I think being authoritarian is more to do with attitude, how you communicate than with whether you apply sanctions.
My DS, when he was 9, once spent £700 on a Simpsons game, as the apple default setting was that no password to the shop (ie in-app purchases) were needed within 15 minutes of the last purchase.
In those 15 minutes he managed to spend £700. I am still not sure whether he understood it was real money. DH came down like a ton of bricks, lots of shouting and crying. Quite an awful day.
Meanwhile I contacted Apple and asked for money back (which i got back), my bank (Barclays) also gave me the money back (so and to return it to them!). So I was covered by both Apple and my bank. I hope you get your money back too, if you state clearly that your card was used without your authorisation. Can you really not get it back? I'd try again!
We had a serious chat with DS that in-app purchases were real money. It was a bit of a shock for all of us.
What OP daughter did sounds like more long-term deceit, so it needs to be dealt with. However, i think it is important for kids to also feel the "sentence" is served after a while, and they are forgiven at some point (before Christmas!).