There are very convincing phishing attacks used to get the original owner to reveal their Apple password: https://krebsonsecurity.com/2017/03/if-your-iphone-is-stolen...

I know someone who fell for this. Even though they were skeptical when they received the message, they thought there was a chance it was legit, and therefore gave them some change to recover their stolen phone. I guess they had nothing to lose, as the chance of recovering the phone was ~zero anyway.