Your Statement Proves Payment. It Never Proves Delivery.

A woman I know asked me to look at her PayPal account. She wasn't panicking. She had the feeling most people get eventually — that money was going out and she couldn't account for all of it. She had twenty-five months of statements saved as PDFs, one per month, August 2024 through August 2026.

I ran them through a discovery and cleanup process I've been building: pull every transaction row off every page, normalize the merchant names, match each payment to the card leg that funded it, then look for shape. Not fraud. Shape. Recurring intervals, price changes, vendors running more than one billing stream at once.

It took the better part of a day. Here's what fell out.

The numbers

837 transaction rows. 406 of them actual payments to merchants. $30,577.05 gross, $1,762.29 back across thirteen refunds, $28,814.76 net. Median payment, $50.48.

Of those 406 payments, 214 — fifty-three percent — were taken under billing agreements. No checkout. No click. No moment where anybody decided anything. The merchant holds an authorization and charges on a schedule. Forty-six different merchants had one.

Twenty-five recurring series, $9,186.50 total. Thirty percent of every dollar that left the account.

Seven of those series were still live when the records ended: $650.17 a month. $7,802 a year, running on an account nobody was watching.

The teaser is the product

Thirteen series changed price at some point. Nine followed the identical shape — a low first charge, then the real one, and the real one never moves again.

• Ads4you OÜ: $4.99, then $19.99. Up 301%.
• Ro (Roman Health Ventures): $45.00, then $145.00. Up 222%.
• Lasta: $9.90, then $29.99. Up 203%.
• Actitech Limited: $25.99, then $66.65. Up 156%.
• Reface: $7.99, then $19.99 — weekly.
• FITME: $24.99, then $49.99.

Now look at when the step-up lands. Ads4you's came four days after the first charge. Reface's, seven. Lasta's, twenty-seven. Ro's, thirty-two.

I can't tell you those intervals were chosen deliberately, and I'm not going to pretend otherwise. What I can tell you is that a charge which arrives four days after a $4.99 trial and a charge which arrives thirty-two days after a $45 one have something in common: both land after the moment you stopped thinking about it, and at least one of them lands outside a thirty-day window.

A few more from the same pile:

• Two weekly app subscriptions started eleven days apart in mid-2026 — Reface and Ads4you, $19.99 a week each. Left alone, that pair is $2,084 a year.
• One vendor took seven separate charges in a single day: $491.96, all on the same date, all to the same merchant.
• Four merchants ran two concurrent billing streams. Lasta opened two plans on the same day on the same 28-day cycle — $55.82 and $29.99 — which reads as one subscription on a bank statement and is two.
• Eighteen payments totalling $1,902.09 print no merchant name at all. Not an abbreviation, not a payment processor's name — the field is simply absent from the statement. Largest was $395.61. The only way to identify them is to look up each transaction ID in PayPal's web activity, one at a time.

What the records cannot tell you

This is the part I want people to sit with, because it's where careless analysis turns into a lawsuit.

A statement proves money moved. It proves the date, the amount, and the counterparty as the processor recorded it. That's the entire list.

It does not prove a product shipped. It does not prove a service was rendered. It does not prove she didn't sign up on purpose, didn't want it, or didn't use it happily every single month.

I put that sentence on the front page of the audit before I wrote a single finding, because I knew where the reader's mind would go the moment they saw a number like $7,802.

Payment is not delivery. Every conclusion you draw past that line needs evidence that lives somewhere else.

So: Ro went from $45 to $145. That's arithmetic off a statement and it's true. If I wrote that Ro took her money and shipped nothing, I'd be asserting something my data cannot support, about a named company, in public, under my own name. Those are two very different sentences, and only one of them is defensible.

The evidence that closes that gap is boring and it all lives on her side of the transaction — shipping confirmations, delivery notifications, app login history, the emails. That's the second pass. It's slower, and it's the only thing that turns "this looks odd" into "this was wrong."

If you take one working habit from this piece, take that one. Separate what your data proves from what it suggests, and label them differently in your own notes, before anybody asks you a pointed question about it.

The mechanism almost nobody explains

Here's the technical part, and I'd bet most people reading this don't know it.

When you subscribe to something through PayPal, you are not authorizing a payment. You're authorizing a billing agreement — a standing token the merchant holds that lets them initiate charges without you present. PayPal surfaces these as "Automatic Payments" or "PreApproved Payments."

The token is the thing that matters, and it has properties people get wrong:

• Cancelling inside the merchant's app does not revoke it.
• Deleting the app does not revoke it.
• Getting a replacement credit card does not reliably revoke it, because the agreement lives at PayPal and PayPal re-points it at your new funding source.

It dies in exactly one place: Settings → Payments → Automatic Payments. One screen, listing every merchant currently able to charge you without asking.

Forty-six merchants were on hers. She thought she had about five subscriptions.

That single screen closed more exposure than every other finding in the audit put together. Your card issuer has an equivalent list, and it's worth pulling both — the card sees charges that never touch PayPal at all.

The law is, right now, a gap

If you assumed there's a federal rule requiring cancellation to be as easy as signup — there was, briefly, and there isn't today.

The FTC finalized its Negative Option Rule, the one everyone called click-to-cancel, in October 2024. It required express informed consent, clear disclosure of terms before billing information is collected, and a cancellation path at least as simple as the one you signed up through.

In July 2025 the Eighth Circuit vacated it — days before the compliance deadline. Not on the merits. On process: the court held the FTC skipped a preliminary regulatory analysis that Section 18 of the FTC Act requires once a rule's projected economic impact crosses the major-rule threshold.

The agency restarted. An advance notice of proposed rulemaking went out on March 11, 2026, comments closed April 13, and as of this writing there is no replacement rule in force.

What is in force: Section 5 of the FTC Act, the Restore Online Shoppers' Confidence Act of 2010, and roughly thirty state automatic-renewal laws, several stricter than the federal rule ever was. ROSCA already requires clear disclosure before billing information is taken, express informed consent, and a simple mechanism to stop recurring charges. Enforcement hasn't paused — $2.5 billion from Amazon and $8.5 million from Care.com came out of exactly these provisions.

So the practice is regulated. It's just regulated case by case instead of by a bright line, which puts the burden of noticing back on the account holder. Which means you — or whoever in your family you're the tech support for.

What I'd actually do

Pull the authorization list, not the subscription list. Settings → Payments → Automatic Payments in PayPal, and the equivalent at your card issuer. Not what you think you subscribe to. What is currently permitted to charge you.

Sort your statements by merchant, not by date. Recurrence is invisible chronologically and obvious the moment you group it. A spreadsheet and twenty minutes finds most of it.

Look for the second stream. Same vendor, same signup day, two amounts, two cycles. Four vendors did it in this one account.

Treat a low first charge as a flag, not a deal. Then go find out what the real price is and when it starts — before the interval runs out.

Cancel in both places. Merchant first, then revoke the authorization. Doing one without the other is how a subscription you cancelled keeps billing you.

The part that stays with me

She's on track to get about $7,800 a year back, and that's before anyone asks a single vendor a single question.

None of this money was hidden. It was itemized, in order, on statements that arrived every month for two years. It was just spread across 148 merchants, and nobody had ever put it in one place and sorted it.

That's the whole job, most days. Not clever. Just nobody had done it yet.