• ExpressVPN has replaced its Aircove router with Fortify, a faster Wi-Fi 6 model built on GL.iNet's Flint 2 platform
• For $199.99, you get the Fortify router and 12 months of ExpressVPN's Advanced plan
• Aircove and Aircove Go are retiring from sale, but existing owners keep support and qualify for a Fortify discount

ExpressVPN, regularly ranked among the best VPN providers, has announced Fortify, a new Wi-Fi 6 VPN router that takes over from its Aircove line and shifts the company's router-level protection onto hardware built by networking specialist GL.iNet.

The idea is a familiar division of labour: GL.iNet supplies the hardware, firmware, and router interface, while ExpressVPN brings the VPN service and privacy technology as part of what both companies describe as a longer-term partnership.

Zac Eller, GM of Global Partnerships at ExpressVPN, says that "together we can do more for customers than either of us would alone."

The launch also draws a line under Aircove. ExpressVPN is retiring both Aircove and the portable Aircove Go from sale, positioning Fortify as the upgrade path for anyone who wants router-level ExpressVPN on more capable hardware.

ExpressVPN Fortify: a big step up from Aircove

Fortify is a dual-band Wi-Fi 6 AX6000 router, a clear jump from Aircove's AX1800 rating. It uses a 4x4 MU-MIMO layout, up from 2x2, and tops out at 1148 Mbps on the 2.4GHz band and 4804 Mbps on 5GHz.

Inside sits a quad-core 2.0GHz processor with 1GB of DDR4 memory and 8GB of eMMC storage, alongside two 2.5 Gigabit Ethernet ports and four Gigabit LAN ports for multi-gig home setups.

For VPN users, speed is the real draw. ExpressVPN says Fortify handles VPN throughput of up to 900 Mbps on WireGuard, compared with up to 330 Mbps on Aircove, and supports as many as 86 devices at once.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How Fortify works, and what's included

As with Aircove, Fortify runs the VPN at the router level, so every supported device on the network can be routed through ExpressVPN, including smart TVs, game consoles, security cameras, and other gadgets that cannot install a VPN app of their own.

The connection uses the WireGuard protocol at launch and is configured through GL.iNet's router interface, which retains the platform's networking tools such as Multi-WAN failover, Smart Queue Management, and AdGuard Home for network-wide ad and tracker blocking.

Fortify ships with 12 months of ExpressVPN's Advanced plan (a value of $119.95) for both new and returning users. That covers the VPN through the router as well as ExpressVPN's apps on personal devices. It also bundles extras including the ExpressKeys password manager, ad and tracker blocking, ExpressMailGuard, and more.

On trust, ExpressVPN points to its no-logs policy and RAM-only TrustedServer infrastructure, independently audited by firms including PwC, Cure53 and KPMG. Aircove also passed a Cure53 security audit at launch.

Fortify goes on sale from GL.iNet's website on September 16 at an MSRP of $199.99.

What Aircove owners need to know

ExpressVPN's router journey began in 2016 with dedicated router firmware, followed by the first Aircove in 2022 and the portable Aircove Go in 2024. Both are now being retired, and ExpressVPN will not produce any more units.

If you already own one, there's nothing to do right now. Existing routers keep working, and ExpressVPN says critical security updates and customer support will continue through 2027 for Aircove and through 2028 for Aircove Go.

There's also an incentive to upgrade: existing Aircove and Aircove Go owners qualify for 20% off Fortify. To claim it, contact ExpressVPN Customer Support to confirm ownership and receive a discount code.

• Nearly half of the top mobile apps collect your browsing history
• Social media apps are the worst offenders
• Avoiding in-app browsers can limit data collection

You probably assume your web browser is the only app keeping tabs on where you go online. According to new research from Surfshark, that assumption is incorrect.

The cybersecurity firm analyzed 40 of the most popular Android and iOS apps and found that 18 of them, or 45%, report collecting users' browsing history in their app store privacy labels. In other words, nearly half of the apps you open every day may be logging the websites you visit.

