Stolen phone

Are you absolutely SURE that she didn’t setup additional trusted numbers?

This is precisely the situation for which they are intended.

To confirm: On the login page where prompted to enter 6-digit Verification Code … click on the link “Didn’t Receive Code ?”

Any additional trusted number(s) will be listed - partially obscured - here.

See:

Get a verification code and sign in with two-factor authentication - Apple Support

The best solution will probably be to contact Apple Support for 1:1 advice and help from Apple. Start with the online link, but be prepared to need proof like the original purchase documents for the stolen phone and maybe some other proof of identity.

Of course, you should also report the theft to your phone network, to get the stolen SIM deactivated and a replacement issued with the same number for a new phone. That would also solve the problem of the SMS authentication check messages.

Additionally, and to hopefully allay any anxiety, her phone is VERY securely protected - even from sophisticated criminals (and probably most governments) - by it’s passcode.

There’s no compelling need to change her AppleID password.

HOWEVER: DO be on-guard for Phishing messages from the criminals attempting to steal her credentials.

These are NEVER from Apple or any legitimate entity.

Don’t reply and don’t follow the links they normally contain.

Lastly, work thru this to-do list; although NEVER perform the final “Step 7.”

If your iPhone, iPad, or iPod touch is lost or stolen - Apple Support