The same thing happened to my kid's grandmother. Her CC was linked to her Apple account for iTunes, etc and its linked to the apple store automatically. My kid was playing a game on her tablet and a pop-up in game gave him crystals to buy whatever and charged right to her card through the store.
She never played any of the games, but he racked up a few hundred dollars and drained her bank account.