I recently had a similar issue. Bought one from craigslist from a Guy who found the phone on a car at his dealership.
I took it home, used my daughters charger to get enough power to turn it on and low and behold its locked (security/user pw lock).
Spent about 5 hours browsing online for a unlock code, then another few hours with a att rep.
*** ATT cannot help. ***
You have two options.
Start entering numbers and hope you get lucky (good luck), or call samsung.
I called samsung and told them the problem, they emailed me a shipping label and told me to send it in for a reflash.
Didnt cost me a dime and turn around was 8 days (from indiana to pablo texas and back).
Something noteworthy...
ATT does not care where you got the phone, and they cannot "lock out" stolen/lost phones, only the sim cards. Unlike cdma phones (verizon etc.). So please think about using the security lock feature as most dirtbags most likely go through the hassle of sending it in.
The impression I bought even had the sim card in it. I put it in another phone and called the original owners father to give it back(Dad in the contact list lol). The guy was in jail, the dad claimed it lost on his insurance and told me to enjoy my new phone.

Works great I might add. Posting this from it now!
enjoy