Lagosec Inc Charge Explained: NordVPN Billing (2026)

Last reviewed and updated: April 2026 — verified against current regulatory guidance and financial data.

This guide draws on NordVPN’s publicly available General Terms of Service, U.S. consumer protection law including the Fair Credit Billing Act (15 U.S.C. § 1666), corporate registration filings from the Delaware Division of Corporations, and analysis of real consumer billing inquiries — reviewed for accuracy as of April 2026.

Lagosec Inc (Billing Descriptor)

A U.S.-registered payment processing entity operated by Nord Security. It appears on credit card and PayPal statements in place of “NordVPN.” Registered as Lagosec, Inc. at 651 N Broad St, Suite 206, Middletown, New Castle, Delaware 19709.

Billing Descriptor

The merchant name displayed on your bank or credit card statement when a charge is processed. It often differs from the consumer-facing brand name, which causes confusion for cardholders.

Chargeback

A reversal of a credit card transaction initiated by the cardholder’s bank. Under the Fair Credit Billing Act, U.S. consumers can file a chargeback for unauthorized charges within 60 days of the statement date.

What Is Lagosec Inc?

Lagosec Inc is the payment processing subsidiary that Nord Security uses to bill U.S. customers for NordVPN, NordPass, NordLocker, and other Nord products. When your subscription renews — or when you first sign up — the charge on your credit card or PayPal statement reads “Lagosec Inc” instead of “NordVPN.” This mismatch between the billing name and the product name is the single most common reason people search for this company.

“Lagosec, Inc. (registered at 651 N Broad St, Suite 206, Middletown, New Castle, Delaware 19709, United States); payments for residents of the United States.”

Many people ask “what is Lagosec” because the billing descriptor doesn’t match anything they remember buying. This is standard practice in the subscription software industry. Companies routinely use different legal entities for payment processing, tax compliance, and regional billing operations. NordVPN is far from the only company that does this — but because VPN subscriptions often renew annually rather than monthly, the charge can feel surprising when it suddenly appears after 12 or 24 months of silence.

What most guides miss is that Nord Security assigns different billing entities depending on where you live. According to NordVPN’s own Terms of Service, U.S. residents are billed through Lagosec, Inc. in Delaware, while customers in Europe might see charges from Mollymind AG (Switzerland), and those in the UK could see Moonflash Limited (London). The Lagosec descriptor specifically signals a U.S.-based transaction.

Here’s what Lagosec Inc is not:

• ✗ It is not a standalone product or service you can buy from directly
• ✗ It is not a scam company — it is a registered U.S. business entity
• ✗ It is not a credit card skimmer or phishing operation
• ✗ It is not a random third-party payment processor — it is owned by Nord Security

If you’ve spotted “Lagosecinc,” “Lago Sec Inc,” or “Lagose Inc” on your statement, those are simply formatting variations of the same entity. Credit card networks and bank statement systems sometimes truncate, respace, or slightly alter merchant names during processing.

What Is Lagosec Inc — The Company Behind the Charge

Lagosec Inc is a Delaware-registered corporation that serves as Nord Security’s U.S. billing arm. It is not an independent payment processor serving multiple clients. Its sole purpose is to route subscription payments from American customers to the Nord Security ecosystem. Here is everything publicly known about the company’s registration and structure.

“More than 1.8 million legal entities have their statutory home in Delaware, including more than 66% of the Fortune 500.”

Delaware incorporation is not a red flag. It is the most common state for U.S. corporate registrations because of its well-established business law framework, specialized Court of Chancery, and efficient filing process. The fact that Lagosec Inc is registered there follows the same pattern as Apple, Google, Amazon, and thousands of other legitimate companies.

Expert insight: One detail that separates Lagosec from a genuine scam entity is traceability. Lagosec Inc is explicitly listed by name and address in NordVPN’s public Terms of Service. Fraudulent billing companies, by contrast, deliberately avoid appearing in any legitimate company’s documentation. If a billing descriptor shows up in a product’s official terms, it is virtually always a legitimate entity.

For context on how other legitimate payment processors create similar confusion, our guide on Solidgate LLC charges on credit cards details another company that frequently surprises cardholders with unfamiliar statement names.

