In the news today there is a case of a child spending more than £2,500 on their parents iPad.

A 10-year-old girl spent more than £2,500 on the gaming site Roblox after changing the password on her family's iPad tablet without her mum realising.

She initially thought someone had hacked her daughter's account but it soon became clear that the 10-year-old had managed to change the password to allow payments.

Her daughter had managed to spend more than £2,500 on the site but most were small transactions of around £20.

"She knew what she was doing, she changed the password but I don't think she understood the enormity of it."

As I understand it if this was done by an adult then they would have committed some computing offence against the account holder (hacking) and fraud against the bank. This should directly affect the banks obligation to provide the account holder their funds on request, without some demonstrable fault on the part of the holder. In this case, where the "fraud" was committed by a child under the care of the bank account holder what is the legal situation? In particular, would the bank still have a responsibility to pay the account holder the funds withdrawn by the child if they did not demonstrate the account holder acted either fraudulently or negligently?

It is worth noting that the age of criminal responsibility in England and Wales (where this occurred) is 10. Would the situation be any different had it happen before the child's birthday when they were only 9, or had it happened in Scotland where the age for criminal responsibility is 12?

  • It isn't clear to me what is meant by "would the bank still have a responsibility to pay the account holder the funds withdrawn by the child". From the context it seems the child made on-line purchases, in which case Roblox would have received funds from the parent's account linked to the iPad. The funds wouldn't have been withdrawn as cash by the child. And "pay the account holder" makes it sound like the bank paying more cash to the parents. Can you help me understand the flow of funds in this example? Are you really asking if the bank is obligated to release funds to Roblox? Commented May 22, 2023 at 17:40
  • @MichaelHall Say the account holders (AC) account contained exactly £2,500. The "hacker" changed the password and made on-line purchases and Roblox received the £2,500. If the hacker was an adult the bank would still own the AC £2,500 and the bank would pursue the hacker for fraud to recover what they could. Had the AC made the purchase the bank would not owe them anything more. In the case that the hacker is the child of the AC does the bank still owe the AC £2500?
    – User65535
    Commented May 22, 2023 at 18:09
  • Got it, thanks for clarifying. Of note, the article you quoted refers to it as "her family's iPad". This implies joint ownership, and presuming the family shares a residence, they all received the product and jointly receive benefits of the purchase. That's a far cry from an outside hacker breaking into the account. I can't answer what UK law says about this, but morally the right thing seems clear enough... Commented May 22, 2023 at 19:52
  • The question is at which points a child is responsible for a payment, at which point the parent is, and whether there is a point where nobody is responsible.
    – gnasher729
    Commented May 23, 2023 at 10:02
  • @gnasher729, you left out "at which point the bank is responsible". I don't think there's a point at which nobody is responsible unless the vendor decides to eat the charges. Which in this case would be a good PR move. Commented May 23, 2023 at 22:41


You must log in to answer this question.

Browse other questions tagged .