My two year old was able to make his first unauthorized in-app purchase yesterday. Because it’s in-app, it won’t show in your Google Play purchase history (even though they e-mail you a Google Play receipt) and thus can’t be canceled. They recommend contacting the seller. It should have the info in the e-mail receipt, but you can also check your Google Wallet transaction history at wallet.google.com. Of course you’re at the mercy of the seller, and they might not care to initiate the refund. It turns out that you can get quicker service if you contact Google using the Google Play’s “Talk to a specialist” feature. Whereas the seller didn’t respond in 24 hours, the specialist was able to refund my purchase in just a few minutes.
I urge all parents to set a PIN in Google Play and require it for purchases to be completed. Instructions can be found here.