Biometric Fail: Child Hacks Mom’s Phone, Drops $250 on Pokemon Toys

It’s a tale as old as six year olds. Young Ashlynd Howell of Arkansas, daughter of Bethany, decided one day she wanted more Pokemon toys.

Familiar enough, but Ashlynd decided to get hands on the toys not by doing a few household chores and raising cash, but rather by going shopping on her mother’s smartphone.

For those already in mid tut-tut and wondering why Bethany didn’t have any security on her smartphone against the insensate depredations of little Ashlynd’s Pokemon lust, Bethany did. In fact, she was using thumbprint protection, a biometic security tool commonly regarded as a powerful protection aid.

Not powerful enough, however, to repel an inquisitive six year old who beat the security in a measure only a six year old could come up with. Specifically, she waited until mommy was napping, and then took hold of mommy’s hand and used the thumbprint contained therein to unlock the device.

Ashlynd then proceeded to run up a roughly $250 bill, buying 13 pieces of Pokemon merchandise, later informing her parents that she’d been shopping.

When said parents believed their Amazon account had been hacked, it was of dubious comfort that Ashlynd revealed her act, noting that she’d got the shipping address right, and that the toys should be arriving in short order. An appropriately stern lecture followed and all the toys that could be returned would.

While the exact value of the response here is debatable—some consider this a catastrophic failure of parenting while others consider it a stroke of genius that the six year old could think of such a thing—the end result remains the same.

We’ve seen before that sometimes it’s just too easy for a six year old or similar minor child to make purchases, and we expect that biometrics will protect us. They will, but as is ever the case, vigilance is always called for even alongside strong security.

Biometrics are indeed a powerful security tool, but no security tool is completely foolproof. So parents, and everyone else: watch your bank accounts, watch your credit and debit cards, watch everything. As the amended adage says, put all your eggs in one basket…and then watch that basket.