I was outsourced. Can former co-worker keep requesting passwords?

Question

Three months ago, I was suddenly (for me) told I was outsourced, a business decision. After this, I got vacation, etc. plus a severance.

It was sudden for me, but upon reflection I realize they were quiet about firing me, because the consulting company kept asking for server, information and passwords, etc., and then I discovered I was being excluded from meetings I should have been included on that my former coworker was included on.

My former coworker keeps asking me for passwords. A few I remembered and provided, and I know other passwords were documented on the laptop computer I ethically returned.

I'm no longer an employee, so I think from now on my answer should be 'No.' On some previous requests I simply did not reply and the requested information was found anyway.

Particularly for today's request which I really don't remember anyway and it's annoying because I am no longer an employee!

I am sure I documented it and they will find it.

This coworker offered to provide a reference (he claimed to be surprised what happened. I actually think he was in on it, but I don't have any proof), so I also feel like I have to stay on his good side. I only have two other references.

Answer 1

If it wasn't part of the severance agreement, I don't think you are required to do anything for that company.

You can even make a claim that information security policies prevent you from doing so because you have no way to verify that are entitled to that information after you left the job. If they use your passwords, they might later blame you if something goes wrong if the password transfer is not documented.

Answer 2

You have left this company. Your only response now should be "I do not remember, nor do I have saved copies of, any passwords".

Make that true; if you have a 'password book', delete it. If you have 2FA for any systems, remove the 2FA item from your device. If you know a password to a system, and could potentially still access it, then you would be prime suspect if that system were ever compromised. Do not let yourself be caught in that situation.

Answer 3

You are no longer employed by them.

Either get them to pay you for your consultancy OR refuse further contact.

Answer 4

I was outsourced, can former co-worker keep requesting passwords?

You are asking the wrong question. Obviously, former co-workers can ask for anything.

Instead you should be asking if you should supply passwords when asked.

The answer is clearly "No".

First, you are no longer employed there so it clearly isn't your job. Second, you shouldn't even know the current passwords - they should have been changed when you left.

Either ignore the requests, or just say "No".

Answer 5

Since it sounds as though you did a proper handover of your passwords etc when you left you can just respond politely:

All the login & password information I had has already been provided to X as part of my handover.

This is of course assuming you want to be polite - at this point you can just ignore them. If there's any login info you didn't provide at handover then refusing to engage can put you in a difficult position but if they (i.e. your former employer) has everything one way or another you can block/ignore the requests and carry on with the next phase of your career with a clear conscience and a spring in your step.

Answer 6

The appropriate way to answer this is:

I'm sorry, but I transferred all information and knowledge, including passwords, when my employment was terminated. Please do not continue to ask about this information, as I am no longer an employee of [company]. Further requests will not be answered.

This should be reasonably polite and not burn bridges with anyone who is being reasonable. Of course, there's no saying how it will be received by the specific person here, and they might not be reasonable.

Answer 7

If you are asked for a password, then ask yourself: Am I supposed to know that password? Normally when you leave your access to anything should be locked down, and the passwords that you know should be worthless. I wouldn't admit to knowing any passwords.

Answer 8

My former co-worker keeps asking me for passwords. A few I remembered and provided,

This was your first mistake. You should have said that you didn't remember them the very first time you were asked. And you should have repeated a similar phrase every time the same request was made.

I think from now on my answer should be 'No.'

Now your answer should be: "I've given you a notebook with all my passwords, and I've told you everything I could remember."

Be a broken record if you have to. It's not that difficult. Just don't adjust your response and don't try to justify yourself to try to gain his approval, otherwise, his requests will keep on coming.

But at the same time, take him up on his offer to give you a reference before his offer evaporates. Ask for a LinkedIn reference and offer to write a LinkedIn reference in return. https://www.themuse.com/advice/your-5minute-guide-to-writing-an-amazing-linkedin-recommendation

Worst case scenario, his LinkedIn reference is not that good and you don't show it on your profile since you have the power to hide it if you don't like it. Best case scenario, he writes you a pretty good LinkedIn reference. Also, if any potential employer calls him, he will feel obligated to stick to what he wrote on your LinkedIn just to be consistent.

(claimed to be surprised what happened, I actually think he was in on it but I have no proof)

So who cares if he was in on it?

Are you really telling us that if the situation had been reversed you would have told your colleague about the upcoming replacement?

And yes, he could be lying to you about his prior knowledge. But again, people tell each other white lies all the time. I'm sure you have as well.

I understand the hurt of being laid off, but do try to let go of that bitterness. It doesn't do you any good to blame him. Take him up on his offer and ask for a LinkedIn reference, but do tell him that you don't remember the passwords, which is the truth anyway. And to make the situation reciprocal, offer to give him a good LinkedIn reference in return.

But if he asks you anything else that's work related, just spell it out for him. "If this LinkedIn recommendation is contingent on me remembering a three months old password, then don't write one for me, because I can not give you what I don't remember". Or if he asks only about work, say: "If this LinkedIn recommendation is contingent on me consulting for free for a former employer three months after I was laid off from that employer, then please don't write such a recommendation for me."

And if you're still have trouble saying "No", I'd suggest you read this book When I Say No, I Feel Guilty by Manuel J. Smith. Personally, that book changed my life.

Answer 9

Whether you documented the passwords or not, password management is an organization responsibility, not the responsibility of a singled employee. You owe them nothing more. If it were me, I'd simply ignore the requests.

Answer 10

I was outsourced, can former co-worker keep requesting passwords?

