HelloFresh: unauthorized charge
If you think someone else used your account, tell HelloFresh at once by email or phone; the Terms make you responsible for activity on your account.
What does this mean?
Grade A (high: almost everything comes from official pages read directly). 100% of 19 sources are the organization's own pages or government sites.
Collect
- the charges you did not make
- order details
- date you noticed
Steps
Report the suspected breach by email or phone as soon as possible, and change your password.
If HelloFresh does not reverse the charges, dispute them with your card issuer.
More contacts for this issue
Facts you can cite
- Process
If you suspect a security breach, "notify us as soon as possible either at hello@hellofresh.com or call (646) 846-3663." The Terms say you are "SOLELY RESPONSIBLE FOR ALL ACCESS TO AND USE OF THE SERVICES BY ANYONE USING YOUR ACCOUNT" (section 4.3).
Source: hellofresh.com, verified 2026-10-13
- Process
Before arbitration you must send a written dispute notice by certified mail to HelloFresh, Attn. Legal Department, 28 Liberty Street, 10th Floor, New York, NY 10005, with a copy to arbitrationoptout@hellofresh.com. Either side may start arbitration or small claims if it is not resolved within 60 days. You may opt out of arbitration by written notice to arbitrationoptout@hellofresh.com within 30 days of first becoming subject to it (section 24).
Source: hellofresh.com, verified 2026-10-13
- Contact
California residents may report complaints to the Complaint Assistance Unit of the California Department of Consumer Affairs at (800) 952-5210 (section 30, Cal. Civ. Code 1789.3).
Source: hellofresh.com, verified 2026-10-13
Rules in force
- Restore Online Shoppers' Confidence Act (ROSCA) negative option requirements15 U.S.C. 8401-8405
A seller that charges consumers online through a negative option feature (for example an automatic renewal or a free trial that converts to paid) must clearly disclose all material terms before taking billing information, get the consumer's express informed consent before charging, and provide simple mechanisms to stop recurring charges. The FTC enforces ROSCA.
Source: law.cornell.edu, verified 2026-10-12
4 citable points
- Policy
Before obtaining the consumer's billing information, the seller must provide text that "clearly and conspicuously discloses all material terms of the transaction".
Source: law.cornell.edu, verified 2026-10-12
- Policy
The seller must obtain "a consumer's express informed consent before charging the consumer's credit card, debit card, bank account, or other financial account".
Source: law.cornell.edu, verified 2026-10-12
- Policy
A post-transaction third-party seller may not charge a consumer for an online sale unless it discloses the material terms and gets express informed consent, including the consumer's full account number, before charging. An initial merchant may not pass a customer's account number or other billing information to such a seller.
Source: law.cornell.edu, verified 2026-10-12
- Process
A ROSCA violation is treated as a violation of an FTC rule on unfair or deceptive acts or practices, and the FTC enforces ROSCA with its FTC Act powers and penalties. Report violations to the FTC.
Source: law.cornell.edu, verified 2026-10-12
- Policy
If that fails, escalate
Go up one step at a time. Keep the reference numbers and dates from each contact.
Customer service
Written complaint
Card or bank dispute
Fair Credit Billing Act billing-error and purchase-dispute rights (Regulation Z)
Electronic Fund Transfer Act error resolution and unauthorized-transfer liability (Regulation E)
Card dispute for charges after a cancellation.
Federal regulator
State agency
Your state’s attorney general. Find it in the list of state agencies (also as JSON:
states/<code>.json, for example states/ny.json).
Watch out
- Cancelling online needs sign-in; the Terms give the click path but no direct cancel URL.
- The weekly deadline is shown only on the signed-in My Menu page and depends on the delivery day.
- The contact-us page returned HTTP 403 to automated fetches on 2026-10-13.
Let your AI agent handle this
Escalate Anything is a free, open-source MCP server for Claude, Cursor, VS Code, Gemini CLI, Codex and other AI apps. Your agent gets this playbook, keeps a case log with reference numbers and follow-up dates, and drafts each message for you to approve.
1. Set it up (needs uv):
uvx escalate-anything setup2. Ask your agent:
HelloFresh charged me [amount] on [date] and I did not authorize it. Use Escalate Anything to get it reversed.Source code, other install options and the Claude Code plugin