I've never engaged in charge-to-bill so don't have first-hand experience of what security measures should be in-place, but my expectation would be...
The third party account or service in-question has password-protection to prevent unauthorised access to it. And when a particular phone number is first mooted as a payment method, that should be covered by a One Time Password (OTP) by text message to ensure valid access to it.
Out of interest, how old is your son?
