Thieves opened iPhone - twice

In both cases, the phone was locked when stolen

There is no way that anyone could guess the correct passcode in the 10 tries that are allowed before the phone locks out completely.

If you are thinking that the thieves had some kind of special software to bypass the passcode lock on the phone....that is not the case. This type of software simply does not exist.

But, I suppose it is possible that someone was looking over your son's shoulder when he entered his passcode. Thieves call this "shoulder surfing".

Unfortunately, this is sounding more like your son received a scam message from the thieves.....(posing as Apple or Apple Support) requesting personal information so his identity could be verified and the phone returned to him. When the information is provided, this in effect gives the keys to the kingdom to the thieves.

Apple does not get involved with lost or stolen phones, so you know that any message from "Apple" is a scam.

The bottom line......NEVER.....respond to a message that is asking for personal information.

Some people also use easily guessed passcodes, like their birthday. Or carry a piece of paper with passwords written on it, which can be a disaster if a thief gets ahold of that piece of paper.

If the phone was locked, there is no way that someone could access it. Some people have a bad habit of just putting their phone in their back pocket without locking it and for a short amount of time before it auto locks, a thief would be able to access the information on the phone if they pulled it out of your pocket. Locking it is easily done just by pressing the side button.

In other cases a person may provide their phone number when it is marked as lost and a thief will send them a message claiming to be from Apple requiring their credentials. The thief will then be able to unlock the phone and remove it from Find My.

I believe you get 10 (?) tries at entering the correct passcode before the phone locks up, and the only way back in is a reset + erase.

With a randomly chosen, six digit passcode, odds are 999,990 out of 1,000,000 that the thieves are locked out of seeing your data. Assuming that the phone was locked when stolen and that the thieves did not know - or trick / force you into revealing the credentials.

(And that your Apple ID password is secure.)

Did your son get emails or text messages telling him that his phone had been found and he just needed to log into his iCloud account via a link helpfully provided in the message……..?