PanicStation.org
UK USA
us Legal, police, prison & official contact

What to do if…
a regulator or official asks you to provide passwords or passcodes during an inquiry

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Pause before sharing or entering any password, passcode, device PIN, authentication code, or biometric unlock. Ask for the request and its legal basis in writing, then contact a lawyer or your organization’s legal contact promptly. Do not ignore paperwork, assume a request is optional just because it is not called a subpoena, or physically interfere.

Do not do these things

  • Don’t disclose or enter your password, device PIN, passcode, or authentication code just to make the moment easier.
  • Don’t approve an authenticator prompt or use a fingerprint, face scan, or other biometric unlock voluntarily before getting advice.
  • Don’t navigate through a device or account, run searches, export data, create temporary access, or change permissions unless legal counsel and authorized IT or security staff coordinate the specific step.
  • Don’t delete messages, wipe devices, reset accounts, change passwords, or clean up files after contact unless legal counsel and authorized IT or security staff coordinate the specific step.
  • Don’t lie, guess, or volunteer extra accounts, devices, or background details because you feel rushed.
  • Don’t ignore a written demand, response date, or contact deadline.
  • Don’t physically resist, obstruct, or interfere if officials say they are taking a device or acting under legal authority.

What to do now

  1. Ask for the request in writing. Calmly say:
    “I want to respond appropriately. Please give me the written request, its legal basis, the scope, any deadline, and the contact details for the person handling it.”
  2. If you are asked to unlock something immediately, pause voluntary cooperation. You can say:
    “I am not agreeing voluntarily to provide credentials, approve access, or unlock anything before I get legal advice.”
  3. Record who is asking and what they showed you. Note the person’s name, agency, contact details, case or reference number, and whether the request is described as voluntary or compulsory. Keep a copy or photo of any civil investigative demand, subpoena, warrant, court order, or other written request if you are permitted to do so.
  4. Contact a lawyer promptly. If the request concerns work systems, send it to your organization’s legal or compliance contact and tell the appropriate IT or security contact that legal review is needed before any technical action. If you are in custody or officials are present, state that you want legal advice before answering credential questions. Do not argue or physically interfere.
  5. Preserve devices and accounts as they are. Keep relevant devices, messages, files, and accounts available. Do not delete, reset, search, export, reorganize, or alter them unless legal counsel and authorized IT or security staff coordinate the specific step.
  6. Route any deadline immediately. A request may still require a prompt response even if it is not called a subpoena. If a written request includes a response date or an urgent demand, send it to counsel at once. Do not assume that asking for advice means the request or deadline can be ignored.
  7. Write a neutral note of what happened. Record when the request was made, what access was requested, what papers were shown, what you said, and whether any device was taken.

What can wait

  • You do not need to decide in the moment how data should be produced, whether an account should be accessed, or whether a device should be unlocked.
  • You do not need to provide a full explanation, background story, or list of extra accounts and devices while you are trying to get advice.
  • You do not need to make technical changes, run searches, create exports, or arrange temporary access before the written scope has been reviewed.

Important reassurance

It is reasonable to pause before giving access to a device or account. A password, passcode, authentication prompt, or biometric unlock can expose much more than one document, and the appropriate response can depend on the type of request and the facts.

Scope note

These are first steps only. Regulator powers and the right response can vary depending on the agency, the written request, the setting, and whether there is a parallel criminal issue. Some regulated entities may have duties to provide certain records without a subpoena. A lawyer can help you respond without ignoring a valid demand or disclosing more than is required.

Important note

This is general information, not legal, medical, financial, therapeutic, technical, or other professional advice. Get legal advice promptly if a regulator asks for credentials, device access, account access, or an unlock during an inquiry.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us