If it was an Android phone, did you make sure that the phone was factory reset and disassociated completely from your Google account? If you don't detach your Google account properly, it would remain locked to you forevermore.
If it was an iPhone, something similar with signing out of iCloud and doing a factory reset.
If it's returned, just make sure the serial number matches up before issuing a refund and make sure it doesn't look like any parts have been swapped or removed like screens swapped for cheaper non original versions etc.
In 2023 nobody should really be selling phones to other random individuals in my opinion, not unless you know how to wipe the phones completely first, and not just a factory reset. They contain your life most of the time!