Turns out he downloaded a scam wallet (sparrow mobile) while trying to set up a "watch only" wallet. It asked for the wallet descriptor which is essentially everything a new wallet needs to spend UTXO's from the old wallet. So it was not a "watch only" wallet at all.

A fairly advanced scam which relies on:

1) The user not knowing there is no Sparrow mobile wallet

2) The user not knowing what wallet descriptors are

Always verify your downloads. In this case the user could have noticed the scam by not finding the mobile release on Craig Raw's trusted release listings while trying to verify with PGP.