Apple family sharing is great but it has its dark side.

[kocandrle]

Yes this is correct, Apple family sharing has dark side which is not so obvious at first look, but it is more dark then we would expect from Apple.
If you read about family purchase at https://support.apple.com/en-us/HT201079, the sentence “Any time a family member makes a new purchase, it's billed directly to the family organizer's account.” Does not ring any bell, but it does to me after discovery I made last week.

My 12 years old son gained access to my credit card through family sharing and spent more then 1100 Euros through in app purchases.
Not possible?
Unfortunately not so difficult especially with IT capabilities our kids has today at age, where they have 0 financial responsibilities, nor ability to connect imaginary world from computers with real money at fathers bank account. And I am afraid that in app purchases are built specifically to target weak groups of teenagers and I have no doubt it is huge business. So I don’t expect to change anything by writing this, however I do believe that all of us deserves to know how weak is security at Apple regarding protecting your money.

So how this all happened?
My son managed to change his birthdate to make him adult, by this simple step he gained instant and unlimited access to my credit card from family sharing and spent more then 1100 Euros in less then two month through in app purchases. In app purchases could be extremely costly and I am not sure if there are any limits, but don’t think so as my son was able to spent lots of money per day in the same app. I tried to claim back what was spent with no success (of course even if money were spent by kid)

I also tried to contact Apple regarding security issue I found, but they did not care at all, probably because they already know. And one thing is clear, family organizer always pay for bills of his family so from business point of view, good group to target. In this case business seems to be more important than security.

Jan

 

[Just_Me_D]

In my opinion, the matter you’ve described is more of your child being deviant than a matter of data security. Without knowing certain information, a person cannot just go in and alter your information or view your account data.

You appear to want to put the onus on Apple when it is really on you. Did I misread?

If there is a security issue with Family Sharing, it would have been widely reported by now in the tech blogs, but I haven’t come across any such information other than what you are reporting in this thread.

 

[kocandrle]

I don't think it is about kids deviation, they cannot connect gaming with real world as easily as we can. And if you believe it is difficult to change birthdate you are mistaken. And I am not blaming Apple, just warning that it is quite simple to gain access to credit card through family share as no limit can be set

 

[wenrob]

It’s you responsibility to lock things down and set them so he can’t do that. Apple gives you the tools to secure every single thing he does, you just need to implement them. My kids devices are locked down, MY device is locked down. They can’t change anything I don’t want them to.

 

[Tartarus]

I’m not sure anyone else but the card holder can access the card info, let alone a child.

I’m afraid that your kid gained physical access to your iPhone and allowed the purchases to go through.

Like @Just_Me_D already said, if this was a true security breach, all news would be all over it, around the globe.

 

[Lee_Bo]

Well, I'm speaking from experience here. We have a family sharing account with one credit card. Anytime, let me say that once again, ANYTIME our son requests any app (free or paid) or any in-app purchase, we (wife and I) get an email asking to grant or deny permission.

As long as the child email account it set up correctly, you son could change his DOB to be 50 and would still be restricted.

Also, I've contacted Apple many many times over the past years about anything from a simple password issue to an iOS update that bricked a device, and at no time did I ever feel Apple "did not care at all" about my issue.

 

[bamf-hacker]

I just tried to change my kids age using their Apple ID and it would not allow that. So I am not sure how your child was able to do that without your knowledge. Now if they no your Apple ID password then they can log in as you and change the age.

 

[Not Quite Right]

This is no more of a security breach than your kid stealing your credit card out of your wallet and making a bunch of online purchases. Anyone smart enough to circumvent the restrictions set up in family sharing, is smart enough to know what they were doing was wrong. This falls all on you and your poor parenting skills, rather than Apples ability to police your kid ...

 

[Tartarus]

This is no more of a security breach than your kid stealing your credit card out of your wallet and making a bunch of online purchases. Anyone smart enough to circumvent the restrictions set up in family sharing, is smart enough to know what they were doing was wrong. This falls all on you and your poor parenting skills, rather than Apples ability to police your kid ...

I urge you to refrain from saying stuff like ‘poor parenting skill’. There are many more factors that you obviously don’t know and can’t comment about.

 

[John Yester]

Be courteous to other forum members regardless of their race, age, nationality, country of residence, ethnic origin, sex, sexual orientation, political views or religious beliefs. Prejudice or discrimination of any form is not tolerated.

 

[Damien_Eternal]

I feel that the onus for this goes on both the parents and the kid, but mostly the kid. At 12 years old, a kid knows full well the difference between right and wrong, and the difference between online (fantasy), and the real world. True enough that they may not yet understand the financial impact that some things can have, but I think that is only a small point here. The kid knew what he was doing was wrong, but either didnt care, or didnt think he would get caught.

