A 10-year-old girl spent more than £2,500 on the gaming site Roblox after changing the password on her family's iPad tablet without her mum realising.
Georgina Munday, from Denbighshire is now warning parents to "be vigilant".
Tesco Bank initially refused a refund but reconsidered and apologised after BBC Radio Four consumer affairs show, You and Yours took up the case.
Roblox says it has "a robust policy" from unauthorised payments and Apple says pre-purchase alerts can be set up.
Roblox allows users to create their own games but also offers in app purchases to upgrade the user's avatar with things like clothes or accessories and offers some pay to play games.
Georgina Munday, 44, who lives in Dyserth, said her daughter, Primrose, who has autism, had been playing on her tablet for longer recently, because she is currently off school after struggling in mainstream education.
She initially thought someone had hacked Primrose's account but it soon became clear that the 10-year-old had managed to change the password to allow payments.
"We'd just seen hundreds of transactions, these payment confirmations, so then the panic set in - oh my gosh, whose card is this on?"
Primrose had managed to spend more than £2,500 on the site but most were small transactions of around £20.
For about a week, Georgina, who is a nurse, was in back and forth contact with Apple and her bank, Tesco Bank, trying to secure a refund but both refused - she said it was "a horrendous time".
"It was a really stressful time. I am not working at the minute, I am looking after my daughter. The last few months have been quite stressful, so maybe we have had our eye off the ball. I just thought I would have to pay it off in instalments over the next few years.
"I rang up Tesco Bank and they said, because it was my daughter, they couldn't do anything about it. So I tried Apple again - they just read me their terms and conditions. So that's when I contacted the BBC, You and Yours, consumer programme."
Within a day, Georgina said that Tesco Bank contacted her to say they would refund the full amount.
"I cried - it was just a relief, a weight off my shoulders."
Apple points out there are ways that accounts can be set up to alert a parent before a child wants to make a purchase.
It added that parents and guardians should not disclose passwords or enable FaceID and TouchID for their children and Ask to Buy should be set up so purchases need approval before going through.
Screen time being turned on will also enable parents to stop in-app purchases, it added.
Roblox players build the games, using the developer tools which the platform provides
Tesco Bank said: "We've carried out a further review of this case and have now agreed with Ms Munday that we'll refund her the full amount.
"We apologise to Ms Munday that this wasn't arranged for her when she first contacted us, and we've therefore also organised an additional payment to her as a gesture of goodwill."
Georgina said she does not feel happy to let her daughter play the game anymore.
"She knew what she was doing, she changed the password but I don't think she understood the enormity of it."
Georgina said parents need to "be vigilant" and know what their children are playing.
"Children are one step ahead of parents these days. We thought this Roblox game was quite innocent, it looks very basic. It's a whole world out there on this Roblox that we knew nothing about."
Roblox said: "Roblox has a robust policy for processing refund requests where there may have been unauthorised payments from a person's account.
"This process is detailed in our help centre here.
"Parents also have access to a suite of Parental Controls that can be used to determine how much their children can spend, and set spend notifications to increase visibility over their children's spending on Roblox."