Fishies in-app purchases are fishy

My son ran into this when he got his new iPod Touch pre-iOS4. We loaded up his iTunes account with some gift cards so he could buy himself some apps or music, but he suddenly realized that all of the money was missing. After a little detective work and looking at his iTunes receipts, we realized that he had been buying from the Fishies store and not realizing it was taking from his money. Luckily we didn't have a CC tied to his account, and that stopped it.

His solution? We disabled the in-app purchases with the new version of iOS4. If he wants a game or song, he emails us the links and we gift it to him. That way he doesn't get tempted to use in-game purchases at all.

This is Apple's problem. They could address this any number of ways. Maybe password caching should be turned off by default, with an option to enable it if you want.

Although that won't solve the issue of people who purchase in-game items, because they don't realize that it cost real money. You have to be pretty dim to do that, as it's clearly stated that you are about to make a purchase. But I remember being startled the first time I encountered this in iRule. This was a new (and unwelcome) concept for me. But I wasn't so startled that I blindly made a purchase.

Paul thorott of Windows Weekly on the twit network had a problem with this. His kids were playing and bough fish for 900$

BTW - Mike Rohde has updated his article, apologizing to PlayMesh for his initial wrongful assumptions that his experience was entirely developer's fault. It includes a response from PlayMesh.

Please update your article especially where it unfairly advises users to delete it from their devices.

The url for reference is:
http://www.rohdesign.com/weblog/archives/003193.html

As a developer, this story does not sound exactly right. Like others have said, a 3rd party app can only initiate a purchase. What that means is showing the standard "Do you want to purchase item X for $Y?" The rest of the transaction is taken care of by Apple's API, including requesting for the user's credentials after they confirm the purchase request. The next time the app is notified is after the user has either authorized the payment or canceled it.

The iOs does cache iTunes passwords for a few minutes, and this also applies to in-app purchases. So, if your password has been cached, the app will still prompt you with the standard "Do you want to purchase item X for $Y?" Then, if you confirm the purchase, it will go ahead with the transaction without asking again for a password. This is most likely what happened with these so-called "scams."

In addition to my description, another fellow has confirmed the same behavior: http://www.manton.org/2010/07/itunes_password.html

I am very surprised TUAW did not investigate this further before posting, given they have at least a couple developers on their staff. For such an inflammatory piece, they should at least confirm these claims before attempting to tarnish a developer's reputation.

I'm have been an iPhone developer for the past 2 years, I have dealt with in-app purchase.

From my developer experience
- You can't steal money if even you tried to. Apple's framework does not allow that.
- Every in-app purchase is given a strict pop up notice, it's not by developer design, it's also by Apple framework. You have to agree to it in order for the transaction to happen.
- You won't even try to have a game with unclear in-app purchase instructions. AppStore approval is hard enough to get by, no developer in their right mind would risk it.

From my everyday experience
- Your 5-year old kid is not the best source of information. Checking this source would be wise.

TUAW, did you reproduce this issue, or did you just take the kids' word this time for this sensational article at the expense of a developer?

You know what this is kind of getting ridiculous if apps are doing things like this and I said if then it is Apples fault and responsibility. I mean they approved the apps and everything has to go through them so if they want a walled garden they have to take the good with the bad.

Ok apple, you wanted to curate the store, time to step up and do it. You can't turn down all these legitimate apps and sit by while people's kids are clearly taken advantage of by apps on your store. I think we can all agree that hundreds of dollars for "pearls" is a scam.

Another reason? What are the others? I've been buying stuff from iTunes for at least as long as you have, and have never had or even heard of any problem like this until now.

What do you do, by the way? Buy everything with iTunes gift cards?

This is another reason why not to link your iTunes account to a credit card.

I've been buying content from iTunes since 2005, and not once have I needed to enter any credit card information.