People aren't listening. Yes our mistake was only a few quid and sorted quickly.
BUT I had already done, or tried to do most of the things on the lists people are giving here.
I did NOT, EVER enter my card details into his tablet
I used google wallet ONCE online many months before we even bought the tablet. I had NO IDEA that google was going to grab these details and link them to the tablet. I did NOT activate google wallet on anything at all apart from my PC.
(I have now of course shut down google wallet as I didn't really want it in the first place.)
There is no option I can find to get rid of the password free period after it is entered. 30 minutes seems to be standard and obligatory - I keep ds with me after I have entered it so he cannot do anything else but he has learned a lesson from last time anyway, so he would not do it on purpose.
All the blocks I could put on the tablet have been put there from the start. Parental controls on the Nexus are almost non existent.
We bought it on the recommendation of a bloke who posted here - offering to advise parents on technology. He has a blog/website called TariffHound.
Nice bloke but he didn't answer my email about parental controls - I assume because he couldn't find any on the Nexus.
It is all about small print, quite often, and the in app purchases are built to look innocent and they make it very very easy for a child to do, even without intending to - ds came to me crying and panicking, when he bought this stuff, because he knew he needed a password normally and didn't intend to buy anything. It just happened with one click.
It turned out it was in the 30 minute period after I'd let him get a paid for app. (minecraft I think - we use his vouchers he saves up for, NOT a credit card - the only thing I used while setting up the Nexus was my gmail address. NO card details at all.)
It is literally like a minefield.