Yes it can be done. No you won't get HSPA+.
There are two problems. The phone has to be fully paid for (as far as AT&T is concerned - if it's on a plan the balance of the plan has to be paid before they'll give you the unlock code). And buying a phone on Craig's List, unless you meet the person at an AT&T store and have them remove it from his account before you pay for it, is usually a scam. (And once they remove it from his account, unless you get an AT&T account, they won't give you the unlock code, so he has to get it unlocked before you buy it - be sure to bring a non-AT&T SIM with you to make sure it's unlocked.)
The phone could be defective in some way not covered by the warranty - water damage, he tried to flash a ROM to it and messed up, etc. He sells you the phone, waits a week and reports it stolen. The phone can no longer be used on any carrier, and he gets a replacement phone and your money. (It's not quite as old as a Ponzi scheme, but it's as well known.) If he has AT&T take it off his account before he gets your money, he can no longer report it stolen - it's not his phone as far as AT&T is concerned, so they won't accept his report.