Roblox: Ten-year-old spent £2.5k of mum's money without her knowing

https://www.bbc.com/news/uk-wales-65659896

by geox • 3 years ago

51 91 3 years ago

tnel77• 3 years ago

While I feel like these companies could easily implement sensible daily spending limits to help combat this, parents could also do more to make sure their children aren’t charging their cards. I’m pretty sure Apple and Google both have systems in place where parent’s can approve all purchases.

berkle44554• 3 years ago

This is 100% an Apple thing, and it sounds like the kid simply changed the password to override the iOS parental restrictions.

shoo_pl• 3 years ago

Well, yes its Apple thing, and they do have systems in place to prevent this, though I'd argue they are not very user friendly for non-tech savy people.

viscountchocula• 3 years ago

Not an apple user. What does "the 10-year-old had managed to change the password to allow payments" mean?

What does one action have to do with the other?

Neil44• 3 years ago

I agree, reading between the lines I don't see any innocent parties here.

em500• 3 years ago

As far as I understand from the article, the parent had some approvals/restrictions in place, but the kid circumvented by changing the password? The article is rather vague in describing what actually happened exactly.

FigurativeVoid• 3 years ago

The design of these sorts of transactions in games are really insidious.

I suspect most payment providers would immediately flag single 2,500 transaction as suspect and prevent it, but breaking it up into small chunks prevents that.

That some breaking up of cost makes it hard to feel like you are actually spending money. A few 5 pound packs and suddenly you're talking about real money.

It seems like the various app stores should have some sort of preventative measures in place to stop kids from spending money (especially large sums), as it seems obvious these sorts of games are targeting them to spend money. Many even engage in dark patterns to get them to spend without realizing.

jon-wood2• 3 years ago

I don't really know why in-app microtransactions, and especially in-app currencies, like this are even allowed in apps targeted at children. The worst example I saw was when my son was playing a mobile game based on a TV show for pre-schoolers. The developers had added an entire in-app currency, complete with prompts to buy packs of it when you game over, to a game explicitly targeted at children who can't even speak yet. I considered it a £60 lesson in better screening which games I install, but I'm still pretty pissed at the whole thing years later.

ryandrake2• 3 years ago

How are pre-schoolers even able to pay? My 10 year occasionally begs me for micro transactions in these rando games she installs even though she knows it's useless. She can't actually buy anything herself because 1. kids don't have credit cards and 2. I just don't give her mine.

hourago• 3 years ago

I don't really know why in-app microtransactions, and especially in-app currencies, like this are even allowed in apps targeted at children.

Because they can. Corporations will engage in any behavior that is not forbidden by law and makes a profit independently on how immoral it is.

The only reason that 5 years olds are not working in mines is because it is forbidden by law, nothing else. Corporations are not people nor have any human moral values.

enlyth2• 3 years ago

Tesco Bank initially refused a refund but reconsidered and apologised after BBC Radio 4's You and Yours took up the case.

I wish customer service didn't depend upon whether you complain to HN/Twitter/BBC. This disadvantages those who don't want to tell the whole world about their personal issues

mysterydip• 3 years ago

The companies have a financial incentive to keep things as they are. Maybe we need one of those "get you out of your timeshare" style companies, pay a small fee and they argue on your behalf.

dixie_land• 3 years ago

John Oliver had an interesting segment on timeshares and argues timeshare exit companies are even bigger scams:

https://m.youtube.com/watch?v=Bd2bbHoVQSM

andrewmcwatters• 3 years ago

I think about this a lot when I think about immoral employers. How do you warn people or signal dangerous behavior to others without airing your dirty laundry?

It's sad that people and organizations can do things that are widely considered immoral until they're caught by others, and then they're only apologizing that they were caught.

georgeecollins• 3 years ago

If you think of the case of Wells Fargo, where a bank fired employees because they didn't do something almost illegal -- opening an account without the account holder's permission -- then often gave them a record such that they couldn't work in banking. They did it for years and eventually did get caught, fined and are very regulated now. But that they got away with it so long should give everyone pause.

What can you do? Look at people's credit ratings, job histories, etc. like a human being and know that sometimes people are taken advantage of. Don't hate all regulation because the bigger organization really does have a lot of advantages dealing with customers and employees.

freetanga• 3 years ago

To be fair the Bank did nothing wrong. A refund means a net loss on their books, and they did not have any obligation. Marketing-wise it makes sense, but only if this does not become a trend of opportunistic scammers.

