There's no particular reason you can't blame all involved parties:

  * android for allowing payforit to be invoked without user interaction
  * payforit for allowing fraudulent transactions
  * rolling stones for not vetting their advertising partners and taking money from scammers.

It's not like every party in the transaction couldn't do anything to prevent the problem.