Hey there! Nice to meet you!
I'm sorry you and your son are experiencing this.
The only way to recover a hacked account is through the official Microsoft troubleshooter guide:
If the account recovery web form doesn't work, and since the security info has been replaced by the hacker, I'm afraid there is no other working method to recover the Microsoft/Minecraft account, and Microsoft Support cannot help either.
Lastly, you mentioned that you have your payment card used to purchase Minecraft on that account. You'll need to contact your financial institution/bank directly to freeze your payment card to prevent unauthorized purchases by the hacker.
You may also need to have your card blocked and request a new one.
Thank you for your understanding.
Best regards,
Darhyl