I really feel sorry for the mother, but ultimately is her responsability to raise her daughter. I haven’t used Roblox so maybe there is a case for going after them, but not the bank. Might as well sue the ISP that made the internet connection possible or the utility that allows charging her iPad…

flutas4• 3 years ago

A refund means a net loss on their books, and they did not have any obligation.

What is the difference in this case between an unauthorized charge on your card?

Example (here):

- Mom enters CC info to allow the child to buy ONE pack.

- Child then, after the fact, buys 100x packs (an unauthorized charge each time).

Example 2:

- Person gives a friend their CC to pay for food on DoorDash.

- Person then, after the fact, continues using their CC to buy DoorDash (an unauthorized charge each time).

These are both unauthorized charges, and an easy case for a chargeback. Additionally the entity out money shouldn't be the bank but Roblox, since the bank will take their money back.

onion2k2• 3 years ago

To be fair the Bank did nothing wrong.

Having fraud detection that didn't catch a £2500 outlier without freezing the card and contacting the owner to ask if it was a legitimate purchase could be considered doing something wrong.

postalrat2• 3 years ago

They block payments to crypto and casinos. They should be blocking payments other shady organizations like Roblox.

BaculumMeumEst• 3 years ago

but ultimately is her responsability to raise her daughter

The game is marketed to and hugely popular among young children.

It’s possible to spend £2,500 on microtransactions.

The young child in question is autistic.

Your response: ‘mothers should parent their children’

I wish I could say I’m appalled by the lack of empathy, but I’m numb to it. It’s no wonder the birth rate is dropping.

Waterluvian• 3 years ago

But only if there are laws requiring refunds like this, and that it's concrete that Tesco actually did something wrong.

theRealMe2• 3 years ago

I don’t get why it was the bank’s fault/responsibility here? I would understand if we were talking about Apple or Roblox or something, but why the bank? It’s not like the bank got the money back from Roblox/apple.

I don’t think the bank refunding the money is, or should be, an admission of guilt. It was a “pay this amount of money to make this (wrongly directed) bad press go away”.

So in the end the public complaint was used as a cudgel to take money that wasn’t owed (from the bank).

flutas4• 3 years ago

It’s not like the bank got the money back from Roblox/apple.

You know in a chargeback (what the mother most likely did)...the bank claws the money back from the company right?

Additionally, why would their fraud algo not detect "hundreds of transactions" back to back. That is instantly a red flag to almost every bank I've known.

nindalf2• 3 years ago

The bank could be liable because they’re supposed to authenticate the customer making the transaction. Either they did the authentication and the kid passed it (banks fault for bad auth) or they didn’t do authentication for a better UX and it’s still their fault.

enlyth2• 3 years ago

I didn't comment on whether it was the bank's fault or not, I merely wish there wasn't a difference in outcomes depending on whether you complain to the media or not.

junon2• 3 years ago

I did this once with a game called FlyFF. Dad wasn't thrilled. I think I totaled 1500 USD or so. The form itself had validation on the client side to cap out your total money for the daily maximum (100 USD) but the URL parameter wasn't checked value-wise, only your daily total before the purchase was validated server-side. So I knew enough at 10 or 11 to change the URL parameter to get loads more.

Then I got a very, very angry knock on the door at about 7am about a week later when the bank statement came through.

Not sure what lessons I learned there (aside from the obvious) about software design, micro-/in-game economies, or children using your services, to be honest. On the one hand, these sorts of services need to make money. I get that. But it's also super enticing and unreasonably easy for kids to do this, and I'd imagine it happens a lot more than what makes the news.

Not sure what the solution is aside from a very extensive and rich set of parental controls that are mandatory. Not sure if Roblox has that, and if so, I would imagine this kid did what I did when my parents added pins on certain channels - I looked over their shoulder!

Kids seem to be very crafty about bypassing security controls. The OG bad actors, if you will.

foobarian• 3 years ago

Not sure if you included it above but a big lesson there is that even though it's very easy to prevent this kind of thing in software, when the incentives are going in the opposite direction, the software provider will likely do a shoddy job (e.g. the unvalidated URL param). The ole "It is difficult to get a man to understand something, when his salary depends on his not understanding it."

