A parent staring at a $237 charge from a “free” puzzle game doesn’t care about app monetization models. They need to stop it happening again and maybe get the money back. That starts with a setting most people never touch.

In-app purchases are everywhere, from games to productivity apps and even dating apps. They let you buy virtual goods, extra features, or subscriptions with a tap. But the tap that triggers a $99 gem pack can happen without you realizing it, because Apple and Google designed a purchase window where your password isn’t required for a set time after the first authorization.

Most advice says to turn off in-app purchases entirely. That locks the door but leaves a window open, literally. For iOS, that window is 15 minutes. On Android, it’s 30 minutes. While you’re logged in, no password is needed. And that’s where the risk lives.

You can close that window in under a minute. And if something slips through, there’s a refund path most people don’t know exists. But first, understand what you’re dealing with. This isn’t about chasing loot box odds or maximizing in-game currency; it’s about plugging a hole that costs people real money every day.

What Are In-App Purchases?

In-app purchases are digital items or subscriptions you buy inside an app. They fall into three categories: consumables (game currency, lives), non-consumables (permanent features, ad removal), and subscriptions (recurring access). The common thread is that the transaction happens through your Apple ID or Google account, not a separate credit card entry each time. That makes buying easy, sometimes too easy.

What most people don’t realize is that the real risk comes from a setting that lets purchases happen without a password for up to 30 minutes after the first one. That’s the vulnerability we’ll fix next.

Why Unsanctioned Charges Happen

The root cause of surprise in-app charges is the authentication window. When you buy something, you authenticate with Face ID, Touch ID, or your Google account password. After that, both iOS and Android keep you “authorized” for a period. On an iPhone, the default setting (according to Apple’s support documentation) requires a password only after 15 minutes of inactivity. Google’s help center notes the default is 30 minutes. During that window, anyone with access to your device can buy more items without any prompt. A child playing a game can tap a $99 bundle, and it charges instantly. The window resets each time you make a purchase, so a series of quick buys stays frictionless.

The better question is why these platforms chose a timed window rather than requiring a password for every single purchase. The answer is user experience: frictionless spending boosts sales. The trade-off is your financial safety. That’s why you need to override the default.

If you typically spend $5 a month on in-app currency, a single $49.99 accidental purchase during the 30-minute window eats up nearly a year’s budget. That math flips the convenience argument on its head.

How to Lock Down Purchase Authentication

Changing the authentication setting takes about a minute on each platform. Here’s what to do.

iPhone or iPad: Go to Settings > Screen Time > Content & Privacy Restrictions (enable if off), tap iTunes & App Store Purchases, then set “Require Password” to “Immediately.” If you use Family Sharing, also enable Ask to Buy for children’s accounts.

Android: Open the Google Play Store, tap your profile icon > Settings > Authentication > Require authentication for purchases. Select “For all purchases through Google Play on this device.” Optionally, set a frequency of “Every time.”

In-app purchase controls aren’t just about blocking spending; they’re about timing the authentication window. Once you close that window, accidental purchases require a deliberate step, and that friction alone stops most unwanted charges.

This setting can be a minor nuisance if you’re the sole user and you buy things often. Having to authenticate every single time gets old. It’s a pain. In that case, you can leave the window at 30 minutes but set a monthly reminder to review your purchase history. The risk is that a guest or a glitch could still trigger a charge. But if you regularly spot-check your bank statements, it’s a reasonable trade-off.

Getting Your Money Back When Something Slips Through

Most articles about in-app purchases skip the refund option, leaving you stuck with that sinking feeling when a $99 charge appears. But both Apple and Google have straightforward refund processes, and many people are eligible without knowing it.

For Apple: Visit reportaproblem.apple.com, sign in, find the purchase, and select “Request a refund.” You’ll describe the issue and submit. Apple often processes refunds within a few days, especially for accidental purchases reported quickly. The window to request is 90 days, but sooner is better.

For Google Play: Open the Play Store, go to Order history, find the purchase, and tap “Request a refund.” Google’s policy generally grants refunds within 48 hours if the purchase was accidental. After that, it’s at their discretion. Don’t wait.

A bank dispute is a last resort. It can take weeks and may get your account flagged by the platform. Exhaust the platform refunds first.

Beyond Authentication: Additional Safeguards

The settings change solves most problems, but not all. If you have a shared device or kids, add a second layer. For Apple devices, use Ask to Buy in Family Sharing so children’s purchases require your approval. On Android, set up a PIN for Google Play purchases or use a prepaid Google Play gift card with a limited balance to cap spending.

Checking your purchase history monthly is free and takes two minutes. In the App Store, tap your profile icon, then Purchase History. In Google Play, go to Payments & subscriptions > Budget & history. If you see a charge you don’t recognize, act fast because refund windows are short.

Prepaid cards remove the direct link to your bank account. That’s a belt-and-suspenders approach for users who want zero chance of a big surprise. The trade-off is you have to reload them.

  1. If you share a device or have kids, set purchase authentication to “Immediately” and turn on Ask to Buy or Family Link.
  2. If you’re the solo owner who buys things rarely, set it to “Every 30 minutes” and check your history each month.
  3. If you’re not sure, start with immediate authentication. You can always relax it later.

Ignoring these settings means you’re one borrowed phone away from a surprise bill. That’s not a risk worth taking.