All three are at fault.
1.Kid spent money he didn't have without permission.
He did not own the money, it was not his, and he utilized it without permission to do so. Violation of trust, blah blah blah. He was wrong to do that, nobody can argue that. No twelve year old is dumb enough to lack the knowledge of what a $ means. He is very irresponsible, blah blah blah. If you read from page 1 to here then you have seen enough of this to last a lifetime.
2.The Man didn't understand the technology at play.
The first thing you do whenever you get a new piece of high-end technology is learn how to work the damned thing. You find out what it can do, what is is supposed to do, and if a kid is using it, how to keep them from doing something stupid (as kids are apt to do). He also gave a copy of COD to someone who wasn't even a teenager yet... showing he didn't even understand what the ESRB Ratings System is. If he had actually done what a intelligent and responsible human being would do, namely learn how the system worked, he would have gotten something done to prevent this.
Also... six months without checking a credit card statement, or a bank account, or any of his financial information? He was asking for something like this to happen by doing that. Rule number one, you don't tempt fate, you don't count on luck for anything you can actually take steps to prevent.
Blah blah blah, again this seems to be the common opinion. Which means i am a conformist sheep doesn't it?
3.Microsoft
For letting this idiot sign up for a XBL Account and unleashing this idiot. Although they are in the business of making money, so it might be possible to forgive this. They did, as stated, create methods by which this could be prevented. They can be held at fault for not creating a safeguard to unauthorized use, but that's not a crime. Unless somewhere it is against the law. They can't however be held responsible for the kid being able to do what his father had enabled him to do by not being aware of the system's capabilities.