I agree, to the extent that one should not leave sensitive information just lying around for anyone to be able to gain access to it and use it for nefarious purposes. However, the store should have required the young man to show ID while he was there, and they should have seen that he was not authorized on the account and called the account holder before processing any type of transaction.
