A 10-year-old miss spent much than £2,500 connected the gaming tract Roblox aft changing the password connected her family's iPad tablet without her mum realising.
Georgina Munday, from Denbighshire, has warned different parents to "be vigilant".
Tesco Bank initially refused a refund but reconsidered and apologised aft BBC Radio Four's You and Yours took up the case.
Roblox said it had "a robust policy" from unauthorised payments and Apple said pre-purchase alerts could beryllium used.
Roblox allows users to make their ain games but besides offers in-app purchases to upgrade the user's avatar with things similar apparel oregon accessories and offers immoderate pay-to-play games.
Georgina Munday, 44, who lives successful Dyserth, said her daughter, Primrose, who has autism, had been playing connected her tablet for longer precocious owed to being disconnected schoolhouse aft struggling successful mainstream education.
She initially thought idiosyncratic had hacked Primrose's relationship but it soon became wide that the 10-year-old had managed to alteration the password to let payments.
"We'd conscionable seen hundreds of transactions, these outgo confirmations, truthful past the panic acceptable successful - ohio my gosh, whose paper is this on?," said Georgina.
Primrose had managed to walk much than £2,500 connected the tract but astir were tiny transactions of astir £20.
For astir a week, Georgina, who is simply a nurse, was successful backmost and distant interaction with Apple and her bank, Tesco Bank, trying to unafraid a refund but some refused - she said it was "a horrendous time".
"It was a truly stressful time. I americium not moving astatine the minute, I americium looking aft my daughter. The past fewer months person been rather stressful, truthful possibly we person had our oculus disconnected the ball. I conscionable thought I would person to wage it disconnected successful instalments implicit the adjacent fewer years.
"I rang up Tesco Bank and they said, due to the fact that it was my daughter, they couldn't bash thing astir it. So I tried Apple again - they conscionable work maine their presumption and conditions. So that's erstwhile I contacted the BBC, You and Yours, user programme."
Within a day, Georgina said that Tesco Bank contacted her to accidental they would refund the afloat amount.
"I cried - it was conscionable a relief, a value disconnected my shoulders."
Apple said determination were ways that accounts could beryllium acceptable up to alert a genitor earlier a kid wants to marque a purchase.
It said that parents and guardians should not disclose passwords oregon alteration FaceID and TouchID for their children and Ask to Buy should beryllium acceptable up truthful that purchases request support earlier going through.
Screen clip being turned connected would besides alteration parents to halt in-app purchases, it added.
Tesco Bank said: "We've carried retired a further reappraisal of this lawsuit and person present agreed with Ms Munday that we'll refund her the afloat amount.
"We apologise to Ms Munday that this wasn't arranged for her erstwhile she archetypal contacted us, and we've truthful besides organised an further outgo to her arsenic a motion of goodwill."
Georgina said she did not consciousness blessed to fto her girl play the crippled anymore.
"She knew what she was doing, she changed the password but I don't deliberation she understood the enormity of it."
Georgina said parents should "be vigilant" and beryllium alert of what their children were playing.
"Children are 1 measurement up of parents these days. We thought this Roblox crippled was rather innocent, it looks precise basic. It's a full satellite retired determination connected this Roblox that we knew thing about."
Roblox said: "Roblox has a robust argumentation for processing refund requests wherever determination whitethorn person been unauthorised payments from a person's account.
"This process is elaborate successful our assistance centre here.
"Parents besides person entree to a suite of Parental Controls that tin beryllium utilized to find however overmuch their children tin spend, and acceptable walk notifications to summation visibility implicit their children's spending connected Roblox."