Lagosec PayPal Charge — Why It Appears on Your Statement

A Lagosec PayPal charge appears because PayPal displays the merchant’s legal business name — not the brand name you recognize. Since NordVPN routes all U.S. PayPal payments through its Lagosec Inc subsidiary, your PayPal transaction history and linked bank statements show “Lagosec Inc” or “PayPal *Lagosec Inc” rather than “NordVPN.”

This PayPal Lagosec Inc charge is one of the most searched billing descriptors on the platform. The confusion runs deep because PayPal transactions often show up on your connected bank statement twice — once in PayPal’s activity log and once on your bank or credit card statement — both using the unfamiliar “Lagosec” name.

• ✓ NordVPN routes U.S. PayPal payments through its Lagosec Inc subsidiary
• ✓ PayPal is required to display the merchant’s registered legal name
• ✓ The charge applies to both one-time and recurring subscription payments
• ✓ It covers NordVPN, NordPass, and NordLocker if bundled with your Nord subscription
• ✓ Bank statements may show “PayPal *LAGOSEC INC” as the combined descriptor

“The name of the seller or the party receiving your payment will appear on your transaction history and receipt.”

To confirm a PayPal Lagosec Inc charge, follow these steps:

1. Log into your PayPal account at paypal.com
2. Go to Activity and find the Lagosec transaction
3. Click the transaction to expand its details
4. Look for the merchant email address — it should link to a NordVPN or nordsec domain
5. Check the Subscription ID if listed — this confirms it’s a recurring payment
6. Note the date and amount; compare them against your NordVPN account billing history

If the PayPal charge is a recurring subscription you want to stop, navigate to Settings → Payments → Manage automatic payments, find “Lagosec Inc,” and click Cancel. This immediately prevents future billing cycles. PayPal’s own dispute window is 180 days — three times longer than the 60-day credit card window — so you have more time to act on PayPal charges if needed.

Real-world scenario: A PayPal user notices three charges labeled “PayPal *LAGOSEC INC” over 10 months and assumes fraud. After logging into PayPal and expanding the transaction details, they discover each charge corresponds to a monthly NordVPN subscription they signed up for during a promotional trial. The trial converted to a paid plan, and the user never noticed the confirmation email buried in their promotions folder. Canceling the billing agreement in PayPal immediately stops future charges.

If you’ve encountered other mysterious PayPal charges, our guide on Gosq Com charges on credit cards explains how third-party payment processors create confusing statement descriptors across multiple payment platforms.

Lagosec Inc Charge on Credit Card Explained

A lagosec charge on credit card statements works the same way it does on PayPal — your credit card issuer displays the merchant name as registered with the payment network, which is “LAGOSEC INC” rather than “NordVPN.” The charge appears on Visa, Mastercard, American Express, and Discover cards alike. The format may vary slightly — you might see “LAGOSEC INC,” “LAGOSEC*NORDVPN,” or simply “LAGOSEC” depending on your card issuer’s statement formatting.

Here are the typical charge amounts, based on NordVPN’s current published pricing:

A common misconception is that any unfamiliar credit card charge must be fraud. The Consumer Financial Protection Bureau (CFPB) recommends contacting the merchant directly before filing a dispute, because many unrecognized charges turn out to be legitimate transactions the cardholder simply didn’t recognize — forgotten trials, family member purchases, or auto-renewals from months earlier.

“Before disputing a charge, contact the merchant directly. Many disputes are resolved quickly when the consumer identifies the charge as a forgotten subscription or authorized purchase.”

Real-world scenario: A cardholder sees a $107.73 charge from “LAGOSEC INC” on their Visa statement and panics. They call Chase to report fraud. The bank issues a provisional credit and opens an investigation. Two weeks later, Chase determines that the cardholder’s spouse signed up for a 2-year NordVPN Plus plan during a Black Friday promotion. The provisional credit reverses. The entire process — the phone calls, the investigation, the reversal — could have been avoided by spending two minutes checking with household members first.

