Jennifer Stubbs of Toronto said the hacker charged the in-game buys to her credit card.
"I wasn't aware that these purchases were happening," she told the Canadian Broadcasting Corp. "Someone had gone into our device remotely."
Her son Dylan went to play FIFA 13 Ultimate one morning and found all the players he had bought to build his virtual game team -- purchased with his mother's permission -- had been stolen.
An avid soccer player, Dylan been building the virtual team for months, his mother said, buying points online to buy better players for his FIFA team.
Stubbs said when she received her credit card statement she found $409 in charges from Microsoft, almost four times as many purchases as Dylan's Xbox showed.
"The device says he bought 7,000 points," she said. "The Visa says he bought 25,000 points."
EA Sports, which produces the FIFA 13 game, replaced all of her son's lost points so he could buy back his players after she complained about the theft, but Microsoft has so far refused to reverse the charges on her credit card, Stubbs said.
Microsoft declined to be interviewed but sent a statement saying it is working on improvements, the CBC reported.
"In this industry, security is an ongoing challenge and we are working every day to bring new forms of protection to Xbox Live," the company said.