If I were using this system I would just have all devices locked by default, and at point of sale the bar code gets scanned, the DB gets updated and when the us

If I were using this system I would just have all devices locked by default, and at point of sale the bar code gets scanned, the DB gets updated and when the user boots up their phone for the first time and connects to the internet it verifies the sale. Maybe that's prone to false positives, so maybe they only manually mark phones as stolen, but it wouldn't be difficult.