The fact that you did it "secretly" might get you into trouble- using a company credit card for unauthorized purchases is fraud. I suppose you could argue the kid defrauded the company by spending his time programming rather than doing data entry. I don't think that would be as easy to get a judgement for as credit card fraud.