Unfortunately it sounds like it's not that simple. His card wasn't stolen, but rather his account was hacked. So technically, he did have an account with Google Cloud.