The lagosec inc charge on credit card statements is especially confusing for annual and biennial plans because the charge appears only once per year (or once every two years). By the time it renews, many subscribers have forgotten they signed up. NordVPN does send renewal reminder emails, but they often land in spam or promotions folders where they go unnoticed.

Lagosec Inc NordVPN — The Connection Explained

Lagosec Inc and NordVPN are the same corporate family. NordVPN’s parent company, Nord Security (headquartered in Vilnius, Lithuania), operates through multiple subsidiaries for billing in different countries. Lagosec Inc is the entity specifically designated to handle payments for U.S.-based customers.

According to NordVPN’s General Terms of Service, Nord Security uses at least five billing entities worldwide, each assigned to a different geographic region:

“Delaware is the legal home to more than 66% of Fortune 500 companies, and more than 1.8 million legal entities are registered in the state.”

This multi-entity structure is not suspicious. International SaaS companies routinely establish regional billing subsidiaries for three practical reasons:

• ✓ Tax compliance: Each country has different VAT, GST, and sales tax requirements
• ✓ Payment routing: Local entities reduce cross-border transaction fees and improve approval rates
• ✓ Regulatory compliance: Some jurisdictions require a local registered entity to process consumer payments

If you see a Lagosec Inc NordVPN charge, verify it by:

1. Logging into your Nord account at my.nordaccount.com
2. Clicking Billing in the left sidebar
3. Comparing the charge date and amount against your bank statement
4. Checking whether auto-renewal is active under Subscription

The match between the charge date, amount, and payment method in your Nord account and your bank statement is definitive proof the charge is legitimate. If the numbers align, there is nothing to worry about.

Lagosec vs. Moonflash and Other NordVPN Billing Names

Lagosec Inc is not the only confusing billing name NordVPN uses. Multiple NordVPN billing descriptors have triggered fraud alerts and online complaints over the years. Knowing all of them helps you identify legitimate charges instantly — and avoids unnecessary disputes that waste your time.

NordVPN has used or currently uses the following billing descriptors:

• ✓ Lagosec Inc — Current descriptor for U.S. credit card and PayPal charges
• ✓ Moonflash Limited — Used for UK-based customers; frequently triggers bank fraud alerts
• ✓ Mollymind AG — Used for certain European transactions, registered in Switzerland
• ✓ CloudVPN Inc — Older descriptor used prior to Nord Security’s corporate restructuring
• ✓ Tefincom S.A. — Former entity used for international billing from Panama
• ✓ nordvpn S.A. — Used for some direct Panamanian transactions (the clearest descriptor, ironically)
• ✓ Cyberpost — Used for Brazilian and select Latin American customers

“NordVPN provides VPN services through subscriptions. If you see a suspicious charge from NordVPN or any Nord product on your card statement, get in touch with our customer support. Sometimes, the charges might be due to a friend or family member using your card.”

The Moonflash descriptor, in particular, has triggered more fraud alerts than any other NordVPN billing name. A widely-shared Reddit thread from r/nordvpn documents dozens of users who received automated fraud alerts from their banks about a “Moonflash” purchase — only to discover it was their NordVPN renewal. Several commenters in that thread also mentioned seeing “Lagosec Inc” and experiencing the same confusion.

Why does NordVPN use so many different names? Each billing entity corresponds to a specific geographic region and payment route. When NordVPN processes your payment, the transaction flows through whichever subsidiary is designated for your country. The payment network then stamps that subsidiary’s legal name on your statement. NordVPN doesn’t choose to hide its brand — the billing infrastructure simply works this way for international subscription companies.

For similar situations involving third-party billing names, our guide on Beck Services Inc charges on debit cards explains how another service uses an unfamiliar entity name for payment processing.

Lagosec Inc Charge: Legit or Fraud?

The Lagosec Inc charge is legitimate in the vast majority of cases. It is a real NordVPN billing entity registered as a U.S. corporation in Delaware. However, there are specific scenarios where the charge could indicate unauthorized activity — and knowing the difference can save you both money and hassle.

