I agree with a lot of your comment (including banning tablets/IAPs for children and the mandatory 120 day refund). I do disagree with your "this is a different

I agree with a lot of your comment (including banning tablets/IAPs for children and the mandatory 120 day refund). I do disagree with your "this is a different situation" though. In both an entity (unknown person/child) accessed your card details, and used it for a purchase without your authorization. Theft by any other name (aka "unauthorized charges") is still theft. It's just your child doing it in this case. If, for example, you give your card to a bar and they charge your your bill, then charge someone else's bill to your card because they skipped on their bill, it's still theft even though it would be called an "unauthorized charge" in the banks eyes. Besides, a lot of this is why there's processing fees (2.9% + $0.30 for stripe for example), chargeback fees ($25 instantly if someone issues a chargeback and more if you escalate after losing once), and interest on CC products. Even if the bank can't get their money back from the company, they will likely still make more on you by giving you that refund than not.