They don't even need to call. There are services out there that thieves can use to send a text to a victim whose iPhone has been stolen (obviously, after they've replaced it or are using a temporary phone).

The text purports to be from Apple, saying "we've located your iPhone!" and then directs them to click a link to a fake web page asking for their Apple ID and password. Once the thieves have that, they can log into the real iCloud page and remove activation lock on the phone.

Your friend should change her iCloud password ASAP.

Here's an article that describes it in more detail.

In general, any time you misplace your phone or it's stolen, you should NEVER directly click on links sent to you via text message that claim to be from Apple. To try and track your phone, you should manually navigate to iCloud.com and log in that way.