diff --git a/components/brave_vpn/browser/brave_vpn_service.cc b/components/brave_vpn/browser/brave_vpn_service.cc
index 34c4c4829e4d..34848b99b314 100644
--- a/components/brave_vpn/browser/brave_vpn_service.cc
+++ b/components/brave_vpn/browser/brave_vpn_service.cc
@@ -359,6 +359,36 @@ void BraveVpnService::UpdatePurchasedStateForSessionExpired(
     return;
   }
 
+  // If expiry is in the future, the person ran out of credentials.
+  // This should only happen if communication bewteen client and VPN provider
+  // is lost after the credential is redeemed (multiple times).
+  //
+  // It's safe to check this first because kBraveVPNLastCredentialExpiry is only
+  // set after getting a valid credential. If the session is expired, this value
+  // might be set but would be in the past.
+  const auto last_credential_expiry =
+      local_prefs_->GetTime(prefs::kBraveVPNLastCredentialExpiry);
+  if (!last_credential_expiry.is_null() &&
+      last_credential_expiry > base::Time::Now()) {
+    std::string expiry_message;
+    base::TimeDelta delta = (last_credential_expiry - base::Time::Now());
+    if (delta.InHours() == 0) {
+      expiry_message = base::StringPrintf(
+          "Out of credentials; check again in %d minutes.", delta.InMinutes());
+    } else {
+      int delta_hours = delta.InHours();
+      base::TimeDelta delta_minutes = (delta - base::Hours(delta_hours));
+      expiry_message = base::StringPrintf(
+          "Out of credentials; check again in %d hours %d minutes.",
+          delta_hours, delta_minutes.InMinutes());
+    }
+    LOG(ERROR) << __func__ << " : " << expiry_message;
+    SetPurchasedState(env, PurchasedState::OUT_OF_CREDENTIALS,
+                      l10n_util::GetStringUTF8(
+                          IDS_BRAVE_VPN_MAIN_PANEL_OUT_OF_CREDENTIALS_CONTENT));
+    return;
+  }
+
   const auto session_expired_time =
       local_prefs_->GetTime(prefs::kBraveVPNSessionExpiredDate);
   // If it's not cached, it means this session expiration is first time since
@@ -386,32 +416,6 @@ void BraveVpnService::UpdatePurchasedStateForSessionExpired(
     return;
   }
 
-  // If expiry is in the future, person ran out of credentials.
-  // This should only happen if communication bewteen client and VPN provider
-  // is lost after the credential is redeemed (multiple times).
-  const auto last_credential_expiry =
-      local_prefs_->GetTime(prefs::kBraveVPNLastCredentialExpiry);
-  if (!last_credential_expiry.is_null() &&
-      last_credential_expiry > base::Time::Now()) {
-    std::string expiry_message;
-    base::TimeDelta delta = (last_credential_expiry - base::Time::Now());
-    if (delta.InHours() == 0) {
-      expiry_message = base::StringPrintf(
-          "Out of credentials; check again in %d minutes.", delta.InMinutes());
-    } else {
-      int delta_hours = delta.InHours();
-      base::TimeDelta delta_minutes = (delta - base::Hours(delta_hours));
-      expiry_message = base::StringPrintf(
-          "Out of credentials; check again in %d hours %d minutes.",
-          delta_hours, delta_minutes.InMinutes());
-    }
-    LOG(ERROR) << __func__ << " : " << expiry_message;
-    SetPurchasedState(env, PurchasedState::OUT_OF_CREDENTIALS,
-                      l10n_util::GetStringUTF8(
-                          IDS_BRAVE_VPN_MAIN_PANEL_OUT_OF_CREDENTIALS_CONTENT));
-    return;
-  }
-
   // Expiry is in the past - they ran out of credentials completely.
   // They'll need to login to account.brave.com again.
   SetPurchasedState(env, PurchasedState::SESSION_EXPIRED);
diff --git a/components/brave_vpn/browser/brave_vpn_service_unittest.cc b/components/brave_vpn/browser/brave_vpn_service_unittest.cc
index 1bbbea9e3862..11a6e91a986c 100644
--- a/components/brave_vpn/browser/brave_vpn_service_unittest.cc
+++ b/components/brave_vpn/browser/brave_vpn_service_unittest.cc
@@ -658,6 +658,23 @@ TEST_F(BraveVPNServiceTest, LoadPurchasedStateSessionExpiredTest) {
   EXPECT_TRUE(session_expired_time.is_null());
 }
 
+TEST_F(BraveVPNServiceTest, LoadPurchasedStateOutOfCredentialsTest) {
+  std::string env = skus::GetDefaultEnvironment();
+  std::string domain = skus::GetDomain("vpn", env);
+
+  // Set an expiry in the future - this would be when the last redeemed
+  // credential (whether it was successful  or not) expires.
+  local_pref_service_.SetTime(prefs::kBraveVPNLastCredentialExpiry,
+                              base::Time::Now() + base::Days(1));
+
+  SetPurchasedState(env, PurchasedState::LOADING);
+  OnFetchRegionList(GetRegionsData(), true);
+  OnCredentialSummary(
+      domain, R"({ "active": true, "remaining_credential_count": 0 } )");
+  EXPECT_EQ(PurchasedState::OUT_OF_CREDENTIALS, GetPurchasedInfoSync());
+}
+
+
 TEST_F(BraveVPNServiceTest, LoadPurchasedStateTest) {
   std::string env = skus::GetDefaultEnvironment();
   std::string domain = skus::GetDomain("vpn", env);