A story grabbed my attention recently: a father in Sydney, Australia, gave his phone to his four-year-old, to keep him occupied, and was surprised to later find that the child had ordered $1,139 of gelato and cakes which was sent to the father’s workplace. The child didn’t do this intentionally; he was just tapping things, as children do on portable devices. It turned out that he had been tapping images in the UberEats app, and, since there was no password or passcode required to approve purchases, there was nothing to prevent the child from doing this.
There are many ways that children could make purchases – either intentionally or unintentionally – on an iPhone or iPad. In this article, I’m going to explain how you can prevent your kids from spending all your money on your device.
Unlike Macs, iPhones and iPads don’t allow you to set up accounts for multiple users. I’ve long felt that iOS/iPadOS needs multiple user accounts, and this situation, where a child may just tap on anything, with expensive consequences, is a good example why this could be useful.
Parents may think it’s a good idea to hand their device to a child to keep them distracted, but this is dangerous. As seen above, kids can buy things easily, but they could also, just by randomly tapping, send messages, forward emails, or interact in any app on the device. The only apps that generally have extra protection are financial and banking apps, which usually require additional authentication when launched. But even apps like Amazon’s mobile app, where a child could order anything with a few taps, don’t require any sort of confirmation.
Ideally, you should not give your iOS device to a child. The risks inherent in this, even with a very young child who doesn’t know what they are doing, are serious. There’s too much data on your iPhone or iPad to allow someone to randomly tap apps, and you won’t know if anything is deleted or altered.
For a young child, you could buy an iPod touch, or a used iPhone, say an iPhone 7 or later that can still get security updates, and let them use it without a SIM card. An iPad mini is another good choice; even for young children, it’s not too big.
You should never give your passcode to your children; you should also never set up Touch ID or Face ID with a child. Your phone will that think they are you, and the child will be able to do anything on the device. This isn’t about children making intentional changes, though that is a consideration, but about the sort of random tapping that leads to $1,000 worth of gelato being ordered. And if your child does have this access, they could potentially make transactions in financial or banking apps.
If you do plan to share your iPhone or iPad, there are some things you need to do to ensure that your child can’t make any purchases in Apple’s stores. Go to Settings, tap your name at the top of the screen, then tap Media & Purchases, then Password Settings. Here, you should tap Always Require Password, and you might even want to toggle Require Password for free downloads.
With these settings, your child will not be able to purchase or download anything from the iTunes Store, the App Store, the Books Store, or any other of Apple’s stores.
You can’t prevent purchases in other apps, or, in many cases, in a web browser. For example, if you’re signed into Amazon on Safari, or you use the Amazon app, anyone who has access to your unlocked phone can place orders. Some websites require that you log in when placing an order. Even if you use iCloud Keychain, and your passwords are saved, as long as your child doesn’t have your passcode, or Touch ID or Face ID access, they can’t unlock the keychain, and can’t log into any websites.
Related:
Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain Works
What you can do is control which apps are accessible by activating Screen Time. This is where iPhones and iPads allow you to set parental controls. If you plan to give one of your devices to a child from time to time, you could set up Screen Time with limited apps and access, then turn it off. When you give your device to your child, go to Settings > Screen Time and turn it on again; it will have saved your settings. When you take your iPhone or iPad back, you can turn off Screen Time so you have full access.
See Use Screen Time to Set Restrictions and Parental Controls on iPhone, iPad, and Mac for more on using Screen Time.
Some things to check here are iTunes & App Store Purchases, where you can prevent them from installing or deleting apps, block in-app purchases, and more. But the only way to prevent purchases in other apps is to not allow them to be used.
And even if your child doesn’t stray from playing games, they could be spending money if you’re not careful. In-app purchases are very lucrative, and can be tempting for children who don’t grasp their cost. Read A Parent’s Guide to In-App Purchases on iOS, iPadOS, and macOS to learn how to block in-app purchases.
Unless a child has their own device, your data may be at risk. You can prevent some purchases, but not all. Take the time to check your options before you hand your iPhone or iPad to a child.
You can also subscribe to our e-mail newsletter and keep an eye here on The Mac Security Blog for the latest Apple security and privacy news. And don’t forget to follow Intego on your favorite social media channels: 