Signs It’s a Legitimate Lagosec Charge

• ✓ You have or previously had a NordVPN, NordPass, or NordLocker subscription
• ✓ The amount matches NordVPN’s published pricing (see the pricing table above)
• ✓ A family member, roommate, or partner with card access signed up for NordVPN
• ✓ You signed up for a free trial that auto-converted to a paid plan
• ✓ You received a subscription renewal email from NordVPN (check spam and promotions folders)
• ✓ The charge date aligns with your original signup date or its annual/biennial anniversary
• ✓ Your Nord account at my.nordaccount.com shows an active subscription matching the charge

Signs the Lagosec Charge Could Be Unauthorized

• ✗ You have never heard of NordVPN or used any VPN service
• ✗ No one in your household uses NordVPN or any Nord product
• ✗ The charge amount doesn’t match any standard NordVPN plan
• ✗ You canceled your NordVPN subscription months ago and confirmed the cancellation via email
• ✗ Multiple Lagosec charges appear in a short time frame (e.g., several within a week)
• ✗ You recently received a data breach notification involving your card number
• ✗ Other unfamiliar charges appeared on the same statement alongside the Lagosec charge

According to the Federal Trade Commission’s Consumer Sentinel Network, consumers reported over 1.1 million cases of credit card fraud in 2023, making it the most commonly reported form of identity theft that year. If your card was recently compromised in a breach, an unauthorized Lagosec charge is possible — even though the Lagosec entity itself is legitimate. A bad actor can use stolen card numbers to purchase subscriptions on any platform, including NordVPN.

Expert insight: A truly fraudulent charge using the Lagosec descriptor is rarer than many people assume. NordVPN accounts require email verification and account creation before a payment can be processed. A bad actor would need both your card number and a functioning email address. The far more common scenario? You forgot about a trial, your partner subscribed with your card, or your annual plan renewed after 12 months of no charges — and the surprise feels like fraud.

Concrete scenario: A user on X (formerly Twitter) posted: “seeing lagosec Inc and moonflash charges on my credit card means dem a try scam me don’t it?” The reality? Both Lagosec Inc and Moonflash are NordVPN billing entities. Seeing both on the same statement likely means the user has two Nord products (e.g., NordVPN billed through one entity and NordPass billed through another), or the billing entity changed mid-subscription.

How to Verify a Lagosec Transaction Step by Step

Verifying a Lagosec transaction takes less than five minutes. Follow these steps in order — most people resolve the mystery by step 3 and never need to contact their bank.

1. Search your email for NordVPN: Open your email inbox and search for “NordVPN,” “Nord Account,” “lagosec,” or “[email protected].” Look for receipts, subscription confirmations, or renewal notices. Critical: Check your spam, junk, and promotions folders — NordVPN emails frequently land there.
2. Check PayPal pre-approved payments (if applicable): If the Lagosec PayPal charge appeared in PayPal, go to Settings → Payments → Manage automatic payments. Look for “Lagosec Inc” in the list of merchants with active billing agreements.
3. Log into your Nord account: Visit my.nordaccount.com and try logging in with every email address you use. If you find an active account, navigate to Billing and compare the charge date, amount, and payment method against your bank statement.
4. Ask household members: Before filing a dispute, ask everyone in your household — spouse, partner, children, roommates — if they subscribed to NordVPN using your card. This is the most common explanation for “mystery” Lagosec charges that people don’t recognize.
5. Cross-reference the dollar amount: Compare the charge to NordVPN’s current pricing at nordvpn.com/pricing. If the amount matches a standard plan (see the pricing table earlier in this article), the charge is almost certainly a legitimate NordVPN subscription.
6. Check for free trial conversions: Think back to whether you signed up for any “free VPN trial” or clicked a promotional offer in the past 30 days. NordVPN’s 30-day money-back guarantee requires payment upfront — if you forgot to cancel within the window, the charge stays.
7. Contact NordVPN support: If none of the above steps resolve the issue, reach out to NordVPN’s 24/7 live chat at nordvpn.com. Provide your card’s last four digits. The support team can look up whether any active subscription is linked to that card.

“If you see a charge on your credit card that you don’t recognize, try to contact the merchant before disputing with your card issuer. Many unrecognized charges turn out to be purchases you forgot about or didn’t recognize.”