Even the best VPN cannot fully stop an app from recording what you do inside its own walls, which makes understanding what you are signing up for more important than ever.

What Surfshark found

Surfshark's team looked at 40 leading apps split evenly across four categories: generative AI, social media, e-commerce, and messaging.

For each one, the researchers checked whether its Apple App Store label reported collecting "Browsing History" and whether its Google Play label reported "Web Browsing History."

Social media came out as the biggest collector by far. Nine of the 10 social apps studied collect browsing history on at least one platform. Facebook, Instagram, TikTok, X, YouTube, and Pinterest do so on both Android and iOS, while Reddit, LinkedIn, and Snapchat collect it on Android only. Discord was the only social app that collected it on neither.

E-commerce came next, with half of the shopping apps analyzed collecting the data on at least one platform.

Messaging was less hungry, with only Rakuten Viber, Messenger, and LINE gathering it, echoing earlier findings on how much data messaging apps collect.

In the generative AI category, Google Gemini was the only app of the 10 to report collecting browsing history.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why apps want your browsing history

The logic is straightforward: the more an app knows about where you go online, the more precisely it can target ads and shape the content in your feed.

As Surfshark's lead system engineer Karolis Kaciulis explains, many apps now route external links through their own "embedded browsers," so the moment you tap a link, they can track what you search for and look at.

The important thing to remember here is that most of these social media and shopping apps do not need your browsing history to provide their services. The practice is not related to providing value to users, and simply takes place to benefit the app companies.

Kaciulis argues that consent for this is usually buried in the fine print, and that the apps fighting hardest to keep you inside their own browser tend to be the ones selling ads rather than the ones that need your history to function.

How to stay safe

There is no single switch that turns all of this off, but a few habits can go a long way.

The easiest is to sidestep in-app browsers: when you tap a link, use the "Open in default browser" option or paste the URL into your default browser, which stops the host app from watching where you go next.

Pair this with switching to a privacy-focused browser, and you'll be able to avoid a lot of the worst data-collecting practices without much effort.

• NordVPN blocked over 5 million malware attempts in January alone
• 99% of phishing attacks impersonate just 300 brands
• AI tools and fraud kits mean attackers no longer need advanced skills

We are well past the days when a cyberattack meant mass-mailing a poorly spelled virus. In 2026, cybercriminals are heavily leveraging generative AI to make their scams highly personal, industrializing fraud on a massive scale.

That is the stark warning from the Consumer Cybersecurity Report: Dismantling the Evolving Threat Landscape, published today by NordVPN. Analyzing threat intelligence data from the first half of the year, the prominent cybersecurity and best VPN provider uncovered that the most exploited vulnerability right now isn't outdated software; it is human trust.

Armed with unrestricted AI models and ready-to-use fraud kits, scammers have drastically lowered the entry barrier for digital crime. The focus has decisively shifted from complex technical exploits to highly targeted campaigns that weaponize greed, urgency, and our faith in familiar brands.

"Bad actors are weaponizing our natural instinct to believe what we see and hear," says Marijus Briedis, CTO at NordVPN, warning that these attacks no longer require advanced skills or significant resources. "Anyone with an internet connection can launch them."

It's in this context that "A single human error is now more likely than ever and likely to be more devastating than ever," Briedis added.

The numbers behind the threat

NordVPN analyzes 12 million unique URLs daily, blocking an average of 130,000 malicious pages every 24 hours before they can reach a user — a critical defense mechanism as NordVPN’s antivirus tool continues to block massive volumes of malicious sites.

Malware remains the single largest threat by volume. January 2026 saw a massive peak of over 5 million blocked attempts as attackers preyed on post-holiday shoppers. Most of these were infostealers aiming to grab saved login credentials.

The US was the hardest hit with 4.89 million attempts across the first half of the year, followed by the UK (2 million) and Germany (1.32 million).

