Had this been a session token the problem would have been less severe (session tokens won't be reused on the user's Gmail account for instance), easier to detect, and easier to mitigate once discovered.

When will regulations catch up with this sort of thing? Do Apple/Google have a moral responsibility here? Apple expressly forbids gambling apps, but this is essentially a slot machine with a different mechanic. Apple (not as familiar with Google) have done a great job on iOS giving parents the options to restrict their children making unauthorised purchases, but the settings aren't hugely discoverable.

In this day and age, do we need to consider a digital restraining order that allows a spouse or close family member to block or limit digital addicts? Do Apple or Google have a duty of care here or does it rest with law makers? The concerning part is that these purchases are invisible. If I buy a $1 million boat, others will see that and can intervene. But digital purchases can rack up silently and cause massive damage without anyone realising.

I'm really not sure where I stand on the issue. One side of me says that "it's his money, he can do what he wants" whereas the other side says that society should protect it's weakest, and this man clearly has a gambling problem.