at this point changing the password wont do any good. the guy had it, she's deposited money. so if he is scamming then he prolly already has bank account numbers and who knows what else she had to provide.