Phishing is equally rampant. NordVPN blocked over 4.4 million phishing attempts in the first half of the year, noting that 99% of these attacks impersonate a narrow list of just 300 brands, often disguised as fake job recruiter campaigns.

Microsoft was the most impersonated company (16.12%), followed by Roblox (12.32%), Google (9.94%), and Netflix (5.99%). Adding to the danger, attackers frequently exploit the trusted .com domain, which accounts for 43.2% of all intercepted scams.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Hijacked sessions and the Dark Web

While users are increasingly wary of downloading fake apps or clicking shady links hidden in pirate sites, attackers are finding stealthier ways in.

Between January 1 and May 26, 2026, a staggering 94 billion cookies were exposed online. Of these, 1.2 billion were active session cookies, which cybercriminals can use to hijack accounts without needing a password, often completely bypassing multi-factor authentication (MFA).

Once data is stolen, it is swiftly commodified. Using its Dark Web Monitoring tools, NordVPN identified 8.4 million compromised accounts in just 90 days.

Frighteningly, over 47% of the exchanged data involved physical addresses and full names, allowing attackers to weave digital and real-world identifiers together into comprehensive victim profiles.

Telephony isn't safe, either. Between the service's launch and June 16, NordVPN blocked nearly 29,000 scam calls and issued spam warnings to over 525,000 users.

How to stay safe

Because technical barriers for criminals are lower than ever, defensive strategies must evolve. NordVPN's report stresses that consumer protection now requires a mix of both technological defenses and behavioral resilience.

Alongside using security tools like a virtual private network (VPN) and antivirus software, users must cultivate a healthy skepticism. If a message, email, or website demands urgent action or offers something too good to be true, pause and verify.

In the age of AI-driven fraud, a moment of hesitation is your best line of defense.

Proton's Unlimited plan has dropped $120, making now the cheapest time to ditch Google entirely, should you wish.

The plan includes everything you'd expect from Google's privacy-unfriendly suite: Docs, Drive, Calendar, Mail, Sheets, and so on. But, it also throws in extras such as Proton VPN, one of the best VPNs available, and Proton Pass, a premium password manager which includes the super-handy email aliasing feature.

Normally, the Proton Unlimited bundle costs $12.99 per month over two years, billed as $311.76.

This deal brings a 38% discount, making it $7.99/month. That saves $120, bringing the total 2-year cost to $191.76.

Unlike Google's suite, all of Proton's tools are end-to-end encrypted and ad-free. This means whatever you send, upload, or create is protected from snoopers looking to intercept your information to use maliciously or sell online.

This is the lowest Proton Unlimited price we've seen in 2026 but we don't know how long it'll last. So, if you're interested, sign up now to lock in the deal, and you can always make use of Proton's 30-day money-back guarantee if you change your mind.

While ditching Google entirely might seem scary, Proton is taking steps to make it as simple as possible.

Its 'Easy Switch' tool sits at the heart of this. It allows you to sign into your old email account, from which Proton automatically pulls information such as your emails, contacts, and calendar.

Files aren't quite so slick but Proton has guides for transferring from services such as Google Drive, OneDrive and more to help you get started.

I've used Proton's privacy suite for nearly two years now. Since the addition of Meet and Sheets (alongside Calendar, Docs, Drive, Mail, Pass and Wallet) it now feels more like Google Workspace than ever, and it's all far more secure.

All of the tools included can be signed up for separately. Most are pricey on their own but the Unlimited bundle makes it really good value.

• NordVPN's antivirus blocked 99.1% malware in latest West Coast Labs test
• Artifact Security ranked NordVPN first out of five providers for performance
• The tests confirm connection times of just 1.8 seconds and zero data leaks

Users looking for the best VPN want the perfect balance of security and speed. According to two newly released independent evaluations, NordVPN is currently delivering exactly that on a global scale.

