At&t Lost Phone Question

So a friend bought a phone from from a facebook friend a month ago. They now see that same friend selling the exact same phone online again. After talking to them for a bit, it looks like the seller is planning on reporting they dropped the phone in a lake while fishing so they can pay the insurance deductible and sell another phone.

My question is, how screwed is my friend? Are they going to blacklist the phone he purchased? If so, what are his options at that point? Can it be removed from the blacklist or is it bricked forever?