If things like this are happening, it is also on the parents to lock the childs device down so they cant do this, as was stated by others. The parents may not have known that they can lock it down like this, it may not have occurred to them that they had to. Maybe they wanted to work on the honor system with their kid and trust that this kind of thing wouldnt happen. All of this is understandable, as I think i would be the same way with my kid. This has taught a very valuable (and expensive, unfortunately) lesson to all involved. Lock the kids device down and make sure he cant do this. If it was me, his device would go away for a month or so while I figured out how to come up with that kind of money and what kind of impact it is going to have.

 

[TylerLV76]

And this is why I removed my credit card from Family Sharing and why every family member connected to my family share must use their own credit or iTunes cards.

 

[BreakingKayfabe]

If you read about family purchase at https://support.apple.com/en-us/HT201079, the sentence “Any time a family member makes a new purchase, it's billed directly to the family organizer's account.”

It's literally spelled out for you at the very top of that page that you linked.

When you set up purchase sharing, one adult in the family—the family organizer—agrees to pay for any purchases that family members make while they're part of the family group.

https://support.apple.com/en-us/HT201079

Side-note: I admire your son for his sharp-wittedness.

 

[Not Quite Right]

I urge you to refrain from saying stuff like ‘poor parenting skill’. There are many more factors that you obviously don’t know and can’t comment about.

A Rose is a rose is a rose is a rose ...

 

[Quis89]

I don't think it is about kids deviation, they cannot connect gaming with real world as easily as we can. And if you believe it is difficult to change birthdate you are mistaken. And I am not blaming Apple, just warning that it is quite simple to gain access to credit card through family share as no limit can be set

Sure it is. The kid knowingly changed their birthdate because they understood they could have elevated privileges they weren't previously granted by doing so. If the child is of age to understand that, they are of age to understand it was wrong.

And as far as I'm aware, there is a way to prevent this. Disabling "Purchase Sharing", I believe, would avoid this. With Purchase Sharing enabled, the primary Family Share account holder agrees to pay for the purchases of everyone in the Family Share. I believe you can even enable the "Ask To Buy" feature which will require you to approve any purchases made. It's been a while since I utilized this as I turned off Purchase Sharing for my family account a while ago.

I'm also unsure of how your child was able to change their age. My son is not able to do that. It sounds like the account may not have been set up correctly.

 

[Quis89]

This is no more of a security breach than your kid stealing your credit card out of your wallet and making a bunch of online purchases. Anyone smart enough to circumvent the restrictions set up in family sharing, is smart enough to know what they were doing was wrong. This falls all on you and your poor parenting skills, rather than Apples ability to police your kid ...

Wow. Imagine claiming someone whom you've never met has poor parenting skills over something like this. I haven't met a child yet who hasn't tried to game the system to their advantage at some point in their life. You have no basis for that claim and it's uncalled for.

 

[BreakingKayfabe]

Imagine claiming someone whom you've never met has poor parenting skills over something like this.

I'm not throwing anything out here about the OP. But, in general, it can absolutely be done.

When I do it I'm usually proven to be correct.

 

[Not Quite Right]

Wow. Imagine claiming someone whom you've never met has poor parenting skills over something like this. I haven't met a child yet who hasn't tried to game the system to their advantage at some point in their life. You have no basis for that claim and it's uncalled for.

Everyone is responsible for their children AND their actions. Fewer and fewer people seem to take that statement seriously. The OP displayed no responsibility in this matter, but chose to pivot the blame on a device manufacturer instead for not policing their child’s delinquent behavior.

 

[Lee_Bo]

Everyone is responsible for their children AND their actions. Fewer and fewer people seem to take that statement seriously. The OP displayed no responsibility in this matter, but chose to pivot the blame on a device manufacturer instead for not policing their child’s delinquent behavior.

Actually no. In their second post they do state they don't blame Apple.

Implied? Maybe.

I personally see this is a family share that may not have been set up correctly.

Like I said before, anytime my son tries to download an app, even a free one, I get an email and have to allow or deny the purchase.

 

[Quis89]

Everyone is responsible for their children AND their actions. Fewer and fewer people seem to take that statement seriously. The OP displayed no responsibility in this matter, but chose to pivot the blame on a device manufacturer instead for not policing their child’s delinquent behavior.

So since the OP specifically stated they don't blame Apple in their second post, would I be safe in assuming you're a poor reader? Similar to your assumption that their parenting skills are poor?