Over the summer, testing firm West Coast Labs (WCL) awarded NordVPN's built-in antivirus tool its highest AAA certification. Back in June, London-based Artifact Security crowned the vendor as the fastest and most reliable provider in a comprehensive global performance test, proving NordVPN continues to score all-positive results on independent audits.

For everyday users, these results are incredibly reassuring. It means you don't have to sacrifice your browsing speeds to stay safe online. The evaluations simulated real-world conditions, proving the app can swiftly block malicious sites and high-severity threats and handle high-speed downloads without breaking a sweat or leaking your personal data.

Top-tier malware protection

Under its WCL Validated methodology, West Coast Labs threw 934 malware samples at NordVPN's next-gen antivirus. The software successfully detected 926 of them, achieving an impressive 99.1% detection rate, well above the 95% threshold required for certification.

This latest achievement builds on the tool's previous successes, having already aced independent testing for its high phishing block rate in past assessments.

Crucially, the testing evaluated the product using its default configuration, meaning no custom tuning or vendor-supplied exclusions were used to artificially boost the score. NordVPN passed all 22 Core and 12 Augment lifecycle requirements across six stages, including deployment, functionality, and removal.

Because a single Core failure results in instant disqualification, this sweep earned NordVPN the highest available AAA certification rating.

"These results tell us the product is doing its job where it matters," said Marijus Briedis, chief technology officer at NordVPN. "What we’re most proud of is that this was tested under default configuration with no exclusions applied. That’s how most users actually run it, and that’s the standard we hold ourselves to."

Unmatched speed and reliability

Security is only half the battle; a VPN must also be fast. Artifact Security's 2026 VPN Performance World Tour evaluated five major VPN providers (NordVPN, Surfshark, ExpressVPN, Proton VPN, and Mullvad) across five origin regions (Germany, Singapore, US West, US East, and the UK) spanning 55 route-pinned highways.

NordVPN dominated the field, finishing first with an overall score of 91 and taking home the test's only Platinum award. On its Windows VPN, the provider led the pack with an average download speed of 271.9 Mbps and a peak download median of 568.4 Mbps. It also proved highly responsive, averaging just 1.8 seconds to establish a working tunnel with a 98% success rate.

Most importantly for privacy advocates, all tested providers, including NordVPN, passed every standard and advanced leak scenario. Across IP, DNS, IPv6, WebRTC, server-switch, and split-tunneling tests, no traffic escaped the encrypted tunnel.

"Performance testing at this scale is a much harder standard to meet than a single-location benchmark," said Briedis. "Coming out first overall and winning three regions outright gives us confidence that the infrastructure improvements we’ve been making are translating into something users can actually feel, regardless of where they connect from."

• Tor unveils Snowflake Volunteer as a standalone Android app
• The app lets users share their open internet connection
• It is the result of a collaboration between Tor and Bloco

The team behind the censorship-resistant Tor Browser has unveiled Snowflake Volunteer — a standalone Android app that lets you help people living in restricted countries bypass internet censorship.

Developed in collaboration with Portuguese Android studio Bloco, the app expands on Snowflake's capabilities. That's Tor’s pluggable transport, which allows people on censored networks to connect to the Tor network via volunteer-operated proxies, making their connection appear as normal traffic.

Since its official launch in April, Tor reported that the app saw an increase from about 1,300 unique proxy IP addresses per day in May to 1,700 per day in June, marking a 29% increase in one month. That represents a win for raising public awareness and expanding its volunteer-led community.

Altruistic digital privacy

Tor Browser is a free-to-use, privacy-focused network that routes Internet traffic through a series of secure computers run by volunteers in different countries — the "layers of an onion" —to prevent snoopers from identifying you personally as the one visiting sensitive sites.

Just like the best VPNs, Tor is all about protecting your privacy online. However, its system only works if people around the world volunteer to run the access points.

Tor bridges, like Snowflake, allow digital users living in safer countries to make their private connections available by turning their phones and computers into proxies, making it appear that they are making video or audio calls. A system that has been widely used as an alternative to VPNs in countries under censorship, including Iran.

