If the Surface was properly reset before shipping, no password should be required from the previous owner.
To securely prepare a Windows device (including Surface) before selling or gifting, the supported method is:
- Back up any personal data that needs to be kept.
- On the device, go to Start > Settings > System > Recovery (or in Windows 10: Settings > Update & Security > Recovery).
- Under Reset this PC, select Reset PC.
- Choose Remove everything.
- When offered, enable the option to clean the drive (this makes it harder to recover removed files).
- Complete the reset so the device boots to the out-of-box setup screen (no user account, no password).
If this full reset with “Remove everything” and drive cleaning was already completed before shipping, there is no need to provide any password; the buyer should complete the initial Windows setup with their own account and password.
Remote “cleaning” after the device has been sold is not supported for consumer-owned Surfaces unless the device is managed via enterprise tools (for example, using the RemoteWipe CSP in a managed environment). In a typical personal/consumer scenario, the only supported way to ensure data removal is the local reset performed before handing over the device.
If there is concern that the reset might not have been done correctly, the safest option is to ask the buyer to perform a new reset themselves using the same Reset this PC > Remove everything path from Settings.
References: