Hmmm... perhaps the auditor should be informed that if he persists in requesting for user account and passwords in the guise of a security audit, you will have

Hmmm... perhaps the auditor should be informed that if he persists in requesting for user account and passwords in the guise of a security audit, you will have no choice but to report him to the FBI or MI5 as a suspected phishing scam operator who may have already compromised prior clients in similarly.