Many people who search “who is Lagosec Inc” or “Lagosec Inc, who is that” resolve the issue once they check their email inbox. NordVPN sends subscription confirmations, renewal reminders (typically 7 days before renewal), and payment receipts — they may just be sitting in your spam folder, unread.

How to Dispute or Cancel a Lagosec Charge

If the Lagosec charge is unauthorized — or you simply want to cancel your subscription and stop future billing — here are three clear paths, ranked from easiest to most aggressive. Start with Option 1 and escalate only if needed.

Option 1: Cancel Your NordVPN Subscription Directly (Easiest)

1. Log into your Nord account at my.nordaccount.com
2. Go to Services → NordVPN (or the specific Nord product being billed)
3. Click Change plan → Cancel automatic payments
4. Confirm the cancellation
5. You’ll receive a confirmation email — save it as proof

NordVPN offers a 30-day money-back guarantee on all plans. If your Lagosec charge is within 30 days, request a full refund through their live chat. Refunds are typically processed within 5–10 business days. After 30 days, you can still cancel auto-renewal to prevent future charges, but a refund for the current billing cycle is not guaranteed.

Option 2: Dispute Through PayPal (For PayPal Lagosec Charges)

If you paid through PayPal and see a PayPal Lagosec Inc charge, you have two sub-options:

• ✓ Cancel the billing agreement: Go to Settings → Payments → Manage automatic payments → find Lagosec Inc → click Cancel. This stops all future charges immediately.
• ✓ Open a PayPal dispute: Navigate to the Resolution Center, select the Lagosec transaction, and choose “I want to report unauthorized activity.” PayPal gives you 180 days to file a dispute — significantly longer than the 60-day credit card window.

PayPal disputes for recurring charges are generally resolved in the buyer’s favor if you can demonstrate you didn’t authorize the subscription. However, if NordVPN provides evidence that you created an account and accepted their terms, the dispute may be denied.

Option 3: File a Chargeback With Your Bank (Most Aggressive)

If NordVPN’s support team and PayPal don’t resolve the issue, escalate to your credit card issuer or bank:

• ✓ Credit card: Call the number on the back of your card. Request a chargeback for an unauthorized charge. You are protected under the Fair Credit Billing Act (FCBA), which limits your liability to $50 for unauthorized charges — and in practice, all major card networks offer $0 liability.
• ✓ Debit card: Contact your bank. Under the Electronic Fund Transfer Act (EFTA, 15 U.S.C. § 1693), you must report unauthorized debit card charges within 60 days to limit liability to $50. Report within 2 business days and your liability drops to $0.

Important timing: Under the FCBA (15 U.S.C. § 1666), you must send your dispute to the card issuer within 60 days of the statement date on which the charge first appeared. Miss that window, and you lose your federal chargeback rights for that specific charge.

Insider tip: When filing a chargeback, always reference the specific transaction date, exact dollar amount, and merchant descriptor (“Lagosec Inc”). Banks process disputes faster when you provide precise details rather than vague descriptions. Also mention that you attempted to contact the merchant first — this is called “good faith effort,” and banks view it favorably when deciding whether to approve the dispute.

For more on handling unfamiliar charges from payment processors, see our guide on Spred charges on debit cards, which covers a similar dispute workflow for another confusing billing descriptor.

Lagosec Inc Customer Service — How to Get Help

Lagosec Inc customer service is handled entirely by NordVPN’s support team. There is no separate Lagosec phone number, website, or support portal. All billing inquiries, refund requests, and cancellation requests go through Nord Security’s centralized support channels.

“If you see a suspicious charge from NordVPN or any Nord product on your card statement, get in touch with our customer support by pressing the contact buttons at the bottom of this article.”

What to have ready before contacting Lagosec Inc customer service:

• ✓ The email address associated with your Nord account (if you know it)
• ✓ The last four digits of the card that was charged
• ✓ The exact charge amount and date from your bank or PayPal statement
• ✓ A screenshot of the charge (helpful for faster resolution, but not strictly required)
• ✓ Your PayPal transaction ID (if the charge came through PayPal)

Pro tip for faster resolution: Use the live chat instead of email. NordVPN’s chat agents can look up your account by card details in real time and issue refunds during the same session. Email support, while thorough, adds a 12–24 hour delay to each back-and-forth exchange. If you need a paper trail for a bank dispute, ask the chat agent to email you a transcript of the conversation — they can do this at the end of the chat.

