It appears he is using two factor authentication which uses a trusted number and devices for password resets.
While their online support article says for forgotten password, account recovery steps are also for a new phone number if you can’t sign in to update the number. See "To see, add, or change your trusted phone numbers" at Two-factor authentication for Apple ID - Apple Support and How to use account recovery when you can’t reset your Apple ID password - Apple Support
When going thru the account recovery steps you need to first enter in that old number to show you know it. Then when you get to the step where it says it sent a code to that old number select the option most like “didn’t get code” and it will let you continue with your current number.
Always scroll down for additional options in small blue print if the ones showing don’t apply to/work for you.
When starting the account recovery steps the credit card is an extra option and not required. (See prior tip)
Account recovery is a two phase process once started. Phase 1 is the evaluation period, usually 24-72 hours but can be longer or shorter. This phase says Apple is evaluating your info and you’ll get an update after the posted time is over (people mistakenly think it means they’ll be able to reset the password immediately after this first phase.)
Once phase 1 is done it enters phase 2 where https://iforgot.apple.com/ will give you the final amount of days (can be weeks) you’ll wait. On that final day you’ll get a text/email, follow that text/email immediately.
