First of all, most likely fake. Second, no bank will side against him if he disputes paying for it. Third, the plushie company can just reverse any order made with the code, or cancel the whole thing if not; they're not going to fill a million orders they know no bank will allow payment to go...