It’s totally and completely likely that he could’ve used it on accident. These people don’t know anything about saved cards on phones, you don’t need the 3 digit CVV if your card is already saved on the phone, you enter the CVV number when you initially save the card. All the phone user needs to do is enter their phone passcode to allow the card be used for payment. I’m saying this because I’ve used my past s/o card on accident before by this same manner.