All together now: Ruh roh!
While the game itself is free, it uses in-app purchases to allow players to upgrade their characters and buy virtual goods. Before his father knew what had happened, there was a huge bill waiting for him on his credit card. He had provided the four-digit passcode to allow his son to use his device, and his son had also memorized his dad's Apple ID login information. Pretty precocious for a 7-year-old, don't you think?
The story has a happy ending: his father, Mohamed, complained to Apple, and they've refunded the money.
That aside, this is only the latest in a long line of similar stories. In-app purchases have long put parents' credit cards at risk when they hand their mobile devices over to their kids, and despite moves by Apple and Google to tighten things up a bit, we still have cases like this.
It's easy to blame the technology - and let's be clear, in-app purchases are the work of the devil, the Borg, and Donald Trump working in concert - but accountability ultimately lies with parents who increasingly see these devices as convenient babysitters. They naively ignore the risk of in-app purchases, and they fail to keep a lid on their kids' online activities. They can easily enable parental controls and limit connectivity, but many parents simply can't be bothered.
This is something to keep in mind as other free-to-play games like Clash of Clans, Boom Beach and Mobile Strike (starring none other than Arnold Schwarzenegger blindly punching the daylights out of a smartphone screen) launch big budget marketing campaigns to get you to play. They make their money via in-app purchases, so the best bet is to not take the bait in the first place.
Online as in life, there's no such thing as free.