I don't think you are being too tough at all. I might also have him research the legal definition of "identity theft" and adult penalties for engaging in such activities and report his findings back to you. Make it a discussion of the moral, ethical and legal ramifications for this kind of behavior. Also discuss the potential harm to you individually and as a family - the importance of credit ratings, the problems with carrying high credit card debt, what would happen if he ran up debts you were not able to pay off. He needs to see the whole picture, not just in terms of "this is wrong because mom/dad says so" but "this is a behavior with actual harms to someone else."
So yes, absolutely be tough on him - stealing is a big deal, and he needs serious consequences to drive the lesson home.
But...I also wouldn't freak out about it too much, or assume that this is the start of a long criminal career. He's young, and I don't think this kind of thing is all that uncommon at this age. Especially with the video games. I HATE the new style games with all of the in-app purchases and microtransactions. They design them to be sooooooo incredibly addictive - they actually use cognitive research to design them this way deliberately. It's not a drug, but the reward cycle activity in the brain isn't all that different. And the cooperative nature of the games, where you feel like you're letting down a "team" if you don't advance fast enough, makes it that much worse.
I once, in a moment of geeky boredom, briefly checked out one of those online battle games for iOS with all of the guilds/leagues or whatever and chatted with some of the other players. I discovered that the big players dominating the game boards were spending on average $500-600 per month!!!!! I talked to one who had been playing for 4 months and estimated he had spent $3,000. His wife was divorcing him. He was still playing. It blew my mind. But those games are designed to hook players and drive just that kind of behavior. I am so glad that when my kids were that age games might have cost $60 up front but were played offline and solo - no further investment required to win. I shudder to think what I might have been in for otherwise. (Though they also grew up prior to unlimited texting plans, and I vividly recall the $1200 cell phone bill I got when S got a boyfriend who was on a different network.)
So yeah, keep an eye on the gaming behavior, and make sure he's got plenty of "real life" pursuits as well.