Child spends over $800 on 'Roblox' using password reset bypass

Posted:
in iOS edited March 2023
A viral video on TikTok shows a mother in distress after her child spent over $800 on "Roblox," but it could have been prevented with Screen Time.

'Roblox' is a popular game on iPhone and iPad
'Roblox' is a popular game on iPhone and iPad


"Roblox" is a very popular game that uses an in-game currency called Robux. It is an enticing, addicting game targeted at children willing to spend real money on cosmetics.

A TikTok influencer named Linzy Taylor shared a video describing her situation after her 10-year-old son had spent over $800 across eleven purchases inside "Roblox." The video has amassed 3.8 million views as of this article's publication.

Usually, stories like these involve the child using some form of deception to bypass a child lock or some lack of supervision from the parent. However, this time, all the child needed was their device passcode.

There was no Screen Time protection on the account, so the only protection the device had was the device passcode and Apple ID password. The child did not know their Apple ID password but had the passcode to access the device.

It isn't clear how he learned to do this, but it is an identical method used by thieves to steal iPhones and reset their Apple ID password.

Taylor's son was able to navigate to "Roblox" and initiate an in-app purchase. The device was set up to prompt for a password any time a purchase was initiated, so biometrics like Touch ID wouldn't work.

All the child needed to do was select "Forgot my password" and then enter his iPhone passcode. The password was reset to the one he chose, then he was free to make purchases.



By the time Taylor noticed the transactions piling up, it was too late. Her son had spent around $800 from her PayPal account that was linked for purchases.

What went wrong

All of the tech-savvy people reading this article already know what happened -- there was no Screen Time passcode. This was a simple mistake to make as Taylor believed she had plenty of protection with just an Apple ID password.

AppleInsider reached out to the family and discussed the situation to ensure Screen Time was not enabled. Taylor admitted she had never heard of the feature and will gladly enable it to gain more control over her child's devices.

Screen Time is a versatile parental control tool
Screen Time is a versatile parental control tool


This is a common occurrence, as Apple does not actively advertise the feature. And she was right to believe a password would be enough.

Screen Time is a tool found within the Settings app, and it is indispensable to parents. App time limits can be set, purchases can be hidden behind a permission structure, and in this story's case, Apple ID passwords can be locked behind the Screen Time passcode.

If Screen Time was set up and the setting turned on, the Apple ID password could not be reset with only the device passcode.

We urge any parent to take a few minutes to set up Screen Time for their children. It isn't foolproof, as crafty kids have found ways to learn their parent's passcode to get by it, but it is an extra layer of protection.

View our guide on how to set up Screen Time and parental controls on iPhone and iPad.

Taylor has reached out to Apple for a refund, and it is pending.

Read on AppleInsider

Comments

  • Reply 1 of 8
    chadbagchadbag Posts: 2,008member
    As an “influencer” she should be rolling in bucks.  Isn’t that the latest “gold mine” internet income?  “Influencer”?

    Maybe she can get sponsored by the Roblox people. 
    Anilu_777doozydozenuraharawilliamlondonwatto_cobra
  • Reply 2 of 8
    chasmchasm Posts: 3,378member
    Bravo to Wesley Hilliard for not just reporting the story, but helping the situation.
    doozydozenpscooter63watto_cobra
  • Reply 3 of 8
    srl62srl62 Posts: 1member
    She did not have Ask to Buy enabled. She had a password turned on for purchasing. Those are two different things. People often confuse them. 
    Anilu_777doozydozenwatto_cobra
  • Reply 4 of 8
    Anilu_777Anilu_777 Posts: 553member
    I’d say said 10-year-old needs to have his phone taken away for a month. They’re old enough at that age to have an idea how much money they’re spending. And if they’re allowed to. If he sneaks in by using “Forgot my Password” then he knows he’s doing something sneaky or wrong. That kid needs consequences. 
    GrannySmith99uraharawilliamlondonroundaboutnowravnorodompscooter63watto_cobra
  • Reply 5 of 8
    radarthekatradarthekat Posts: 3,866moderator
    Anilu_777 said:
    I’d say said 10-year-old needs to have his phone taken away for a month. They’re old enough at that age to have an idea how much money they’re spending. And if they’re allowed to. If he sneaks in by using “Forgot my Password” then he knows he’s doing something sneaky or wrong. That kid needs consequences. 
    More than a month.  Enough time to
    offset $800, maybe as measured against the owner's cell plan cost.  Show the kid how the length of his punishment is calculated so he will have a solid grasp of how long it should take to spend that much money.  
    GrannySmith99uraharabyronlwilliamlondonroundaboutnowpscooter63watto_cobra
  • Reply 6 of 8
    uraharaurahara Posts: 733member
    Anilu_777 said:
    I’d say said 10-year-old needs to have his phone taken away for a month. They’re old enough at that age to have an idea how much money they’re spending. And if they’re allowed to. If he sneaks in by using “Forgot my Password” then he knows he’s doing something sneaky or wrong. That kid needs consequences. 
    More than a month.  Enough time to
    offset $800, maybe as measured against the owner's cell plan cost.  Show the kid how the length of his punishment is calculated so he will have a solid grasp of how long it should take to spend that much money.  
    I support your suggestion. But only in case if the mother cared about financial education of her child (I don't know their case/situation). So if he understands how big the amount of 800 is, e.g. if he is receiving every week 8 USD as pocket money. Then he could have seen how much 800 is. That would be almost 2 years of his pocket money.

    But if he is not getting any money, and his parents are not teaching him about the money, then he wouldn't even have a close understanding what 800 USD means (for his family).

    This means, the parents are still responsible to explain the importance of money and how to treat them. So she should think not just about consequences for her child but for herself
    Though we rarely think this way.
    Take the responsibility. Own it.
    get seriouspscooter63watto_cobra
  • Reply 7 of 8
    DAalsethDAalseth Posts: 2,835member
    Yes, Apple needs to make a bigger deal about the capabilities of ScreenTime. Honestly, until I read this, and then read the linked article on how to set up Screen Time I just thought it was that thing that would nag me about how much I was on the phone each week. I just silenced it and haven’t looked at it in however many years it has been out because had no idea what else it could do. 
    byronlCloudTalkinroundaboutnowpscooter63watto_cobra
  • Reply 8 of 8
    No sympathy. Apparently she thought she knew how to use an iPhone. Wondering if she uses seatbelts in her car.
    Family Sharing and Screen Time set up are part of the set up flow when setting up a device for a child under 13 years old. The Parent can skip the process or more often in my experience Parents share their own AppleID or fib about their child's age when they set up the child's ID. 
     Apple Support Video
    watto_cobra
Sign In or Register to comment.