The kid would be in big trouble as I AM SURE he knew what he was doing.
Reminds of a few years ago my youngest daughter needed surgery, the wife and I stayed with her in the hospital for 3 days. My oldest and her iPod stayed with my father in law for the weekend. We went to leave the hospital but first had to get the kids meds for home, so we get them and pay with our debit card but it is declined....wtf? My wife calls the bank, our card was frozen for fraudulent activity.... double wtf?
Come to find out my (then) 7 y.o. was playing a FREE iPod game all weekend but was making in-app purchases of stuff for the game, in the amount of roughly $350 before the card was frozen.
Yeah, that was cool. We actually fought with Apple and won, got our money back. Now the apple devices all have password for all downloads and purchases lol. I honestly don't think she knew what she was doing.....that is what I tell myself anyway...hah.
You live and you learn.