Black Friday is the busiest time of year for fake VPN deals. Scammers know people are actively looking for a VPN discount, so they copy real brands with lookalike websites, social ads promising “lifetime” plans, clone apps and phishing emails warning that “your VPN has expired.” The fix is simple and dull: get to the provider’s site yourself, pay only there or in the official app store, and treat any deal that reaches you uninvited as suspect until you’ve checked it.
- Type the provider’s address yourself or use a bookmark. Don’t click through from a social ad, text or email.
- Big-brand “lifetime” VPN deals in social ads are a major red flag. Mainstream providers sell subscriptions.
- In app stores, check the developer name, not just the app name and icon.
- If you’ve already paid a fake site: contact your card issuer, change any reused passwords and report it.
The five scams that peak in November
| Scam | What it looks like | What it’s after |
|---|---|---|
| Lookalike domains | A site with the real logo and layout on an address that’s slightly off: an extra word, a hyphen, a swapped letter or a different ending | Your card details, your login, or both |
| “Lifetime deal” social ads | A sponsored post offering a famous VPN for a one-time payment “today only,” often with a countdown | A quick card payment for something that never arrives or doesn’t work |
| Clone apps | An app with a similar name and icon to a known VPN, published by a different developer | Subscription fees, ad revenue, or your data |
| Gray-market keys | Very cheap “activation keys” or shared accounts from marketplaces or resellers | Your money for an account that may be revoked or shared |
| “Your VPN expired” phishing | An email or text with the provider’s branding urging you to renew now at a special price | Your login and payment details |
Lookalike domains: check the address, not the design
Copying a website’s design is easy. Getting the exact same domain is not. Scam pages often look perfect because they are copies, so judge the address bar, not the page.
- Look at the whole domain, especially the part just before the ending (such as .com). Extra words like “deals,” “offer,” “official” or “promo” added to a brand name are a warning sign.
- Watch for swapped or doubled letters and different endings from the one you know.
- The padlock icon only means the connection is encrypted. Scam sites can have one too.
- Search results can include paid ads, and ads can be impersonations. Scroll past ads, or type the address yourself.
Our guide to spotting fake VPN discounts covers legitimate-but-misleading offers, and Fake Timers & Inflated MSRPs explains the pressure tactics both scammers and real sellers use.
“Lifetime” deals and gray-market keys
Mainstream VPN providers like NordVPN, Surfshark, ExpressVPN and Proton VPN sell subscriptions on their own sites and in the official app stores. A social media ad offering one of them for a single “lifetime” payment should make you suspicious straight away.
Gray-market keys are less obviously a scam, but they carry real risks. A key or account bought from an unauthorized reseller may have been bought with a stolen card, may be shared with strangers, may break the provider’s terms, and can be deactivated without notice, leaving you with no refund from the provider. We cover this in detail in Are Cheap Lifetime VPN Keys Safe?
Watch out: A lifetime offer for an unknown VPN brand can also be a problem. Some cheap VPNs make money by collecting or selling your data. See cheap VPNs to avoid.
Clone apps in app stores
App stores review apps, but copycats still get through, especially when people are searching hard for “VPN” in November. Before you install:
- Check the developer name. It should match the company behind the VPN. A real VPN app is published by that company, not a similar-sounding developer.
- Link from the official site. The most reliable way to find the real app is through the download links on the provider’s own website.
- Look at the listing details. Very new listings, few reviews, odd grammar or permission requests a VPN doesn’t need are warning signs.
- Read the in-app subscription terms. Clone apps often have expensive weekly subscriptions that start after a short trial.
Prices can also differ between in-app and website purchases, so it’s worth comparing them. See app store vs website VPN pricing.
“Your VPN has expired” phishing
These emails and texts look like renewal notices and often include a special offer to create urgency. The link goes to a fake login page that collects your password and then your card.
- Don’t click the link. Open the provider’s app or type its address, log in, and check your subscription status there.
- Check the sender’s address carefully, but don’t rely on it alone, because sender names are easy to fake.
- Be wary of any message asking you to enter your password and card details on the same page.
- Turn on two-factor authentication on your VPN account if the provider offers it.
How to verify you’re on the official site
- Start from a trusted source. Use a bookmark, type the address yourself, or follow the provider’s official app-store listing to its website.
- Read the domain carefully before entering anything.
- Check that the offer exists on the official site. If a “deal” appears only in an ad and not on the provider’s own pricing page, don’t buy it.
- Check that the checkout shows the provider’s name and a sensible total. Unexpected currencies or payment methods (gift cards, crypto-only, bank transfer to a person) are red flags.
- Verify any coupon before prepaying. Here’s how to verify a VPN coupon.
Tip: Deals we’ve verified are listed in Today’s Deals and link to the providers’ official sites, so you can use it as a starting point.
What to do if you already paid
- Contact your card issuer or bank right away. Explain that you paid a fraudulent site, ask about a dispute or chargeback, and ask whether the card should be replaced. Card disputes have time limits, so act quickly.
- If you paid through PayPal or an app store, use their dispute or refund process too.
- Change your passwords. If you entered a password on the fake site, change it on the real VPN account and anywhere else you’ve used it. Turn on two-factor authentication.
- Watch your statements for further unauthorized charges.
- Report it. In the US, you can report fraud to the FTC at ReportFraud.ftc.gov. Also report the ad to the platform that showed it and the fake app to the app store. Let the real provider’s support team know too, since they often track impersonation.
Frequently asked questions
Are lifetime VPN deals ever real?
Some small or lesser-known VPNs do sell lifetime plans, but that brings its own risks about how the service is funded long term. A big-name provider offered as “lifetime” in a social ad is almost certainly fake or gray-market.
How can I tell if a VPN app is a clone?
Check the developer name in the store listing and compare it with the company behind the VPN. The safest route is to follow the app-store link from the provider’s own website.
I got an email saying my VPN expired. Is it real?
Maybe, maybe not. Don’t use the link. Log in through the app or by typing the address yourself, and check your subscription status there.
Can I get my money back from a fake VPN site?
Often you can, through a card dispute, especially if you act quickly. Contact your card issuer as soon as you realize. Payment methods like gift cards or crypto are much harder to recover.
Is it safe to buy a VPN from a deal site?
It’s safe if the deal site links to the provider’s official site and you pay there. Be cautious with sites that sell keys or accounts themselves rather than sending you to the provider.
Ready to lock in a deal?
We track intro prices, renewal rates and refund windows so you can compare the real total.
See today's verified deals →