, networks, or work cases that still need the tunnel.
What will the next charge buy? Compare the next renewal price with the intro price you paid. ExpressVPN’s current order page shows annual autorenew figures of $99.95, $119.95, and $199.95 after the first stretch. CNET’s current roundup records NordVPN renewals at $140 a year and Surfshark longer-plan renewals at $79 a year. Write the actual number from your receipt next to the reminder. 1 3
Is there a second VPN or add-on? Check dedicated IP, password-manager bundles, and store billing against direct billing.
What is the refund cutoff? Write the date beside the renewal date for any new purchase still inside a money-back window.
Can I cancel now and keep access? ExpressVPN, Surfshark, NordVPN’s cancel flow, Proton, and Google Play all describe access continuing through the paid period after renewal is turned off. Confirm the specific plan before acting. 7 8 12

A virtual card can add a spending limit or a second warning for a trial. Privacy.com says its virtual cards can lock to a merchant, carry maximum spend limits, and be paused or closed. Treat that as a brake, not the cancellation: the VPN account and its billing rail still need a final canceled or expiration state. 17

If you want a tracker instead of a spreadsheet, Subtrakr’s public page describes subscription and recurring-expense tracking with renewal reminders. It does not publish a consumer price on that page, so check the current offer before you rely on it. 18

The kill list

Pull 13 months of card, bank, family, and business records.
Search NORDVPN, EXPRESSVPN, SURFSHARK, PROTON, VPN, APPLE.COM/BILL, GOOGLE PLAY, PAYPAL, AMAZON, RECURRING, and RENEWAL.
Match every hit to the receipt, account email, and billing owner.
Record the next charge, access end, refund cutoff, intro end, and renewal price.
Check for a second VPN, dedicated IP, or security bundle.
Cancel on the owning rail: direct merchant, Apple, Google Play, Amazon, or PayPal.
Finish every confirmation screen. Do not stop inside the VPN app alone.
Save the dated final state and confirmation email.
Set the 45-day VPN renewal-price gate.

The app can stay on the phone after the charge is dead. The charge is dead when the owner shows canceled, auto-renewal off, will not renew, or a dated expiration—and the proof packet shows you got there.