A 10-year-old girl spent more than £2,500 on the gaming site Roblox after changing the password on her family's iPad tablet without her mum realising.

Georgina Munday, from Denbighshire, has warned other parents to "be vigilant".

Tesco Bank initially refused a refund but reconsidered and apologised after BBC Radio 4's You and Yours took up the case.

Roblox said it had "a robust policy" from unauthorised payments and Apple said pre-purchase alerts could be used.

Roblox allows users to create their own games but also offers in-app purchases to upgrade the user's avatar with things like clothes or accessories and offers some pay-to-play games.

Georgina Munday, 44, who lives in Dyserth, said her daughter, who has autism, had been playing on her tablet for longer recently due to being off school after struggling in mainstream education.

She initially thought someone had hacked her daughter's account but it soon became clear that the 10-year-old had managed to change the password to allow payments.

"We'd just seen hundreds of transactions, these payment confirmations, so then the panic set in – oh my gosh, whose card is this on?," said Georgina.

Her daughter had managed to spend more than £2,500 on the site but most were small transactions of around £20.

For about a week, Georgina, who is a nurse, was in back and forth contact with Apple and her bank, Tesco Bank, trying to secure a refund but both refused – she said it was "a horrendous time".

"It was a really stressful time. I am not working at the minute, I am looking after my daughter. The last few months have been quite stressful, so maybe we have had our eye off the ball. I just thought I would have to pay it off in instalments over the next few years.

"I rang up Tesco Bank and they said, because it was my daughter, they couldn't do anything about it. So I tried Apple again – they just read me their terms and conditions. So that's when I contacted the BBC, You and Yours, consumer programme."

Within a day, Georgina said that Tesco Bank contacted her to say they would refund the full amount.

"I cried – it was just a relief, a weight off my shoulders."

Apple said there were ways that accounts could be set up to alert a parent before a child wants to make a purchase.

It said that parents and guardians should not disclose passwords or enable FaceID and TouchID for their children and Ask to Buy should be set up so that purchases need approval before going through.

Screen time being turned on would also enable parents to stop in-app purchases, it added.

Tesco Bank said: "We've carried out a further review of this case and have now agreed with Ms Munday that we'll refund her the full amount.

"We apologise to Ms Munday that this wasn't arranged for her when she first contacted us, and we've therefore also organised an additional payment to her as a gesture of goodwill."

Georgina said she did not feel happy to let her daughter play the game anymore.

"She knew what she was doing, she changed the password but I don't think she understood the enormity of it."

Georgina said parents should "be vigilant" and be aware of what their children were playing.

"Children are one step ahead of parents these days. We thought this Roblox game was quite innocent, it looks very basic. It's a whole world out there on this Roblox that we knew nothing about."

Roblox said: "Roblox has a robust policy for processing refund requests where there may have been unauthorised payments from a person's account.

"This process is detailed in our help centre here.

"Parents also have access to a suite of Parental Controls that can be used to determine how much their children can spend, and set spend notifications to increase visibility over their children's spending on Roblox."