Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is disgusting. Yes parents should be aware of these things but shifting the burden of locking down every system a child uses when this could be handled at the app store or financial processor level is ridiculous. It seems that some of these people are claiming that the game is not distinguishing well between fake and real currency. There are definitely games I've played where this is ambiguous as well.

IMO there needs to be a more rigorous opt-in process for different types of apps. You can opt in for automatic purchases for utility type apps but not for game purchases for example and it needs to be off by default. There also needs to be ways for people to get their money back in certain situations. If a child has a cognitive disability of some kind then holding them accountable seems kind of exploitative. Parents can prove these things with documentation and if proven the money should be refunded.



But still though, they gave the kid their credit card. If you don't want your kid to spend £3000 then don't give it to them?

Not defending any particular app's behaviour. Without any first hand knowledge, I certainly believe that there are scummy games out there using dubious methods to get people to rack up IAP.


While I agree that parents should never give their credit card to their kids[1], note that this is not the case in some examples from the article:

> It was on his own phone and he managed to [...] enter his own children's bank card details and buy lots of in-game items.

> It turned out my wife had left herself logged into Google Play on her old phone that she'd given to our youngest daughter.

[1] I'm not sure if this is a cultural thing. At least in my coutry almost no one has a credit card (it's more common to use debit cards + virtual credit cards) so I find the concept of "giving your CC to your child" really weird.


> they gave the kid their credit card

These systems are set up so you really don’t have much choice, though. My son will come to me and say, “Dad, I have some money from Grandma, can I use it to buy willywhacker 2 for my iPod?” I’ll say, “sure” - then he’ll hand me the $5 he got from Grandma and I’ll type my credit card number into wherever the game expects it to be and try to check the “don’t remember this card for future use” check box (if it’s there and if the game actually honors it). My kids are really good about asking before they make purchases, but a lot of these apps are designed to trick you - that’s how they make profits.


This seems like a nice use case for virtual credit cards with a very strict limit (just create one with $5).


There is a lot you can do, but you shouldn't have to. This isn't someone burning down their school. This is the first world becoming the third world in digital.

In the third world you always to watch yourself so you don't hurt, scammed or abused with little recourse. So being curious, doing something different or challenging the status quo becomes a liability. Eventually there isn't much development at all, only corruption and people knowing their place.

When you buy something in a store with cash in person, after having it shown by an employee, you can still in most cases return the thing at your will. But when some clicks a button moving a few bytes with a digital payment that in reality costs nothing, there is of course nothing that can be done. This industry is just increasingly rubbish.

Don't click this, don't open that e-mail and don't answer the phone. You don't know who it is from or who it is going to. Don't have that password, don't type it there, don't have it too long and don't make it too short. We can automate your job, but not authentication. Don't publish that, don't vote like this and don't live here. Know your place.

(At least my banks haven't offered virtual cards for many years).


Well, then the USA was "third world" long before in-app purchases. When you give someone your debit/CC info, they can basically pull infinitely from your account at any point in the future thus you have to remain eternally vigilant because you once gave someone $5. Which you didn't even do. You gave them the key to your account and trusted them to only take $5, that's how crazy our system is.

Better financial tools/primitives would have gone a long way to prevent the issue in the article which most Americans don't have. I shouldn't need my bank to hopefully create a "virtual card" feature (it doesn't). It should've been ubiquitous 20+ years ago.

This is one reason I use Paypal: I can see a list of organizations authorized to take money out of my account. My bank account and credit cards? I have no fucking idea who might show up next month. Maybe that thing I "canceled" on their website four months ago?

Or I use bitcoin because it's basically cash.


Yeah, there are also gift cards you can buy at the grocery store (for a $5 activation fee!), but I've actually found that a lot of merchants don't accept them - they have some way of telling which credit cards are "unlimited" and which are gift cards and just rejecting the gift cards as "suspected fraud".


You can purchase specific amounts for a lot of vendors, take the time to research the product and plan accordingly and many parents will not have these issues. If using the apple App Store it is the easiest I've come across with setting limits, controlling downloads and purchases, you can add funds instantly so your child never has your card number. Unfortunately everyone believes they never have the time, even though these devices are easier then setting up a family PC was in the early 00's


Can't you buy him a gift card?


Some of this is "bad parenting", but games that say they're OK for 3 year olds (like the mini-golf game described in the article) shouldn't make it easy for a 3 year old to spend money.

I have less sympathy for the high-school and college kids who did this.


A three-years-old should not have an ability to spend money using a card, period.

Much like a three-years-old should not have an ability to light matches, or push a screwdriver into a power socket, or operate a chainsaw.


