Turning it into "lost and found" was just fine. You could, and probably someone will, go into the contact list and call a couple numbers listed, maybe it's labeled "home" or "mom and dad," or something, to try to track down the owner. I lost my cell phone a few years back, and they went into the address book and called "home," and I was able to retrieve my phone. Even if no one goes in and tries to call people in the contact list, this person surely knows they might have lost their phone at the mall and will be calling to see if anyone found it and turned it in. And I think that's the best choice is to leave it in the location you found it, turn it in to lost and found. Let the chips fall where they may at this point.