It uses the "domain fronting" technique to establish a connection with one of the thousands of Snowflake proxies managed by volunteers. For users subject to censorship, if their Snowflake proxy is blocked, the broker will automatically find a new one.

What Snowflake actually needs is more volunteers' proxies that can serve as disguised access points to the Tor network. Perfectly addressing this need, the Snowflake Volunteer app was created specifically to allow people with less technical experience to easily become these proxies and contribute to the network's continued expansion.

Indeed, until now, the option was available for Android on Orbot, Tor's main Android app, or via browser extensions, a desktop command-line tool, and manual access to Tor's Kindness mode to facilitate the process.

The new app widely simplifies the experience. Users can simply install the app from F-Droid and Google Play (or build it from the source code) and let it run in the background to have their device become part of the Tor bridge. They can also restrict its use to networks with unlimited data, and set a limit on the number of people who can connect at the same time.

Once enabled, the app automatically connects with users seeking a Snowflake proxy and helps route their connection through the Tor network, making it easier and more rewarding to help others online, as people can see the impact of their actions.

Tor vs VPNs?

Is it wise to use a VPN with Tor? Unfortunately, there is no universally accepted answer.

Tor's official stance for most users is not to use a virtual private network (VPN) to avoid the risk of exposing identifying information. However, if you’re an experienced user who understands the technical aspects of VPNs and Tor routing, you could safely opt for more complex configurations.

Others, however, argue we should all use VPNs: particularly in countries with high levels of censorship, some believe it’s better to use VPNs, as they mix better into normal traffic and arouse less suspicion.

Unfortunately, though, this approach fails where VPNs are subject to restrictions or made illegal — further proof that, when it’s about digital security, there might be no one-size-fits-all solution.

There are some very good and obvious reasons why a VPN should be part of your summer holiday plans.

Anyone who's ever had to rely on crawling hotel Wi-Fi speeds or faced blocks on their regular home streaming services while abroad will understand the frustration, and a VPN is a great solution for both of those.

A VPN will mask your online activities to make sure you can access whatever you like on public Wi-Fi without the network restricting your bandwidth or recording the sites and services you go to.

You can also use a VPN to supply you with an IP address of any country in the world, of course. That means that your device can appear to be connecting from back home and you won't get blocked from accessing iPlayer, Sling or any of your other regular streamers.

All good VPNs offer these things, and for a few dollars a month, it's well worth downloading one for this year's summer vacation.

If you are going to give that a try, then you should have a think about IPVanish. It's a very good VPN – not the best VPN, but a very good one – but the reason it's a good choice for your travels this time is that an IPVanish subscription currently comes with a free eSIM to use for 30 days too.

Compare that to ExpressVPN – the only other recommended VPN company that offers a free eSIM right now. First, ExpressVPN's plans are twice as expensive ($2.19 per month vs $4.49 per month) but, secondly, you only get access to your eSIM for 3 days with ExpressVPN!

Sign up to the IPVanish Essential plan ($2.19 per month) and you'll get 3GB for 30 days. If you go for the Advanced plan ($3.29 per month), then it's 5GB for 30 days.

The other good reason to try Advanced is that it comes with access to a cloud based browser called Secure Browser. This means that you'll do all your browsing and service accessing from IPVanish's cloud servers, instead of your own device, while on shared Wi-Fi networks. There's no way that any restricting network will have any idea of what you're doing and that should mean you're scot-free to access whatever you need with minimal disruptions.

You can read more about IPVanish and Secure Browser here. Have a great vacation and happy travels!

• Recorded Future found an Iran-linked group spreading spyware
• The malware is delivered through fake VPN and media player apps
• Researchers assess that most targets are Iranian users

A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.

Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.

It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.

Fake apps, real surveillance

Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.

Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.

According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.

Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.

It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.

MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.

Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.

Why a fake VPN makes such an effective lure

Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.

The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.

Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.