If a three year old came into your hardware store waving his mother's credit card and assured the staff that he had parental permission to buy a chainsaw, would you fire the employee that sold him that chainsaw? Or would you, like the company in question in this article, refuse to respond to phone calls from that confused mother?


They aren't using a card though, at least not directly. They are playing a game.

It sounds like many games are set up to 1) encourage you to enter account information at some point and 2) not make it obvious when you are going to spend more "real" money.

Obviously these situations could be avoided in various ways, but I think it's being pretty hard on parents of young kids to blame them entirely for "falling for" scenarios that are pretty dodgy. Especially if you are a) a technologist of some sort and b) don't have kids, I would really think carefully before deciding the parents are 100% at fault.


I do have kids, and make abundantly sure that any payments on my kids' devices go through Play / App store (not a card directly), and always require a password. It does not require technical knowledge; both systems clearly show relevant controls at every purchase.

I see how being a parent of a young and active kid can be exasperating. But, if anything, it should increase the level of healthy paranoia :)


> shouldn't make it easy for a 3 year old to spend money.

Am I the only one that is impressed by a 3 year old knowing how to use a credit card online. I have trouble, at times, getting all 16 digits correct--depending on the past week's workload.


I use a "7 accounts setup" for my finances. One of my accounts is labelled "Internet" and has no more than £50-£100 at any given moment. It is the card used for Paypal, Amazon, Spotify, etc. If that card gets compromised I won't lose more than that, and my bank will most likely return the funds (yes even if it's just a Debit Card). If the account runs low then Spotify won't get paid in time and I won't cry about it :)

I was inspired by this video: https://m.youtube.com/watch?v=auzLhKvsxnQ

I always had multiple accounts but this vid and a discussion with friends (bankers and accountants) helped us all develop (each his own) 7 (or more) accounts setup. Imagine a "Dave Ramsey envelope system", but online.


Why would you ever use a debit card over a credit card?


As a european my question is exactly the opposite, why would you ever use a credit card if you can just pay directly with the money you have?

The concept just seems to bizzare as someone who has grown up with their country specific bank cards - getting a credit card or even a visa/mastercard debit card is something fairly unusual.

I do realize you american people have to build a credit score and there's cashback schemes. Very different cultures I guess


Well one reason people use credit cards a lot in the US is that it is much easier to dispute a payment charged to a credit card then it is a debit card. Additionally a charge on a credit card is not money you currently have it is more potential money, whereas a charge on a debit card is tied directly to your bank account and can take a while to be returned in the case of fraud. At one point you used to be basically SOL if fraud occurred using your debit card.


The concern over fraud goes the other way in Europe. We don't like the "pull" model and worry about our card number being used without our authorization. Debit card payments usually require card presence and PIN for each transaction, making stuff like that impossible.


>Debit card payments usually require card presence and PIN for each transaction

Presence and pin? How does that work online? Even if it's pin only, aren't you still screwed if you get phished?


Not for online, for physical purchases. Another fundamental/SHOCKING difference between Europe vs USA is that when you pay with your card in a restaurant in Europe, the waiter brings the POS over to you, while in the USA the waiter disappears with everyone's cards for 5mins ;)

Not good security is it? They can take their time to scan/photograph the cards etc, while in Europe the card's details are for seconds and right in front of you.


Online payments usually go through something like 3DSecure, where you get redirected to your bank and need to authorize the payment amount with a digipass or card reader, which require a PIN.


Yup - credit cards offer incentives (for example, 2% cash back) - I can't think of any good reason not to get one and have it set up so that it automatically deducts the balance from your bank account once a month - this makes it effectively a debit card where everything you purchase is 2% cheaper.


Because the use of credit cards over debit cards is pretty much a uniquely american phenomenon.


Credit card = Loan

Debit Card = money in the bank.

I am not trashing the credit industry, but when they give me 1% and I give them 24%...

And in the UK I do get a refund for fraudulent purchases (e.g. someone copied my card details from a store and made some purchases of women's shoes from somewhere in the UK I have never veen) - NatWest flagged it, alerted me, refunded me.


Why would you ever use a credit card over a debit card???

With debit you spend the money you own.

With credit you take debt. On every single payment. You are taking debt. Only at the end of the month you pay your debt.

If you spent too much, (by accident) you now have to pay overdraft interest.

With debit you spend the actual money you own.

If a purchase (fraudulent or not) exceeds your current balance, the payment won’t process.

But that is a good thing.

You shouldn’t be buying things you don’t have the money for anyway...


I asked my bank to automatically pay off my credit card in full at the end of each month. (It might help that my credit card is affiliated with my bank, I'm not sure.)

I've never come close to spending near my limit, so I don't know about an overdraft fee. I assumed it would decline further payments.

