I mean, he doesn't have to have direct access. I remember in middle school, you used to have to type in a credit card to recover your Xbox live account. I had my mom's credit card # memorized so I could play at friends houses on my own account. That's way less damage than life savings, but I still could have made a financial dent, and she had no idea I had memorized it. Him spending money doesn't mean he had access; it's hard to see, but he doesn't look young. I'm guessing he accessed account he shouldn't have without parents being aware. You wouldn't normally assume your older kids are going to clean you out either.