No protections in place and blindly trusted her kid. It is her responsibility to manage her passwords, not Amazon / twitch / whoever else. A shitty situation for sure but if she wants the $ press charges, if she doesn’t want to press charges then she must forego the 20k. Not as simple as that to her, but to everyone else it is.