Never seen this before.  Family all have their own ITunes accounts. He logged onto his email to find a credit card had been applied to his account about 3 days ago - He's 12 so that confused him for a bit.

Then about $120 US was spent downloading a couple of apps with some asian language names that made no sense to me. 

Then apple send him an email saying, someone is downloading apps from an unregistered device and different location but it's tagged to your account. We're just letting you know in case its not you but haven't done anything to stop them.

Now changed his password and all of ours as well. Was about to call the bank when I realised I hadn't registered a card against his account (only mine) and it appeared to be a mastercard when I use Visa etc. Mine is now deregistered from itunes. I'll stick with scratch vouchers from a shop.

I'm presuming someone has used his details to register stolen card info then dumped $$$'s onto it before disappearing. 

I've informed Apple as well using their ever efficient email- NOT... Their automated voice helpdesk thing now keeps calling me, tells me to press 1 to talk to someone, then says my selection is invalid then hangs up..Piece of c**p that it is.  It'll call again in about 30 minutes.

Anything else I should be doing re security.?  Have beefed up the passwords, scanned all the home PC's for malaware etc, changed IP/email passwords as well.

Thanks for any advice.