+1 for what Just_Me_D said.
An iPhone that is in the device list of someone’s iCloud account and FindMy on (IME virtually everyone also has FindMy turned on), that device is fully etched in stone then sealed in a vault to that account. There is no legitimate way to move forward with that iPhone transferring to a different account. Not going to happen. I believe even if you have the PIN code, I’m almost certain trying to locally disable FindMy and removing it from your device list under General Settings>iPhone owner name, you will be prompted to enter the iCloud credentials before this action will occur.
As Just_Me_D Stated well, it seems extremely unlikely to be legitimate for someone to go into a store to ask the store to recover the cloud based iCloud credentials. You/someone working in a store would have no idea what the secondary contact methods would be to password recover.
Moving forward, Here’s a simple rule of thumb I suggest you live by for modern Apple devices iPhone, watch, iPad. Without the iCloud credentials of the account the device is listed in, these devices are expensive paperweights. Anyone who comes into your store and doesn’t have the credentials or a way to recover the credentials, tell them you can’t help them. Never buy one from someone before they demonstrate in front of you the device is removed from the device list/FindMy.