He may have disabled his own token in advance to avoid charges? That's what I would have done in his scenario.