I would say yes, she's been conned. BT would not ask for that sort of info, and would not charge £200. The fact they now have DoB and mother's name is worrying - if she does any online banking, she should change password and memorable info, as a precaution. As she paid by credit card, she should speak to her card provider - if she can convince them that she has been conned, she should get a refund.
HTC U12 Plus review: Hands-on