My credit card gives me reward points for money spent on it. Having a credit card that I keep paid helps my credit score.

I make some tiny amount of interest on the money in my account each month. I might as well collect that before parting with the money. And it's not like credit card debt accrues daily.


>If a purchase (fraudulent or not) exceeds your current balance, the payment won’t process

>But that is a good thing.

In case of fraud that's a bad thing because your cash flow is now screwed until the dispute's resolved. What do you do if you have $1000 in the bank, you get a fraudulent charge for $600, and this months rent of $800 is coming up?


Here in the Netherlands it is exceptionally hard to kick someone out of "their" home when doing so would leave them homeless. Being 1 month behind on your rent for 1 or 2 months may get you some stern letters, but you won't get kicked out if it happens once.


In the UK the tenant needs to be 2 months behind in rent before the landlord can start the eviction process.


Why would you ever want errors to reported while they are happening, instead of at the end of the month?


I have no self control to pay it back on time.


sadly, because of to much fraud i guess, china now doesn't allow more than one account per person (it's actually per bank, but i suspect only because it's not easy to enforce across multiple banks)

with that restriction in place, 2 or 3 accounts is manageable, but 7 almost impossible.

ideally the bank should allow to split your account into sub-accounts. so that nominally (for tax and monitoring purposes) you still have one account, but for money management purposes you have multiple.


"Giving your kid the credit card" is as simple as using the credit card once on the device, perhaps for a completely different game (or to buy the game in the first place). There is not necessarily any kind of physical action associated with these transactions.


Compare this to the real world. You are in a store and your child heads to the counter with $3,000 worth of goods. He puts your credit card on the counter. At this point, the clerk would ask if mommy or daddy were around and probably would deny the purchase.

But the digital world? Come right up little johnny!


How to tell the difference between an adult and a kid online assuming the adult gave their credit card to the kid?


That’s something for these businesses to figure out. In the real world, we had the advantage of the card holder needing to be present.

Maybe the model needs to change to force digital currency purchases to happen outside of the game? That way the purchase is divorced from the play and the parents can still retain control.

Or maybe accounts need to be set up in “child mode” by default, which caps spending at $50/month?

Or maybe the game rating agencies can be made to mark all games with micro transactions as Mature (since they basically need an adult present at all times to make decisions about the game)


I don't think that's too much to ask. If I spend more than an extra £10 my phone company will start sending me messages. Plenty of families would be financially crippled by an unexpected £3000 bill.


Actually, that's a great point. In Canada, we passed legislation that caps the amount a phone company can charge you in a billing period. We ought to do something similar for micro transaction businesses (though I loathe the appearance of a dialog box - "You have reached the daily spending limit as permitted by your jurisdiction")


More importantly, how to at the same time make payment as frictionless and password-free, so that you do not lose any business to people having second thoughts or going to competitors!

Because that is the purpose of a smartphone - to funnel the user's money to the true owners of the phone. Any barriers to that must be removed.


it's not spending $3000 at once, but $5 at a time. imagine a large store with 10 cashiers, the kid coming to each cashier once per day. that means over the course of a week the kid can spend several hundred dollars without anyone noticing anything unusual.


Gave the credit card .. I don't think the credit card is always save locked away .. I mean I also did steal (not 1000s !!) out of my moms wallet, when I was a child .. just for bubble gum or so ..

To take the credit card is easy .. no Pin code .. nothing does protect the card ..


> If you don't want your kid to spend £3000 then don't give it to them?

The article said it was a 22 year old with cerebral palsy using his own account (presumably his own credit card).


I am not defending EA (I think they are scumbags). But I remember kids back in the 90s getting hold of their parents credit card and spending money they didn't have.

Everything old is new again ...


I remember getting my ass kicked for running up a huge 900-number hint-line phone bill on some Lucasarts adventure game


I know Apple asks for Face ID or Touch ID when making in app purchases. This seems like a deterrence, but not sure about Android.


You can even make it so it sends a request to the parent's phone asking for permission to make a purchase.


You can always enter the iTunes password instead of using biometrics. I’ve done that using ApplePay on occasion with my phone.


You can do the same thing on Android. It's not on by default though


And parents will just put the kid on the touchid or put their card on the kids phone to keep the kid from bothering them a dozen times a day for a tiny purchase.


A lot of this is due to dark patterns from day zero requiring a payment method to create an apple id and/or itunes account.

Apple has since relaxed this requirement, but it is like running a gaultlet to do something like remove your credit card from your account. There are also self-serving weirdnesses - somehow you can set up a child to "request a purchase" from a parent, but you can't set this up if they are 18 with a family account.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: