A father was stunned when he discovered his nine-year-old daughter had guessed the password to his PayPal account while he slept before blowing £1,000 ($1890) of his money on a dream trip for one to Disneyland Paris.
Ian Wilson, 53, was fast asleep when Susan nabbed his mobile and went on a midnight spending spree, the Daily Mail reports.
The schoolgirl spent £400 ($756) on flights and a hotel gift card, £214.08 ($404) on a VIP trip up the Eiffel Tower and £381.84 ($722) on theme park tickets and the Disneyland Express train due to depart the next day.
Mr Wilson, a welding inspector who lives with partner Tracey, 52, son Anthony, 12 and daughter Marie, 10, in Immingham, Lincolnshire, only realised what had happened three days later on October 27 when he noticed £1005.92 had been drained from his account.
He told MailOnline: "My immediate thought was that it was fraud so I phoned PayPal who told me the the payments had been made from a device they deemed normal for me and did not consider it to be fraud.
"That's when I went through my phone history and found all these websites in my internet history. I asked Susan and she said it was her.
"She was absolutely brokenhearted and very remorseful. She had no idea what she was doing, I could not even punish her for it."
The tour was booked through Getyourguide, a German-based website while the flights and hotel were booked with budget airline Bravofly.
Susan, who usually spends her holidays in Skegness, says she has no idea how she managed to book the trip and said she just likes playing on her father's phone.
She does not even know what the Eiffel Tower is, she claimed.
As soon as he realised what had happened Mr Wilson phoned Yorkshire Bank, Paypal and the travel companies in a bid to get his money back - but claims they refused to refund the cash after saying no fraud had been committed.
But PayPal eventually refunded the money to an 'elated' Mr Wilson, who was told it was classed as "friendly fraud" and happens frequently.
Now Mr Wilson is urging other parents parents to ensure their children do not have access to their internet devices.
He said: "Have a pin on your phone. I didn't because I've never needed one but I do now."