They can request whatever they want, that doesn't mean that you need to honor or acknowledge their requests in any way.

I have left companies where former coworkers would occasionally message or call me asking for work related help after I had left. The former coworkers that I kept in touch with and had good relationships with I had no issue helping them at all. The former coworkers that I did not care for, I never replied to their messages or answered their calls.

As for the reference, anyone offering a reference on the condition of your continued help after you have left the company is not worth it.

Answer 11

From now on assume you do not have any passwords.

First, they should have rotated them once you left.

You are probably in legal breach if you keep company information with you.

Finally, I would never accept a contract gig (as suggested elsewhere) for such assignments - you reveal that you kept that information and did not provide it at handover.

Do not reply to their requests, wait for a legal request that will never come because it makes absolutely no sense.

Answer 12

When you say "outsourced", do you actually mean outplaced (i.e. dismissed), or do you mean you have been transferred to another employer but continue to provide services to your old employer?

If you're not working for your old employer at all anymore, and if you've parted on amicable terms, then it isn't impolite for your colleague to make perhaps one or two brief and non-urgent queries over the following few months.

Compare this to the few moments that might be required to send out a prepared written reference, or field a telephone call from a new employer seeking a reference.

Obviously, they must expect your memory to start to fade, and that contacting ex-employees is a last resort.

Also, if the questions are indeed spurious or used as a shortcut for only modest work, it might be appropriate to remind them that you are no longer employed there. "Come on, John, they let me go three months ago! I'm sure you could figure this out yourself. I like to do favours, but I only really want to be contacted as a last resort.".

If the real problem is that you don't really have amicable feelings about your old employer (or indeed this particular colleague), then it might be appropriate to broach that directly. "You know, John, I was quite surprised to be let go, and I wasn't really happy about it, so I'd like to put it all behind me. You've contacted me X times already about my old work, and I really think this should be the last time".

Answer 13

It's reasonable to ask a former employee for a password when the parting was amicable - you'd want someone to return the favor if you were in a tough situation. But this is the kind of thing that should only happen once, under dire circumstances (the password cannot be retrieved or reset any other way).

It sounds like you've been more than generous about this, and they need to respect your ability to move on.

Answer 14

Usually, the answer is no, but there are exceptions.

Plenty of answers have already explained the most common case which is that you should not have to provide a password to a person who no longer employs you, but this is not always the case. The big exception to this is when your job involves non-core products. Your company probably had all sorts of company wide products everyone uses. Office 365, G Suite, etc. These are things thier IT department should have set up for you when you got there, and that the IT department should be able to properly handle when you leave with or without your cooperation.

However, there are also cases where you may have personally set up products that other employees had nothing to do with at all (due to the unique requirements of your position) and no way of recovering on thier own. Maybe you were the only one who ever had those credentials. Maybe you set up something and the 2FA for it is only on your phone. Things like that can keep an IT team from taking control of the company's intellectual property, even after you've turned in your physical equipment.

In cases like this, you may have a legal requirement to comply after your employment is terminated. In all likelihood, your contract contained language saying that anything you developed in the employment of that business is thier intellectual property and that it must be turned over at the end of employment. So, if these systems they are asking about would constitute a meaningful failure on your part to turn over thier intellectual property, then refusing to give them the credentials could be seen as Intellectual Property Theft which is a crime punishable with both lawsuits and jailtime in many parts of the world.

There are also other cases where special laws may come in based on the type of information protected by those credentials. Accusations of Intellectual Property Theft can become much more severe if the intellectual property involved contains financial, medical, classified, or personally identifying information.

So when in doubt, it is usually best to comply anyway.

Limitations

Once you turn over the information once, your responsibility is fulfilled. If they are contacting you over and over for the same credentials, then feel free to refuse to answer thier further questions, but if they keep contacting you about different credentials each time, then you should provided them with those credentials and confirm thier ability to access the account each time until all platforms that you used in their employment are properly turned over.

Answer 15

The OP is being altruistic, that's natural. He is trying to help out the folks he worked with even though the org rather abruptly outsourced him. It shows good character and reflects well on him.

Boring IT policy issues about password management aside, it's OK to help out former coworkers with an occasional piece of information for a few weeks after leaving. Any more than that, however, and the OP risks being taken advantage of.

If he wants to help out further, the best course of action is to ask the former employer to set-up a consulting agreement with a significant hourly rate and hard limits on the number of hours you help them. What that rate is depends on locale, but for a US based tech firm, it could easily be $200+/hr.

Answer 16

Of course your former co-worker can ask you for passwords, how else do they know if you could be trusted with passwords, and give you a good reference.

My former coworker keeps asking me for passwords. A few I remembered and provided [...] This coworker offered to provide a reference (he claimed to be surprised what happened. I actually think he was in on it, but I don't have any proof), so I also feel like I have to stay on his good side. I only have two other references...

LOL! ROFL! Now you are certain to be getting a strong negative reference, expect your employment to be listed on your credit report for the next few years and kiss your current career BYE-BYE! You just gave sensitive information to someone potentially not authorized, you fell for their trap and now you will have to pay the price, you may even be subject to legal consequences.

I once worked for someone who didn't like me... turns out they hired me for a few hours just so they could list themselves on my credit report and be a negative referral. Trust me, once they get on your credit report, there is no saving your career, it is over. In the USA they can say whatever they want so long as you can't prove it to be false (i.e. slander). If you emailed or communicated the passwords over a phone line then they have actual proof. Seeing as how your employer and coworkers did not like you, none of these things happening to you would surprise me.