How to stay safe

Most readers will never be targeted by a state actor, but the underlying lesson travels.

Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.

Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.

Star ratings are a weak signal, since fake reviews are cheap.

• Windscribe said Bill C-22 won't change its privacy policies
• The bill would require service providers to retain user metadata
• Canada's Senate is set to discuss Bill C-22 in September

A Reddit user recently put a blunt question to Windscribe: is paying for a Canada-based VPN a privacy problem, given the surveillance bill working its way through Parliament?

The company's official support account answered without hedging. Windscribe will keep operating exactly as it has, the account said, with "no changes to our logging or privacy policies".

Canada is bringing in laws that genuinely complicate things for the company, Windscribe added, but that is internal work to sort out rather than something subscribers should expect to feel.

It's a calmer message than the one Windscribe was broadcasting in May, when it said it would sooner relocate its headquarters than start logging users. That put it alongside Signal and NordVPN, and made it one of the sharpest voices among the best VPN providers fighting the bill.

Bill C-22, formally the Lawful Access Act, cleared the House of Commons on June 18 and now sits with the Senate, which won't begin its study until Parliament returns in September.

Windscribe and Bill C-22: what the VPN provider said

Is paying for Windscribe a problem to privacy given they’re based in Canada and the likely upcoming Bill C-22? Would love to subscribe if not for this. from r/Windscribe

Pressed further in the thread, Windscribe drew a line between where the company is registered and where its infrastructure lives.

The incoming laws could see it served with a court order requiring it to start logging users, the support account acknowledged. Its answer is jurisdictional: a virtual private network (VPN) operating outside Canada doesn't have to comply with Canadian law.

That echoes the route the company has been signalling since May, when CEO Yegor Sak told the Globe and Mail he was actively exploring moving Windscribe out of the country.

Windscribe was also careful to separate provider obligations from user liability. No law currently stops Canadians from using a VPN, it pointed out, and the risk it describes only reaches customers if a provider stays put and starts logging traffic.

For anyone uneasy about the paper trail, Windscribe's suggestion was simple: pay in crypto, so neither the government nor a card issuer sees the purchase.

What's next for Canada Bill C-22

Introduced in March by Public Safety Minister Gary Anandasangaree, Canada Bill C-22 would let the government compel electronic service providers to retain user metadata and build technical capabilities for law enforcement access.

The House passed it at third reading on June 18 after the government moved to limit debate, and the Senate is set to pick it up on September 21, according to Parliament's own LEGISinfo tracker.

Late amendments cut the maximum metadata retention period from twelve months to six and added a clause stating the act can't be read as compelling decryption, unless the provider already holds the keys.

Still, law professor Robert Diab argues that doesn't go far enough, since ministerial orders could still sweep up the metadata of people under no suspicion whatsoever.

The government has consistently rejected the surveillance framing, insisting the bill builds no backdoors and that authorities still need judicial authorisation to obtain data.

ExpressVPN has kept its 30-day money-back guarantee on pause after launching a new promotion to follow its previous World Cup promotion.

The ExpressVPN Summer Tech Competition / Sweepstakes will see the company give away 30 new iPhone 17 Pros, with the caveat that users are not covered by ExpressVPN’s usual 30-day money-back guarantee.

The promotion runs from 11 July 2026 to 11:59 pm BST on 9 August 2026, directly following the ExpressVPN FIFA World Cup 2026 Ticket Giveaway event, which ran from 10 June 2026 to 11 July 2026.

During the promotion, each new sign-up gains 10 entries into the iPhone 17 Pro raffle, with the caveat that all sales are final during this period.

This means that ExpressVPN will not have offered its usual 30-day money-back guarantee for 60 days by the time the Summer Tech Sweepstakes promotion concludes.

Mixed reactions

On the surface, it might seem like ExpressVPN’s decision to remove the money-back guarantee during these promotional periods is logical.

After all, if the option for a refund were still available after entering a raffle for World Cup tickets or a new iPhone, users might attempt to game the system by entering the contest and then cancelling their ExpressVPN plan if they win.

