No idea why you’ve bumped a thread, but you don’t need to be scammed to get hacked. There’s so many websites out there with peoples informations and passwords which have been leaked in database hacks. There’s been many database leaks from MySpace to Shien.
I bumped the thread to correct misinformation.
She was absolutely scammed, as, IIRC, you needed the device to accept the pairing for them to rip the icloud.
The standard scam is to ring up pretending to be apple support, claim you notices suspicious logins, pings from all over the globe, and that you'll need security info to make sure it's actually her device, and that it hasn't been cloned.
You go round the hedges comparing names, dates, passwords, then send her a security ping to verify her device. She accepts, you're in, you thank her for her patience, and hang up.
It's not the most sophisticated scam in the world, but if your job and social life depends on that phone, you don't think clearly.
No idea if that's the scam she fell for, but it's the one they used to try on a friend of mine about once a month for going on 3 years. Lol.