A mother has warned of the risk of children spending hundreds of pounds on "free" online games available through Facebook after her 12-year-old son ran up bills of more than £900 without her knowledge.

The woman, who prefers to remain anonymous, discovered last month that her son had spent more than £900 on FarmVille. He had emptied his own savings account of £288 and had used her credit card to the tune of £625 to pay the bills.

FarmVille, one of the most popular games on Facebook, allows members to manage a virtual farm by planting, growing and harvesting crops, trees and livestock. New users are given virtual coins to set up their farm, and the revenue from matured crops can be used to maintain it. But those who are desperate to progress more quickly can buy extra virtual coins using real cash.

The mother said: "The first use of my card was on 14 March. I discovered it on the 29th and the card was stopped at that point. Any transactions after that date were already in the system, so what I thought was a £427 spend turned into £625 over the next few days.

"The total spend is about £905, but the credits are still rolling in. Facebook and [game creator] Zynga will not refund anything as [the son] lives in my house. Facebook has disabled his account and Zynga has unhelpfully suggested I use password protection on computers in the future."

She contacted her credit card company, HSBC, but was told she would only qualify for a refund if she reported her son to the police and obtained a crime number. "He would be cautioned and I have been told that this caution would stay with him. Obviously the idea of a stupid farm simulation jeopardising his future earnings is not something that I want to consider," she said.

She added that her son was "very shocked" when confronted with the amount he had spent, but it was clear he knew what he was doing. "When I asked him why he did it he said that they had brought out 'good stuff that I wanted'."

She does not blame Facebook, Zynga or HSBC, saying that her son was the one using the card and is entirely at fault. But she added: "I do think they need to shoulder some responsibility in this business and put systems in place to stop this happening again. The fact that he was using a card in a different name should bring up some sort of security and the online secure payment filter seems to be bypassed for Facebook payments."

A spokeswoman for HSBC said that had the credit card been used on a gambling site it would have started alarm bells ringing for "unusual usage". But because the card had been used to buy Facebook credits HSBC did not consider the transactions to be suspicious, even though £625 was spent in just two weeks.

Michael Arrington, founder of the Techcrunch blog, criticised Zynga last year for "monetising" the game, and warned that people who didn't have access to a credit card to buy extra virtual money could use "pay by mobile" companies instead.

The indebted 12-year-old has not used his mobile to pay for virtual money, his mother said, but only because his older brother lost all his credit buying a ringtone a couple of years ago.

"We sound terribly technologically unaware don't we? I wouldn't mind but I am always explaining that all of these online offers, ringtones and games are a scam designed to take money off stupid people. Kids know best though."