Welcome to the Android Central Ask A Question forum!
Without her password to wipe the data, you can do nothing with the phone. That security is there for a purpose, mainly, to reduce the possibility of a thief being able to use a stolen device. Might ask her to refund the money and send the phone back to her. If she can't remember the password to an account she uses to sign in her own phone, I'd wonder if she didn't sell you a stolen device.
If you need additional help or have more questions or details to share, please join the site so you can reply in this thread. See
this link for instructions on how to join Android Central.