Actually, anyone who read my previous post, disregard. I refuse to believe that in the obligatory user agreement Microsoft failed to mention that the credit card could be used for micro(soft)transactions. I mean, if they did, I think we owe a complaint to M$ more than anyone else, but if they didn't?
Who doesn't read all of the documentation before handing over their credit card? That's painfully reckless. Ok, yeah, maybe if you yourself are to be using the service, it's probably not so risky. But she did just throw her card at her son, maybe she should have made certain that the details couldn't be used for anything else? Age is no excuse for ignorance.
Once she knew that this could occur, a swift warning to her son would commence, and he would walk away, humbled, and overly cautious of the marketplace.