"Passwords/PINs should be on the devices themselves (as well as on services such as voicemail) and these should be changed from time to time." . . . .