Topic: What scam is this?

Hi everyone, I'm hoping for some help. My older son had Black Ops 4 bought on Monday on his account. He got the email, and the transaction history on his PS4 shows it was bought that Monday. He never bought it.
His younger brother has frequently hacked into his account and bought games using his older brother's debit card. (Yes,he does always get into trouble for it, but nothing works on this delinquent kid)
So, the problem I have is the younger one has Black Ops 4 on his cloud or whatever it's called. The last trophy he got on this game is over 18 months ago. So he wouldn't have done this for his own account. It's not downloaded on his account. But we feel if it was a hacker, wouldn't they buy more than 1 game? Couldn't they also fleece his bank account since the card is linked?
The best we could think of was the younger one sold my older son's details to his friend for money. And the friend bought Black Ops 4. It seems a bit weak. Can anyone think of another explanation as to what happened? The younger one is always trying to scam money from people so we feel it's definitely him. But we can't figure out how he did it. Any ideas? Bear in mind I know almost nothing about gaming, so please don't be too technical! Thanks in advance!

Check his bank to see if anything else has been purchased without his knowing. If not then your scamming kid probably had something to do with it.