Should game companies be held liable for unauthorized Apple ID transactions?

In recent years, incidents of unauthorized charges via Apple IDs have occurred frequently. When users suffer financial losses from in-game purchases due to compromised accounts, they often direct their claims toward gaming companies, demanding compensatory damages. However, from the perspective of legal principles and the apportionment of liability, gaming companies are generally not held liable in such cases.This article will systematically demonstrate the rationality behind the non-liability of gaming companies by examining legal obligations, the liable subjects, user negligence, and the burden of proof.

PART 1

Gaming Companies Are Not the Directly Liable Parties in Unauthorized Charging Incidents

1、Gaming Companies Provide Technical Services and Are Not Participants in the Payment Process

As application developers, the core obligation of gaming companies is to provide game services that meet regulatory standards, rather than to guarantee the security of a user’s payment accounts. When a user completes a purchase through the Apple App Store or other third-party payment platforms, the payment process is executed jointly by Apple, the payment service provider, and the bank. Should financial loss occur due to unauthorized charges, the directly liable subjects should be the perpetrator (the "unauthorized charger") and the payment platform or bank that failed to fulfill its security guarantee obligations.

2、In-game Consumption Behaviors Lack a Direct Causality with Unauthorized Charging

The essence of unauthorized charging is the transfer of property executed after illegally obtaining access to a user’s payment account; it has no inherent nexus with the game services provided by the gaming company. Even if a user purchases in-game items, the transaction instructions are issued by the user’s own account. The gaming company serves merely as the terminal service provider of the transaction channel and does not participate in the transaction decision-making process. Consequently, there is no direct causality between the gaming company's actions and the user’s loss.

PART 2

Gaming Companies Have Fulfilled Reasonable Security Guarantee Obligations

1、Technical Perspective: Inability to Intervene in User Account Security

Gaming companies possess no direct control over, nor the capacity to monitor, a user’s sensitive information, such as Apple IDs or payment passwords. Even if a user enables Two-Factor Authentication (2FA), unauthorized charges can still occur through channels like phishing websites or Trojan horse viruses. Imposing a security liability on gaming companies that exceeds their technical capabilities would be manifestly unfair.

2、Contractual Perspective: Explicit Obligations for Users to Safely Maintain Accounts

Service agreements entered into between users and gaming companies typically contain explicit covenants requiring users to properly safeguard their own account and payment information. If unauthorized charging occurs due to the user’s own negligence (such as password leakage or failure to enable 2FA), the liability shall be borne solely by the user.

PART 3

Liability Should Primarily Rest with the Perpetrator and the Payment Platforms

1、The Perpetrator is the Direct Tortfeasor, and the Victim May Seek Recovery via Criminal Proceedings

Under relevant provisions of the Criminal Law, unauthorized charging constitutes the crime of theft, and the perpetrator shall bear the liability for restitution. In practice, many victims have successfully recovered their losses through criminal restitution procedures, further confirming the primary liability of the perpetrator.

For instance, in August 2022, a defendant (Li) fraudulently obtained a victim's Apple ID password and 2FA code, subsequently executing unauthorized charges exceeding 13,000 RMB via the victim's password-free payment feature. Following a criminal investigation and arrest by the Putuo District Police in Shanghai, the Putuo District People’s Procuratorate initiated a public prosecution against Li in May 2023. By June 2023, the victim received the restitution funds transferred from the Putuo District People’s Court. Li was sentenced to eight months of imprisonment for the crime of theft and fined 2,000 RMB.

2、Payment Platforms Must Fulfill Risk Control Obligations

Apple, along with third-party payment institutions such as Alipay and WeChat Pay, bears a duty for real-time monitoring of abnormal transactions. If unauthorized charges occur due to lapses in risk control (e.g., failure to intercept high-frequency small-amount transactions or failure to implement restrictive measures on dense, short-term transactions), Apple and the third-party payment institutions should be held liable for the aggravation of the user's losses.

PART 4

User Negligence as a Key Factor in the Incurrence of Losses

1、Failure to Enable Two-Factor Authentication (2FA)

Apple has repeatedly emphasized that enabling Two-Factor Authentication (2FA) is an effective measure to prevent account theft. If a user fails to enable this feature, they remain vulnerable to losses resulting from unauthorized logins, even if the payment platform or bank has fulfilled a portion of its risk control obligations.

2、Improper Selection of Payment Methods and Voluntary Assumption of Risk

When a user opts to bind password-free payment (autopay) services and sets high transaction limits, they significantly escalate the risk of unauthorized charges. Pursuant to Article 57 of the E-Commerce Law, a payment platform is liable for unauthorized payments only when it is at fault. By actively selecting password-free payment, the user's conduct constitutes a voluntary assumption of risk.

Furthermore, in many practical cases, users suffer unauthorized charges because they misplaced their trust in scammers and performed authorized actions (such as providing 2FA codes) via online interactions. In such instances, the user must bear primary liability for their own gross negligence.

PART5

Allocation of the Burden of Proof: No Fault on the Part of the Gaming Company

1、The Principle of "He Who Asserts Must Prove"

In civil litigation, the party claiming compensation bears the burden of proving that the liable party is at fault. If a user seeks compensation from a gaming company, they must provide evidence demonstrating that technical vulnerabilities or managerial negligence on the part of the company directly led to the unauthorized charges. However, in typical unauthorized charging scenarios, the gaming company is not at fault, making it impossible for the user to satisfy this evidentiary requirement.

2、Limitations on the Probative Value of Police Filings

In some cases, insurance companies deny claims or payment platforms shift responsibility because the police filing receipt (Certificate of Case Filing) records the incident as "fraud" rather than "unauthorized charging" (theft). Even if a user asserts that unauthorized charges occurred, they may still lose the case due to insufficient evidence if they fail to provide substantial proof, such as records of abnormal IP logins.

Final Thoughts

In cases of unauthorized Apple ID transactions, game companies bear neither direct liability nor breach statutory security obligations. Their responsibility should be strictly confined to the scope of technical provision and contractual agreements. As the primary custodians of their accounts and payment information, users should mitigate risks by enabling two-factor authentication and setting limits on password-free payment amounts. For loss recovery, claims should first pursue criminal restitution against the fraudsters or hold payment platforms accountable under the E-Commerce Law. Shifting responsibility to game companies lacks legal basis and violates fairness principles. Only by clearly defining the boundaries of responsibility for all parties can we build a safer and more equitable digital consumption environment.