As much as I would like to be able to say that Granny gave implied permission to use the card info, I don't think I can. This is a direct parallel to Granny writing her PIN on her card. Granny didn't tell the kid he could buy anything with the card.
I think the bank pays the piper on this claim, and decides whether to let Granny have another card (this one should be canceled). Granny should also be told she should not share the card number with her grandson unless the account can be set up so he needs a separate access code (known only to Granny) to make a purchase.
John S. Burnett
Fighting for Compliance since 1976
Bankers' Threads User #8