I don't see any kind of fraud in this, but she hopefully stopped using that paypal imediately.
Technically the one liable for fraud looks more like the dad to me.
Also you don't get arrested on such things, an arrest can only happen on the chances of a flight-risk, risk of cover-up, or risk of repetition.
They can close the card, so the danger of repetition is gone, she won't run and she won't be able to manipulate the banks transaction details or such and since all has been done verbally there is no other evidence to destroy.
Her lawyer sounds like a hack.
The situation is difficult though. She might be found guilty of unauthorized use of the CC. Maybe she will have to cover the payments she made, or something like that. Jail sounds ridiculous.




