I've bought a phone in good faith but the owner has forgotten their apple id and password. Please help. It was bought for my sons birthday.

Regrettably, you're out of luck. It may be a stolen device or may not have belonged to the seller (it could also be just fine and someone wanted to get rid of it). You could try filing a police report or escalate the issue to whatever marketplace you used to make the purchase.

Return it. It will never work unless the original owner can unlock the device.