A 10-year-old girl spent more than £2,500 on the gaming site Roblox after changing the password on her family’s iPad tablet without her mum realising.
Georgina Munday, from Denbighshire, has warned other parents to “be vigilant”.
Tesco Bank initially refused a refund but reconsidered and apologised after BBC Radio 4’s You and Yours took up the case.
Roblox said it had “a robust policy” from unauthorised payments and Apple said pre-purchase alerts could be used.
Roblox allows users to create their own games but also offers in-app purchases to upgrade the user’s avatar with things like clothes or accessories and offers some pay-to-play games.
Georgina Munday, 44, who lives in Dyserth, said her daughter, who has autism, had been playing on her tablet for longer recently due to being off school after struggling in mainstream education.
She initially thought someone had hacked her daughter’s account but it soon became clear that the 10-year-old had managed to change the password to allow payments.
“We’d just seen hundreds of transactions, these payment confirmations, so then the panic set in – oh my gosh, whose card is this on?,” said Georgina.
Her daughter had managed to spend more than £2,500 on the site but most were small transactions of around £20.
For about a week, Georgina, who is a nurse, was in back and forth contact with Apple and her bank, Tesco Bank, trying to secure a refund but both refused – she said it was “a horrendous time”.
“It was a really stressful time. I am not working at the minute, I am looking after my daughter. The last few months have been quite stressful, so maybe we have had our eye off the ball. I just thought I would have to pay it off in instalments over the next few years.
“I rang up Tesco Bank and they said, because it was my daughter, they couldn’t do anything about it. So I tried Apple again – they just read me their terms and conditions. So that’s when I contacted the BBC, You and Yours, consumer programme.”
Within a day, Georgina said that Tesco Bank contacted her to say they would refund the full amount.
“I cried – it was just a relief, a weight off my shoulders.”
Apple said there were ways that accounts could be set up to alert a parent before a child wants to make a purchase.
It said that parents and guardians should not disclose passwords or enable FaceID and TouchID for their children and Ask to Buy should be set up so that purchases need approval before going through.
Screen time being turned on would also enable parents to stop in-app purchases, it added.