However, ExpressVPN electing to deny users a money-back guarantee for two consecutive months has worried some users, representing a break from industry-standard practice.

Feedback to the decision has been mixed at best, with multiple commenters in the r/Express_VPN speaking out. User QueenBe12 warned others to “be careful” while user rockyyguy called the move “predatory business”, asking "who came up with this idea?"

new scamy tactics: Express VPN does not offer money back guarantee/ no refunds but offers you to enter the raffle to win an iPhone from r/Express_VPN

In a statement given to TechRadar, ExpressVPN said: "ExpressVPN sometimes runs optional, limited-time promotions — such as the current prize draw — which customers can choose to join.

These promotional plans are clearly identified and disclosed at the point of purchase, including that they offer additional benefits, such as prize-draw entry, in place of the 30-day money-back guarantee. This allows customers to make an informed choice about which option best suits them before they subscribe.

Whether a money-back guarantee is offered or not, customers' statutory rights are unaffected. Anyone on a promotional plan can also contact ExpressVPN Support to request a refund, and each request is considered on its merits."

Why are money-back guarantees important for VPNs?

Like most software services, VPNs can be paid for as monthly subscriptions – but almost all VPNs offer huge discounts for signing up to one- or two-year-long plans.

In the case of ExpressVPN, a two-year plan offers an 84 per cent discount versus renewing monthly, and you get four extra months free of charge.

As such, when we talk about VPN pricing here at TechRadar, we’re usually referring to the price of one of these extended plans. It’s typically the most economical choice for most users.

However, our price-based recommendations are usually made in the context of money-back guarantees, which protect users from long payment plans if they sign up to the wrong option or realize that a certain VPN isn’t for them.

These guarantees are offered by many of the best VPNs, and many smaller and mid-tier brands will provide them as well. NordVPN and Surfshark VPN both offer 30 days; CyberGhost bumps this up to 45 days, and Norton VPN gives users a full 60 days.

This is all to say that ExpressVPN removing its money-back guarantee, even for a promotion, is a pretty big deal and a genuine reason to consider avoiding a longer plan until the promotional period concludes.

So, if you’re still keen on picking up ExpressVPN, consider picking up a monthly plan or waiting until 10 August for a longer plan, and be sure to check out our ExpressVPN review for an in-depth breakdown of its features and performance.

In the past year I've spent tens of hours streaming with VPNs, and one thing is consistently problematic for even the best VPNs — live events.

So, if you're traveling and keen to catch BBC's coverage of England vs Argentina later this evening instead, you might think you're stuck. Thankfully, NordVPN proved to be the one streaming VPN I tested that consistently performed well in these scenarios.

Over the past year, I've used NordVPN with Peacock, BBC iPlayer, TNT Sports, ITVX, and 7Plus. And compared to any other VPN, it's proved the most effective.

I experienced the least delayed streams, the least buffering, and, most importantly, the fewest complete connection dropouts when using NordVPN. So, while cheaper alternatives such as Norton VPN and Surfshark exist, if you want the most reliable performance, this is where I'd put my money.

If you don't want a long term commitment, you could always choose to pick a monthly plan. For $15, you can watch the rest of the tournament and gain all the additional security benefits that come with a VPN.

You don't need NordVPN's most advanced features to watch England with a VPN. That's a good thing, as right now its premium plans are considerably more expensive than many other providers.

With long term plans, Surfshark plans start at $2.49/month, a full dollar cheaper per month; the same goes for Norton VPN. If you're really budget-focused, both PIA and Cyberghost are less than $1.60 per month right now, too.

But, should you choose a NordVPN Plus plan or above, you do get some great perks. NordPass, the best password manager we've tested, cloud storage, dark web monitoring, and more are on offer.

It's worth mentioning that buying the more premium plans monthly will set you back at least $20, so I'd recommend signing up for a longer duration if you prefer these extra features.