Thorrez• 3 years ago

The developers' salaries depended on kids changing url parameters to spend their parents' money? I doubt that. I doubt the developers ever expected this to happen.

warent• 3 years ago

I remember FlyFF from my childhood! Never spent money on it, but yeah that was my first experience with a "pay to win" game model, so I can see how kid-you would have done this.

roomey• 3 years ago

On a different note, the lack of support for parents of children with Autism is just really really shit, and it seems like where the heart of the problem is here

dbg31415• 3 years ago

Roblox, like so much of the gaming industry, is so incredibly predatory... and toxic.

Here are two great videos from "People Make Games" that show some of the issues and ways that Roblox specifically is exploiting young gamers.

* Investigation: How Roblox Is Exploiting Young Game Developers - YouTube | https://www.youtube.com/watch?v=_gXlauRB1EQ

* Roblox Pressured Us to Delete Our Video. So We Dug Deeper. - YouTube | https://www.youtube.com/watch?v=vTMF6xEiAaY

kmfrk• 3 years ago

Can't we at the very least be allowed to easily apply some spending limit on iOS/iPadOS apps to catch this kind of stuff? It would also help serve as a basic allowance system.

frumper2• 3 years ago

There are already systems you can setup to control for things like this. Adding more systems to setup won't help though if the current ones also aren't being used. It's just easiest to setup a kids phone just like how you use it, it's what you know.

lockhouse2• 3 years ago

Every purchase my kids make on their iPhones, even free app installs require my permission, so the systems are absolutely already in place.

It’s not Toyota’s fault if you don’t buckle up your seat belt.

dclowd99013• 3 years ago

On the note about the seatbelt, At some point, I think someone said it _was_ car manufacturers’ faults if drivers didn’t buckle up. Otherwise we wouldn’t have that… oh so helpful chime when we forget to buckle. NHTSA 7.3

lvl102• 3 years ago

I refuse to let my kids play this game. Their business practice of exploiting children is THE worst.

ravenstine• 3 years ago

Granted, this describes most of gaming today. The target audience of most video games today is actual children with their parent's credit cards and adult children, also with credit cards, who value buying skins and decals over actual gameplay.

dclowd99013• 3 years ago

My daughter plays it and had never asked for money to buy stuff in game. I’ve monitored her playing and it’s a really neat platform tbh. I wish I’d had something fun like that to play when I was younger. It feels very Nintendo in the way it tries to build a safe, fun community for kids to inhabit.

That is the thing, though: you really should be involved if your kid is playing these things, and ensure you’ve setup good stringent limits. All of my device’s purchases are locked behind fingerprint auth. I’ve definitely done the due diligence of going through all the parental controls and locking everything down.

DANmode• 3 years ago

"That sounds like a lot of work!"

supernewton• 3 years ago

You probably don't have any issues because your daughter is well behaved, but fingerprint auth is probably one of the easiest things for a child to defeat - just wait for the parent to fall asleep!

causi• 3 years ago

"I rang up Tesco Bank and they said, because it was my daughter, they couldn't do anything about it. So I tried Apple again - they just read me their terms and conditions. So that's when I contacted the BBC, You and Yours, consumer programme."

Within a day, Georgina said that Tesco Bank contacted her to say they would refund the full amount.

That's crazy. When an unauthorized user transfers funds, it's the unauthorized user committing a crime against the bank, with the bank having the responsibility to correct the customer's account and the unauthorized user owing the bank the money. When a young child commits a crime it is their parents who are responsible, therefore the person who owes the bank money is the mother whose money was taken in the first place. She doesn't deserve a refund.

lockhouse2• 3 years ago

Don’t leave a credit card connected to your children’s accounts ever, period. Set them up to require your approval to purchase or provide them with a balance via gift cards.

I’m sorry this mother had to learn that lesson the hard way.

noahjk2• 3 years ago

Gift cards or an in-between like privacy.com where you can set max-spend on a card number are probably the best method for parents. It should probably be on the platform to suggest features along these lines, as we can't reasonably educate all parents on this, and it's against the individual game dev's best interests to show parents to limit spending (moreso than the platform as a whole)

ryanjshaw• 3 years ago

This is great in theory until the developers make it impossible e.g. Microsoft has a convenient bug (for at least the past 4 years) where Minecraft purchases are authenticated against your child's account PIN, not the adults account PIN that holds the card details. (I use a virtual credit card to protect against overcharges so this is annoying but I suspect many parents without this setup have been burned).

bastardoperator2• 3 years ago

My son gave "5" to a channel called annoying orange, he was so proud of himself. Quick look, yup 5 alright, 500, lol. I wasn't even mad, kind of my fault anyways. I reached out to annoying orange, they were super helpful and reversed the charge thankfully.

