Something like that happened to my ex girlfriend and Google play. She connected her card once so her 6 year old could watch, I think, Disney on the tablet.

Then the little one installed some games and €150 later GooglePay froze her payment info on file for outstanding subs to silly games.