Prevent Unknown Charges in the Future

The Lagosec charge catches people off guard because the billing descriptor doesn’t match the product. This is frustrating, but it’s also entirely preventable. These six habits protect you from both confusing legitimate charges and genuinely unauthorized transactions.

• ✓ Enable real-time transaction alerts: Every major U.S. bank and credit card issuer — Chase, Bank of America, Capital One, Citi, Amex, Discover — offers free push notifications for transactions. Turn them on so you see every charge the moment it posts, not 30 days later when your statement arrives.
• ✓ Maintain a subscription tracker: Use your bank’s built-in subscription detection feature (Chase and Capital One both offer this), or maintain a simple spreadsheet. Log every recurring charge with the merchant’s legal billing name (e.g., “Lagosec Inc”), not just the brand name you recognize. When a renewal hits, you’ll instantly know what it is.
• ✓ Use virtual card numbers for subscriptions: Services like Privacy.com or your card issuer’s virtual card feature let you create unique card numbers for each subscription. If you see a charge on a specific virtual card, you instantly know which service triggered it. You can also set spending limits on each virtual card to prevent unexpected renewal amounts. For a comprehensive comparison, our guide on the 10 best virtual credit card apps in the USA covers your top options.
• ✓ Review statements weekly, not monthly: Under the FCBA, you have 60 days from the statement date to dispute unauthorized charges. Catching suspicious charges early gives you maximum time to investigate and act. A weekly 5-minute review of your banking app is the single best habit for financial security.
• ✓ Screenshot every subscription confirmation page: When you subscribe to any service — NordVPN, streaming platforms, software tools — screenshot the confirmation page showing the merchant name, amount, and billing frequency. Store these in a dedicated folder on your phone or cloud drive. When a confusing charge appears months later, you have an instant reference.
• ✓ Set calendar reminders for annual renewals: For subscriptions that bill yearly or biennially (like NordVPN’s 1-year and 2-year plans), create a calendar reminder 7 days before the renewal date. This gives you time to decide whether to keep or cancel the service before the charge posts.

According to the Federal Reserve, card-not-present transactions — online purchases and subscriptions — continue to grow as a share of total U.S. card payments year over year. As more spending moves online, unfamiliar descriptors like Lagosec Inc, Venuplus Inc, Moonflash, and others will only become more common. Building strong monitoring habits now saves you from repeated confusion and potential losses down the road.

Final Verdict on the Lagosec Inc Charge on Credit Card

A lagosec inc charge on credit card or PayPal statements is a legitimate NordVPN subscription payment in the vast majority of cases. The entire confusion exists because the billing descriptor — Lagosec, Inc. — doesn’t match the NordVPN brand name consumers recognize. This is standard practice for subscription software companies operating through regional subsidiaries, and it affects thousands of cardholders every month.

Here is your quick action plan if you see this charge:

1. Search your email for NordVPN receipts, renewal notices, or trial confirmations
2. Log into your Nord account at my.nordaccount.com and check the billing section
3. Ask household members if anyone subscribed using your card
4. Cancel auto-renewal through your Nord account if you no longer want the service
5. Request a refund within 30 days via NordVPN’s 24/7 live chat
6. File a chargeback with your bank within 60 days if the charge is truly unauthorized

The reason the Lagosec Inc charge on credit card statements appears is straightforward: NordVPN bills U.S. customers through a Delaware-registered subsidiary called Lagosec, Inc. It is not a scam. It is not a billing error. It is simply how the payment routing works for an international VPN company with millions of subscribers. Five minutes of investigation resolves nearly every case.

To protect yourself from future billing surprises, enable real-time transaction alerts, keep a subscription log with legal billing names, use virtual card numbers for each subscription, and save every confirmation email. These habits eliminate the guesswork the next time an unfamiliar descriptor appears on your statement.