You would think a company that caters to kids would get it, but Roblox is the same company that allows kids to hang out in strip clubs, or da hood where they can kill each other over gang territory and has blatant racism baked in.

noahjk2• 3 years ago

Maybe the secret to regulating Roblox is to put it in front of the same people who are trying to regulate children's attendance of drag shows? This may be a case of aligned interests!

bastardoperator2• 3 years ago

Don't forget about the people decimating the libraries! They worry about books while their children are playing here:

https://www.youtube.com/watch?v=6seauSMyjCY

and here:

https://www.youtube.com/watch?v=XL-D_xFEhTw

9front• 3 years ago

Mum's??? Good it wasn't mom's money!

andybak• 3 years ago

No idea what you mean?

throwaway49274• 3 years ago

So, a child stole and it's the business's fault?

rocket_surgeron• 3 years ago

I can't even spend $3 let alone $3k on the App Store without biometric authentication and my kids are grown and gone. Why would someone change this?

Handing a 10 year old your AMEX and dropping them off at a mall is a bad idea.

This is the same thing, on an iPad.

kthejoker2• 3 years ago

This website loves to rail about dark patterns, but can't see that Roblox (and Apple) have colluded through dark patterns to allow this scenario to happen.

Their Apple Family pay system is flaky and essentially unsupported (do not bother calling for help when it's not working, there is none), doesn't work at all if as a parent you have an Android phone, and in general is designed to obfuscate in app purchases.

They'll even gladly let you buy the same app and DLC that another family member has purchased which is shareable - you just have to search through a completely separate interface to see if someone else has it already.

Roblox takes this up to 11, you can set up recurring purchases on accounts below 13+ without triggering any notification to the "supervising" account, there's no "family" billing history, no ability to set alerts on purchases when you do give permissions, no ability to set monthly limits (Premium is a different kind of joke), and of course the microtransaction / freemium model is designed to frustrate every child who isn't paying to win.

We banned it in our house after 2.5 years of trying to accommodate our kids who at their heart just want to play games with their friends and each other. But these companies are designed to be mini casinos.

It's disgusting.

1letterunixname2• 3 years ago

Yep. Business models that shouldn't be allowed. IAP virtual currencies might as well be NFTs because they're worth the same.

marttt• 3 years ago

A classmate made a (13+) Roblox account for our son (under 10yo) behind my back. I wanted to delete it, followed all the steps to contact the company via their support form, and was replied quickly and politely: "We do not have an account deletion request feature for players. You can stop using your Roblox account at any time. Should you choose to use your account again in the future, it will remain accessible to you by simply logging in." [1]

I really think this is deeply cynical, considering that Roblox is also targeting young children. With this decision, I feel like they're consciously hindering parents to protect their offspring from computer gaming addiction -- in 2023. This is extremely sad.

Including a dead-easy-to-find "Delete Account" button should be tacit ethical behaviour and a sign of respect towards users for every web company in 2023. Let alone the ones that target young children and thus make money exploiting their brains which are still in developmental stage.

I always hesitate (that is, almost always avoid) making accounts on sites that hide their account deletion buttons. These days, is an obvious sign of distrust towards the users and it feels like there is some stupid hoax.

Obviously, I can block access to roblox.com on my browser (I did, for good!), /etc/hosts, wireless router, etc. But -- actually having to this kind of user-side fiddling in 2023 feels incredibly silly.

Man up, Roblox devs. Add that button, for good.

1: Same message in full length posted to reddit by somebody else: https://old.reddit.com/r/roblox/comments/10409c0/roblox_maki...

berkle44554• 3 years ago

Are they also going to add a button to prevent a classmate from just creating another account (or doing it themselves on any computer except yours at home)? All you do is give it a username, password, and solve a captcha.

I’m confused at what deleting an account would actually solve for the problems you’re encountering.

1letterunixname2• 3 years ago

Perhaps virtual currencies and IAPs should be banned because they're predatory.

Roblox: Ten-year-old spent £2.5k of mum's money without her knowing

Related Stories