I was worried it was stolen, but it was not. I reached out to him, and he did contact Xiaomi, but that went nowhere. So he gave me a password to try and it worked, so I could log him out after giving him the account number, and he could then retrieve all his lost data, so it was a win/win.

He had migrated all his google data but didn't realize there was more to it than that. It was innocent enough, not every used phone is stolen.

But it's something to be mindful of, that a 'working phone' may in fact be locked.