My DS at the same age could have done a lot worse, if he wanted to.
My card is linked to the account and he actually knows the password.
He's always asked me before using any money (even as little as 5 euros) and I've fully trusted him so far.
In the same way that he doesn't take money from my wallet or takes anything from home.
So, no, I don't think it's your husband's fault for not checking or whatever. Or the tech company.
Your son is to blame. Although, trust has to be gained, and that is why I am relaxed about my son.
I'd sell all of his gaming, etc. Not sure what he bought, but I think some of the gaming stuff can be resold online. Look into that.
Apart from that, does he have a savings account, does he get a weekly allowance? I'd take as much as possible from those and I'd deduct the money from his Christmas and birthday presents from then on. I'd inform the family to only give cash presents and why. No birthday parties other than cake with family.
And I'd give him household chores to compensate for the money lost, from washing the car to ironing.