The suicide bombers rode two motorbikes up to a checkpoint outside a police station and blew themselves up, police chief Tito Karnavian told a news conference in Indonesia's second-largest city.
He said the child survived the explosion, and CCTV footage showed the girl stumbling around in the aftermath.
Four officers and six civilians were wounded in the attack, East Java police spokesman Frans Barung Mangera said.
"We hope the child will recover. We believe she was thrown 3 metres (10 ft) or so up into the air by the impact of the explosion and then fell to the ground," said Mangera, adding she had been rushed to hospital.
President Joko Widodo branded the attacks in Surabaya the "act of cowards", and pledged to push through a new anti-terrorism bill to combat terrorist networks. After some major successes tackling terrorism since 2001, there has been a resurgence in recent years, including in January 2016 when four suicide bombers and gunmen attacked a shopping area in the capital, Jakarta.
Police suspected Sunday's attacks on the churches were carried out by a cell of the ISIS-inspired group Jemaah Ansharut Daulah (JAD), an umbrella organization on a U.S. State Department terrorist list that is reckoned to have drawn hundreds Indonesian sympathizers of ISIS.
"In the case of Surabaya, they escaped detection, but once it happened we moved fast to identify their network," Karnavian said.
The father of the family involved in those attacks was the head of a JAD cell in the city, the police chief said.
Earlier, police said his family was among 500 Islamic State sympathizers who had returned from Syria, but the police chief said that was incorrect.
During the hunt for the cell, police shot dead four suspects and arrested nine, media reported police as saying.
The police chief said the JAD cell may have been answering a call from ISIS in Syria to "cells throughout the world to mobilize."
He said the imprisonment of JAD's leader, Aman Abdurrahman, could be another motive, and cited clashes with Islamist prisoners at a high-security jail near Jakarta last week in which five counter-terrorism officers were killed.
Karnavian said the JAD attacks used a powerful home-made explosive triacetone triperoxide (TATP), known as the "mother of Satan", and commonly used in ISIS-inspired attacks.
In all, 31 people have died since Sunday in attacks, including 13 suspected perpetrators and 14 civilians, police said.
CHILDREN USED IN ATTACKS
CCTV footage of the blast outside the police station early on Monday morning showed two motorbikes arriving at a checkpoint next to a car followed by an explosion as officers approached.
Security experts said the attacks represented the first time in Indonesia that children had been used by militants on a suicide mission.
"The objective of using a family for terror acts is so it is not easily detected by the police," said Indonesian security analyst Stanislaus Riyanta.
He said that families could also avoid communicating using technology that could be tracked.
Indonesia's chief security minister said that police backed by the military would step up checks across Indonesia.
In Surabaya, police officers wearing balaclavas were posted at major hotels and landmarks on Monday.
President Widodo said he would issue a regulation in lieu of a new anti-terror law next month if parliament failed to pass the bill.
Police have complained that laws do not give them enough powers to detain suspects to prevent attacks.
Speaker of parliament Bambang Soesatyo told Metro TV that the house was committed to wrap up debate on the bill this month, but called on the government to help resolve differences.
Get Breaking news, live coverage, and Latest News from India and around the world on NDTV.com. Catch all the Live TV action on NDTV 24x7 and NDTV India. Like us on Facebook or follow us on Twitter and Instagram for latest news and live news updates.