In-app purchase & gift-card scams
Robux, V-Bucks, loot boxes, and gift-card fraud. Prevention and recovery.
Where kids lose money fastest
- Roblox Robux — fake “Robux generator” sites, Discord scams, trading fraud.
- Fortnite V-Bucks — fake “free V-Bucks” links, gift-card scams.
- In-app purchases in mobile games — accidental purchases inside a re-authentication window. Apple offers “Require After 15 Minutes” and Google Play offers “Every 30 minutes”; either one lets a run of purchases through on a single unlock.
- Mobile game loot boxes — gambling-adjacent mechanics.
- Livestream gifts / donations on Twitch, TikTok, YouTube.
- Sneaker/ticket resale scams via Facebook Marketplace / Instagram DMs.
Prevention setup
- Require authentication on every purchase. On iPhone or iPad: Settings › [your name] › Media & Purchases › Password Settings › Always Require. On Android: open the Play Store, tap your profile icon, then Payments & subscriptions › Purchase Verification, and set the frequency to Always — which Google lists as the default.
- Remove stored payment methods from the kid’s account, or use a virtual card with low limits.
- Turn on purchase approvals. Apple calls it Ask to Buy: Settings › Family › your child’s name › Ask to Buy › turn on Require Purchase Approval. Google calls it Purchase & download approvals: go to g.co/yourfamily, select your child, then Controls on Google Play › Require approval for.
- Set a spending limit where the platform has one. PlayStation has a Monthly Spending Limit, which Sony says is set to 0 by default. Microsoft Family Safety does it by adding money to the child’s Microsoft account, which then “cannot be overdrawn” — plus a Require approval for every purchase toggle for credit cards. Google Play has no spending limit; approvals are the control it offers.
- Know what approval does not stop. Apple states that content acquired via redemption codes is not subject to Ask to Buy, and that you get no request for redownloads or app updates. Microsoft states that purchases can still be made from a child account using gift cards or money already in their Microsoft account. Google’s approvals apply only to purchases made through Google Play’s billing system.
The gift-card scam pattern
- Kid gets a message: “I’ll give you X V-Bucks if you buy me a $25 Amazon card and send me the code.”
- Kid buys the card (or asks parent to), sends the code.
- Scammer vanishes. The card is drained in minutes.
Both Apple and Amazon warn that once the code is handed over, the funds are likely spent before you can reach the issuer or law enforcement. Teach every kid: gift-card codes = cash.
If a scam happened
- Credit card: contact the issuer straight away. Under the Fair Credit Billing Act your dispute has to reach them within 60 days of the first bill showing the error; they then have 30 days to acknowledge it and 90 days to resolve it. It is a route to your money, not a fast one.
- Gift card: report it to the gift-card company right away — the FTC says to report it no matter how long ago it happened, and to ask for your money back, because some companies might give it back. For Apple, the FTC and Apple both give 800-275-2273 (say “gift card”); the FTC adds that if the money is still on the card, Apple can freeze it. The FTC says the same of Google Play, which you report through Google’s gift-card scam form — though Google’s own policy is that it will not issue you a replacement gift card. For Amazon, the FTC lists 888-280-4331.
- Report scam account to the platform.
- Report at reportfraud.ftc.gov.
What was checked, and when. Purchase approvals, spending limits, gift-card recovery verified against the vendor’s own documentation on 2026-09-08. Not reached in that pass: refund timings.
Common questions
What is the gift-card scam, exactly?
Your child is offered in-game currency in exchange for buying a gift card and sending the code. They buy it, send the code, and the card is drained within minutes. Apple and Amazon both warn that once a code reaches a scammer the funds are likely spent before you can reach the issuer, which is why one rule covers it: gift-card codes are cash.
Where do children lose money fastest?
Fake Robux and V-Bucks generator sites and Discord scams; accidental in-app purchases made inside a re-authentication window, such as Apple’s 15-minute option or Google’s 30-minute one; loot boxes with gambling-adjacent mechanics; livestream gifts and donations on Twitch, TikTok and YouTube; and sneaker or ticket resale scams run through Marketplace and Instagram DMs.
How do I prevent this in the first place?
Set purchase authentication to Always on both stores, remove stored payment methods from your child’s account, and turn on approvals — Ask to Buy on Apple, Purchase & download approvals on Google Play. Add a spending limit where one exists: PlayStation has a Monthly Spending Limit and Microsoft Family Safety uses a pre-funded balance the account cannot overdraw, but Google Play has none. Approvals never cover store balances, gift cards, redownloads or redemption codes.
My child was scammed. Can we get the money back?
Sometimes, but slowly. A credit-card dispute has to reach the issuer within 60 days of the first bill showing the error, and the issuer then has up to 90 days to resolve it. For a gift card, the FTC says to report it to the card company right away and ask for your money back — some companies might return it, and Apple or Google can freeze a card if the money is still on it. Report the account to the platform and file at reportfraud.ftc.gov.
When parental controls change
The controls behind this change more often than the advice does. Roughly monthly we send new guides, changes to controls like these, and scams worth knowing about.
Free. No ads, no affiliate links, and we never sell or share your address.