Stolen phone, Fake Apple Support Message, Clicked and entered icloud pw

My Son's phone was stolen. He did not have Find my turned on. We got location notifications for awhile but then it stopped. Few days later got a Apple Support Message saying phone was found and location would only be available for 24 hours. He called Apple Support and 2 Reps told him message was good. So he clicked on it and it asked for icloud password which he put in. He did not have icloud back up turned on either.

Can his phone pin code be changed from the icloud?

Also today he got a message showing his phone was still attached to his icloud account. The Message had a screen shot of his phone with the about information on it including imei phone number serial number it said if in red letters to remove from account or if didn't recognize the phone to remove device and change passcode.