Why would a $120k spend on a business card (entered by the cardholder on an advertising account under their name) be suspicious?
This doesn't follow the pattern of a stolen card at all.
EDIT: Dad set up the YT brand account using his employer's Google Workspace. He handed all his work emails and sensitive auth to the kid too. Dad is stupid as fuck.