My kid got scammed on a gaming app

Just found out my 10 year old spent 40 bucks on in game currency through our family iPad without asking. Said he was just trying to get enough gems or whatever for a game his friends were playing. We talked about it and he understands it was wrong but how do I prevent this from happening again? Should I remove payment methods from his profile or is there a better way to handle it?