Fall of 2021? I’m surprised the phone hasn’t already been stripped for parts.

It’s possible the person that has your phone is telling the truth. It’s also possible that they’re the one that stole your phone or know the person that did. Regardless, don’t send them your Apple ID password under any circumstances and don’t send them money hoping they’ll ship you the phone.

Like mentioned earlier, ask them to ship you the phone for free so you can get your photos and remove the activation lock/factory reset it. I doubt they will but if they do send it for free they’re more than likely telling you the truth. After that it’s up to you if you want to send your phone back to them. At the end of the day it is your phone despite the other persons circumstance.